Updated daily · official sources
Vulnerabilities (CVE) being actively exploited, according to the CISA KEV catalog, with CVSS severity and exploitation probability (EPSS).
CVE-2025-22225
Severity under analysis Ransomware added on 03/04/2025
VMware · ESXi · CWE-123
VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.
CVE-2018-8639
Severity under analysis Ransomware added on 03/03/2025
Microsoft · Windows · CWE-404
Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
CVE-2024-53704
Severity under analysis Ransomware added on 02/18/2025
SonicWall · SonicOS · CWE-287
SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.
CVE-2025-23006
Severity under analysis Ransomware added on 01/24/2025
SonicWall · SMA1000 Appliances · CWE-502
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
CVE-2024-55591
Severity under analysis Ransomware added on 01/14/2025
Fortinet · FortiOS and FortiProxy · CWE-288
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
CVE-2025-0282
Severity under analysis Ransomware added on 01/08/2025
Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · CWE-121
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
CVE-2024-9474
Severity under analysis Ransomware added on 11/18/2024
Palo Alto Networks · PAN-OS · CWE-77
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
CVE-2024-0012
Severity under analysis Ransomware added on 11/18/2024
Palo Alto Networks · PAN-OS · CWE-306
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
CVE-2024-49039
Severity under analysis Ransomware added on 11/12/2024
Microsoft · Windows · CWE-287
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
CVE-2024-38094
Severity under analysis Ransomware added on 10/22/2024
Microsoft · SharePoint · CWE-502
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
CVE-2024-40711
Severity under analysis Ransomware added on 10/17/2024
Veeam · Backup & Replication · CWE-502
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
CVE-2024-30088
Severity under analysis Ransomware added on 10/15/2024
Microsoft · Windows · CWE-367
Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
CVE-2020-0618
Severity under analysis Ransomware added on 09/18/2024
Microsoft · SQL Server · CWE-502
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
CVE-2024-6670
Severity under analysis Ransomware added on 09/16/2024
Progress · WhatsUp Gold · CWE-89
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
CVE-2024-40766
Severity under analysis Ransomware added on 09/09/2024
SonicWall · SonicOS · CWE-284
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
CVE-2017-1000253
Severity under analysis Ransomware added on 09/09/2024
Linux · Kernel · CWE-119
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.
CVE-2024-37085
Severity under analysis Ransomware added on 07/30/2024
VMware · ESXi · CWE-305
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
CVE-2024-26169
Severity under analysis Ransomware added on 06/13/2024
Microsoft · Windows · CWE-269
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
CVE-2024-1086
Severity under analysis Ransomware added on 05/30/2024
Linux · Kernel · CWE-416
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
CVE-2024-30051
Severity under analysis Ransomware added on 05/14/2024
Microsoft · DWM Core Library · CWE-122
Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.
CVE-2024-3400
Severity under analysis Ransomware added on 04/12/2024
Palo Alto Networks · PAN-OS · CWE-20, CWE-77
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
CVE-2023-24955
Severity under analysis Ransomware added on 03/26/2024
Microsoft · SharePoint Server · CWE-94
Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
CVE-2023-48788
Severity under analysis Ransomware added on 03/25/2024
Fortinet · FortiClient EMS · CWE-89
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
CVE-2021-44529
Severity under analysis Ransomware added on 03/25/2024
Ivanti · Endpoint Manager Cloud Service Appliance (EPM CSA) · CWE-94
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
We assess versions, access and integrations of your ERP and infrastructure and prioritize the fixes.
Sources: CISA Known Exploited Vulnerabilities Catalog, NIST National Vulnerability Database and FIRST EPSS. Informational content; always follow the vendor advisory and fix.
This product uses the NVD API but is not endorsed or certified by the NVD.
Bit is an AI and can make mistakes. Do not share passwords or personal data. Conversations are not stored. Learn more