CISA Known Exploited Vulnerabilities
KEV additions — November 2024
21 CVEs entered the KEV catalog in November 2024.
Added November 25, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-28461ransomware | Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability | 9.8 | 87.2 % | December 16, 2024 |
Added November 21, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-21287 | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | 7.5 | 69.8 % | December 12, 2024 |
| CVE-2024-44308 | Apple Multiple Products Code Execution Vulnerability | 8.8 | 1.9 % | December 12, 2024 |
| CVE-2024-44309 | Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability | 6.1 | 1.0 % | December 12, 2024 |
Added November 20, 20242
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-38812 | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | 9.8 | 77.9 % | December 11, 2024 |
| CVE-2024-38813 | VMware vCenter Server Privilege Escalation Vulnerability | 7.5 | 31.1 % | December 11, 2024 |
Added November 18, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-0012ransomware | Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability | 9.8 | 94.3 % | December 9, 2024 |
| CVE-2024-1212 | Progress Kemp LoadMaster OS Command Injection Vulnerability | 9.8 | 94.3 % | December 9, 2024 |
| CVE-2024-9474ransomware | Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability | 7.2 | 94.2 % | December 9, 2024 |
Added November 14, 20242
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-9463 | Palo Alto Networks Expedition OS Command Injection Vulnerability | 7.5 | 94.2 % | December 5, 2024 |
| CVE-2024-9465 | Palo Alto Networks Expedition SQL Injection Vulnerability | 9.1 | 94.3 % | December 5, 2024 |
Added November 12, 20244
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-26086 | Atlassian Jira Server and Data Center Path Traversal Vulnerability | 5.3 | 94.2 % | December 3, 2024 |
| CVE-2021-41277 | Metabase GeoJSON API Local File Inclusion Vulnerability | 7.5 | 94.4 % | December 3, 2024 |
| CVE-2024-43451 | Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability | 6.5 | 89.9 % | December 3, 2024 |
| CVE-2024-49039ransomware | Microsoft Windows Task Scheduler Privilege Escalation Vulnerability | 8.8 | 66.4 % | December 3, 2024 |
Added November 7, 20244
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-16278 | Nostromo nhttpd Directory Traversal Vulnerability | 9.8 | 94.4 % | November 28, 2024 |
| CVE-2024-43093 | Android Framework Privilege Escalation Vulnerability | 7.3 | 0.1 % | November 28, 2024 |
| CVE-2024-51567ransomware | CyberPanel Incorrect Default Permissions Vulnerability | 9.8 | 94.3 % | November 28, 2024 |
| CVE-2024-5910 | Palo Alto Networks Expedition Missing Authentication Vulnerability | 9.8 | 91.0 % | November 28, 2024 |
Added November 4, 20242
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-8956 | PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability | 9.1 | 83.6 % | November 25, 2024 |
| CVE-2024-8957 | PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability | 7.2 | 55.5 % | November 25, 2024 |