CISA Known Exploited Vulnerabilities
KEV additions — December 2024
16 CVEs entered the KEV catalog in December 2024.
Added December 30, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-3393 | Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability | 7.5 | 78.0 % | January 20, 2025 |
Added December 23, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-44207 | Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability | 8.1 | 9.1 % | January 13, 2025 |
Added December 19, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-12356 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability | 9.8 | 93.7 % | December 27, 2024 |
Added December 18, 20244
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-14933 | NUUO NVRmini Devices OS Command Injection Vulnerability | 9.8 | 93.9 % | January 8, 2025 |
| CVE-2019-11001 | Reolink Multiple IP Cameras OS Command Injection Vulnerability | 7.2 | 33.8 % | January 8, 2025 |
| CVE-2021-40407 | Reolink RLC-410W IP Camera OS Command Injection Vulnerability | 7.2 | 32.6 % | January 8, 2025 |
| CVE-2022-23227 | NUUO NVRmini2 Devices Missing Authentication Vulnerability | 9.8 | 47.0 % | January 8, 2025 |
Added December 17, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-55956ransomware | Cleo Multiple Products Unauthenticated File Upload Vulnerability | 9.8 | 91.0 % | January 7, 2025 |
Added December 16, 20242
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-20767 | Adobe ColdFusion Improper Access Control Vulnerability | 7.4 | 94.1 % | January 6, 2025 |
| CVE-2024-35250 | Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability | 7.8 | 53.7 % | January 6, 2025 |
Added December 13, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-50623ransomware | Cleo Multiple Products Unrestricted File Upload Vulnerability | 9.8 | 94.0 % | January 3, 2025 |
Added December 10, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-49138 | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | 7.8 | 85.7 % | December 31, 2024 |
Added December 4, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-51378ransomware | CyberPanel Incorrect Default Permissions Vulnerability | 9.8 | 93.9 % | December 25, 2024 |
Added December 3, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-45727 | North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability | 7.5 | 21.0 % | December 24, 2024 |
| CVE-2024-11667ransomware | Zyxel Multiple Firewalls Path Traversal Vulnerability | 9.8 | 34.2 % | December 24, 2024 |
| CVE-2024-11680 | ProjectSend Improper Authentication Vulnerability | 9.8 | 93.5 % | December 24, 2024 |