CISA KEV · exploited vulnerabilities

InformationCISA KEV · updated 3h ago

Known Exploited Vulnerabilities from CISA, cross-referenced against ingested MENA cases. “MENA-relevant” means a CVE surfaced in a tracked case — not the full undifferentiated catalog. Each carries a remediation priority (P1–P3) so it's clear which to patch first, and why. For direct SIEM/SOAR ingestion, the same data is available as a machine-readable JSON feed →.

Sort

MENA-RELEVANT FULL CATALOG

50 of ~1,722

Comfortable Compact

CVECVE-2025-0108

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks · PAN-OSremediation: past CISA due date

ATT&CKT1190exploitation T1055primary impact T1565.001primary impact

P2added 2025-02-18due 2025-03-11

⋮

CVECVE-2024-57727

SimpleHelp Path Traversal Vulnerability

SimpleHelp · SimpleHelpremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1552.001primary impact T1552.004primary impact T1003primary impact T1059secondary impact

P1added 2025-02-13due 2025-03-06

⋮

CVECVE-2024-41710

Mitel SIP Phones Argument Injection Vulnerability

Mitel · SIP Phonesremediation: past CISA due date

ATT&CKT1068exploitation T1059primary impact

P2added 2025-02-12due 2025-03-05

⋮

CVECVE-2025-24200

Apple iOS and iPadOS Incorrect Authorization Vulnerability

Apple · iOS and iPadOSremediation: past CISA due date

P2added 2025-02-12due 2025-03-05

⋮

CVECVE-2024-40890

Zyxel DSL CPE OS Command Injection Vulnerability

Zyxel · DSL CPE Devicesremediation: past CISA due date

ATT&CKT1055exploitation T1011primary impact

P2added 2025-02-11due 2025-03-04

⋮

CVECVE-2024-40891

Zyxel DSL CPE OS Command Injection Vulnerability

Zyxel · DSL CPE Devicesremediation: past CISA due date

ATT&CKT1055exploitation T1011primary impact

P2added 2025-02-11due 2025-03-04

⋮

CVECVE-2025-21391

Microsoft Windows Storage Link Following Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1068exploitation T1485primary impact T1490primary impact

P2added 2025-02-11due 2025-03-04

⋮

CVECVE-2025-21418

Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1068exploitation T1055primary impact T1005primary impact

P2added 2025-02-11due 2025-03-04

⋮

CVECVE-2025-0994

Trimble Cityworks Deserialization Vulnerability

Trimble · Cityworksremediation: past CISA due date

ATT&CKT1068exploitation T1059primary impact

P2added 2025-02-07due 2025-02-28

⋮

CVECVE-2020-15069

Sophos XG Firewall Buffer Overflow Vulnerability

Sophos · XG Firewallremediation: past CISA due date

P2added 2025-02-06due 2025-02-27

⋮

CVECVE-2020-29574

CyberoamOS (CROS) SQL Injection Vulnerability

Sophos · CyberoamOSremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1055exploitation T1059primary impact

P1added 2025-02-06due 2025-02-27

⋮

CVECVE-2022-23748

Dante Discovery Process Control Vulnerability

Audinate · Dante Discoveryremediation: past CISA due date

ATT&CKT1203exploitation T1059exploitation

P2added 2025-02-06due 2025-02-27

⋮

CVECVE-2024-21413

Microsoft Outlook Improper Input Validation Vulnerability

Microsoft · Office Outlookremediation: past CISA due date

ATT&CKT1566.002exploitation T1059primary impact

P2added 2025-02-06due 2025-02-27

⋮

CVECVE-2025-0411

7-Zip Mark of the Web Bypass Vulnerability

7-Zip · 7-Zipremediation: past CISA due date

ATT&CKT1566.001exploitation T1553.005exploitation T1588.001primary impact

P2added 2025-02-06due 2025-02-27

⋮

CVECVE-2024-53104

Linux Kernel Out-of-Bounds Write Vulnerability

Linux · Kernelremediation: past CISA due date

ATT&CKT1091exploitation T1068exploitation T1059primary impact

P2added 2025-02-05due 2025-02-26

⋮

CVECVE-2018-19410

Paessler PRTG Network Monitor Local File Inclusion Vulnerability

Paessler · PRTG Network Monitorremediation: past CISA due date

P2added 2025-02-04due 2025-02-25

⋮

CVECVE-2018-9276

Paessler PRTG Network Monitor OS Command Injection Vulnerability

Paessler · PRTG Network Monitorremediation: past CISA due date

P2added 2025-02-04due 2025-02-25

⋮

CVECVE-2024-29059

Microsoft .NET Framework Information Disclosure Vulnerability

Microsoft · .NET Frameworkremediation: past CISA due date

ATT&CKT1068exploitation T1059primary impact

P2added 2025-02-04due 2025-02-25

⋮

CVECVE-2024-45195

Apache OFBiz Forced Browsing Vulnerability

Apache · OFBizremediation: past CISA due date

ATT&CKT1133exploitation T1203exploitation T1059primary impact T1498.001secondary impact

P2added 2025-02-04due 2025-02-25

⋮

CVECVE-2025-24085

Apple Multiple Products Use-After-Free Vulnerability

Apple · Multiple Productsremediation: past CISA due date

ATT&CKT1068exploitation T1059primary impact

P2added 2025-01-29due 2025-02-19

⋮

CVECVE-2025-23006

SonicWall SMA1000 Appliances Deserialization Vulnerability

SonicWall · SMA1000 Appliancesremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1059primary impact

P1added 2025-01-24due 2025-02-14

⋮

CVECVE-2020-11023

JQuery Cross-Site Scripting (XSS) Vulnerability

JQuery · JQueryremediation: past CISA due date

P2added 2025-01-23due 2025-02-13

⋮

CVECVE-2024-50603

Aviatrix Controllers OS Command Injection Vulnerability

Aviatrix · Controllersremediation: past CISA due date

ATT&CKT1055exploitation T1059primary impact

P2added 2025-01-16due 2025-02-06

⋮

CVECVE-2024-55591

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet · FortiOS and FortiProxyremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1068exploitation T1555primary impact T1078primary impact T1021secondary impact

P1added 2025-01-14due 2025-01-21

⋮

CVECVE-2025-21333

Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1068exploitation T1003primary impact

P2added 2025-01-14due 2025-02-04

⋮

CVECVE-2025-21334

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1068exploitation T1003primary impact

P2added 2025-01-14due 2025-02-04

⋮

CVECVE-2025-21335

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Microsoft · Windowsremediation: past CISA due date

ATT&CKT1068exploitation T1003primary impact

P2added 2025-01-14due 2025-02-04

⋮

CVECVE-2023-48365

Qlik Sense HTTP Tunneling Vulnerability

Qlik · Senseremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1133exploitation T1059primary impact

P1added 2025-01-13due 2025-02-03

⋮

CVECVE-2024-12686

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

BeyondTrust · Privileged Remote Access (PRA) and Remote Support (RS)remediation: past CISA due date

ATT&CKT1068exploitation T1059exploitation

P2added 2025-01-13due 2025-02-03

⋮

CVECVE-2025-0282

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gatewaysremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1595exploitation T1190exploitation T1055primary impact T1003primary impact T1046secondary impact T1018secondary impact

P1added 2025-01-08due 2025-01-15

⋮

CVECVE-2020-2883

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Serverremediation: past CISA due date

P2added 2025-01-07due 2025-01-28

⋮

CVECVE-2024-41713

Mitel MiCollab Path Traversal Vulnerability

Mitel · MiCollabremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1068exploitation T1005primary impact

P1added 2025-01-07due 2025-01-28

⋮

CVECVE-2024-55550

Mitel MiCollab Path Traversal Vulnerability

Mitel · MiCollabremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

ATT&CKT1190exploitation T1005primary impact T1041secondary impact

P1added 2025-01-07due 2025-01-28

⋮

CVECVE-2024-3393

Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

Palo Alto Networks · PAN-OSremediation: past CISA due date

P2added 2024-12-30due 2025-01-20

⋮

CVECVE-2021-44207

Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

Acclaim Systems · USAHERDSremediation: past CISA due date

P2added 2024-12-23due 2025-01-13

⋮

CVECVE-2024-12356

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

BeyondTrust · Privileged Remote Access (PRA) and Remote Support (RS) remediation: past CISA due date

P2added 2024-12-19due 2024-12-27

⋮

CVECVE-2018-14933

NUUO NVRmini Devices OS Command Injection Vulnerability

NUUO · NVRmini Devicesremediation: past CISA due date

P2added 2024-12-18due 2025-01-08

⋮

CVECVE-2019-11001

Reolink Multiple IP Cameras OS Command Injection Vulnerability

Reolink · Multiple IP Camerasremediation: past CISA due date

P2added 2024-12-18due 2025-01-08

⋮

CVECVE-2021-40407

Reolink RLC-410W IP Camera OS Command Injection Vulnerability

Reolink · RLC-410W IP Cameraremediation: past CISA due date

P2added 2024-12-18due 2025-01-08

⋮

CVECVE-2022-23227

NUUO NVRmini2 Devices Missing Authentication Vulnerability

NUUO · NVRmini2 Devicesremediation: past CISA due date

P2added 2024-12-18due 2025-01-08

⋮

CVECVE-2024-55956

Cleo Multiple Products Unauthenticated File Upload Vulnerability

Cleo · Multiple Productsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2024-12-17due 2025-01-07

⋮

CVECVE-2024-20767

Adobe ColdFusion Improper Access Control Vulnerability

Adobe · ColdFusionremediation: past CISA due date

P2added 2024-12-16due 2025-01-06

⋮

CVECVE-2024-35250

Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

Microsoft · Windowsremediation: past CISA due date

P2added 2024-12-16due 2025-01-06

⋮

CVECVE-2024-50623

Cleo Multiple Products Unrestricted File Upload Vulnerability

Cleo · Multiple Productsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2024-12-13due 2025-01-03

⋮

CVECVE-2024-49138

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Microsoft · Windowsremediation: past CISA due date

P2added 2024-12-10due 2024-12-31

⋮

CVECVE-2024-51378

CyberPanel Incorrect Default Permissions Vulnerability

CyberPersons · CyberPanelremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2024-12-04due 2024-12-25

⋮

CVECVE-2023-45727

North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

North Grid · Proselfremediation: past CISA due date

P2added 2024-12-03due 2024-12-24

⋮

CVECVE-2024-11667

Zyxel Multiple Firewalls Path Traversal Vulnerability

Zyxel · Multiple Firewallsremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2024-12-03due 2024-12-24

⋮

CVECVE-2024-11680

ProjectSend Improper Authentication Vulnerability

ProjectSend · ProjectSendremediation: past CISA due date

P2added 2024-12-03due 2024-12-24

⋮

CVECVE-2023-28461

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Array Networks · AG/vxAG ArrayOSremediation: known ransomware use · past CISA due date⬤ KNOWN RANSOMWARE USE

P1added 2024-11-25due 2024-12-16

⋮

451–500 of ~1,722

← Prev Next →