CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2024-38014Windows Installer Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2024-37383RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 6.1Medium |
| CVE-2024-37085VMware ESXi Authentication Bypass Vulnerability n/a VMware ESXi, n/a VMware Cloud Foundation Versions & vendor guidance → |
Known exploitedCISA KEV | 6.8Medium |
| CVE-2024-37079Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability n/a VMware vCenter Server, n/a VMware Cloud Foundation Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2024-36971net: fix __dst_negative_advice() race Linux Linux Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2024-36401Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver geoserver geoserver Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2024-35250Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2024-34102XXE can expose crypt key and other secrets granting full admin access Adobe Adobe Commerce Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect Palo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW, Palo Alto Networks Prisma Access Reported fix guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2024-3393PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet Palo Alto Networks Cloud NGFW, Palo Alto Networks PAN-OS Reported fix guidance → |
Known exploitedCISA KEV | 8.7High |
| CVE-2024-32896Android Pixel Privilege Escalation Vulnerability Google Android Versions & vendor guidance → |
Known exploitedCISA KEV | 8.1High |
| CVE-2024-3273D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection D-Link DNS-320L, D-Link DNS-325, D-Link DNS-327L, D-Link DNS-340L Versions & vendor guidance → |
Known exploitedCISA KEV | 7.3High |
| CVE-2024-3272D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials D-Link DNS-320L, D-Link DNS-325, D-Link DNS-327L, D-Link DNS-340L Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2024-32113Apache OFBiz: Path traversal leading to RCE Apache Software Foundation Apache OFBiz Versions & vendor guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2024-30088Windows Kernel Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7High |
| CVE-2024-30051Windows DWM Core Library Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows 11 version 21H2, Microsoft Windows 10 Version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2024-30040Windows MSHTML Platform Security Feature Bypass Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows 11 version 21H2, Microsoft Windows 10 Version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2024-29988SmartScreen Prompt Security Feature Bypass Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows 11 version 21H2, Microsoft Windows 10 Version 21H2, Microsoft Windows 11 version 22H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2024-29824Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability Ivanti EPM Versions & vendor guidance → |
Known exploitedCISA KEV | 9.6Critical |
| CVE-2024-29748Android Pixel Privilege Escalation Vulnerability Google Android Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2024-29745Android Pixel Information Disclosure Vulnerability Google Android Versions & vendor guidance → |
Known exploitedCISA KEV | 5.5Medium |
| CVE-2024-29059.NET Framework Information Disclosure Vulnerability Microsoft Microsoft .NET Framework 4.8, Microsoft Microsoft .NET Framework 3.5 AND 4.8, Microsoft Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft Microsoft .NET Framework 4.6.2, Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.2, Microsoft Microsoft .NET Framework 2.0 Service Pack 2, Microsoft Microsoft .NET Framework 3.0 Service Pack 2, Microsoft Microsoft .NET Framework 3.5, Microsoft Microsoft .NET Framework 3.5.1 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2024-28995SolarWinds Serv-U L Directory Transversal Vulnerability SolarWinds SolarWinds Serv-U Reported fix guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2024-28987SolarWinds Web Help Desk Hardcoded Credential Vulnerability SolarWinds Web Help Desk Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2024-28986SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability SolarWinds Web Help Desk Reported fix guidance → |
Known exploitedCISA KEV | 9.8Critical |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.