Actively exploited CVEs (CISA KEV) with detection & prevention rules¶
Answer
946 CVEs in this repository are on the CISA Known Exploited Vulnerabilities (KEV) catalog as actively exploited in the wild; 148 ship ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache). Of those, 212 are linked to known ransomware campaigns. Source: CISA KEV catalog, catalog version 2026.10.21 (released 2026-10-21).
The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with reliable evidence of active exploitation. These are the highest-priority CVEs for defenders. Every entry below pairs the KEV listing with a detection-only PoC, a Docker test lab, and — where available — ready-to-deploy detection and prevention rules.
KEV CVEs with ready-to-deploy rules (148)¶
Deploy the Snort/YARA/Nginx/Apache rules for these actively-exploited CVEs first.
| CVE | Severity | KEV added | Ransomware | Detection / prevention |
|---|---|---|---|---|
| CVE-2026-21962 — Oracle HTTP Server and WebLogic Server Proxy Plugin Authentication Bypass vulnerability. | Critical (10.0) | 2026-08-24 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal | High (8.4) | 2026-04-28 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-27199 — JetBrains TeamCity Path Traversal | High (7.3) | 2026-04-20 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-43468 — Microsoft SCCM SQLi | Critical (9.8) | 2026-02-12 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-37079 — VMware vCenter Heap Overflow | Critical (9.8) | 2026-01-23 | — | Snort, YARA, Nginx, Apache |
| CVE-2025-8110 — Gogs Git Server RCE via Symlink Bypass | Critical (9.1) | 2026-01-12 | — | Snort, YARA, Nginx, Apache |
| CVE-2025-55182 — React Server Components Remote Code Execution (React2Shell) | Critical (10.0) | 2025-12-05 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2025-61757 — Oracle Identity Manager Pre-Auth RCE | Critical (9.8) | 2025-11-21 | — | Snort, YARA, Nginx, Apache |
| CVE-2025-59287 — Microsoft WSUS Remote Code Execution | Critical (9.8) | 2025-10-24 | — | Snort, YARA, Nginx, Apache |
| CVE-2025-57819 — FreePBX Authentication Bypass to RCE | Critical (9.8) | 2025-08-29 | — | Snort, YARA, Nginx, Apache |
| CVE-2025-24813 — Apache Tomcat | Critical | 2025-04-01 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-20439 — Cisco Smart Licensing | Critical (10.0) | 2025-03-31 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-48248 — NAKIVO Backup RCE | Critical (9.8) | 2025-03-19 | — | Snort, YARA, Nginx, Apache |
| CVE-2025-22224 — vCenter Server, Cloud Foundation | Critical | 2025-03-04 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-50302 — Linux Kernel Uninitialized | Medium (5.5) | 2025-03-04 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-4885 — WhatsUp Gold Path Traversal | Critical (9.8) | 2025-03-03 | — | Snort, YARA, Nginx, Apache |
| CVE-2025-0411 — 7-Zip Mark-of-the-Web Bypass | High (7.0) | 2025-02-06 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-21413 — Microsoft Outlook RCE | Critical (9.8) | 2025-02-06 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-53104 — Linux Kernel USB Video UAF | High (7.8) | 2025-02-05 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-29059 — .NET Info Disclosure | High (7.5) | 2025-02-04 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-45195 — Apache OFBiz Unauth RCE | Critical (9.8) | 2025-02-04 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-55591 — FortiOS Auth Bypass | Critical (9.8) | 2025-01-14 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-12686 — BeyondTrust PRA/RS Command Injection | High (7.2) | 2025-01-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2025-0282 — Connect Secure, Policy Secure, ZTA Gateways | Critical | 2025-01-08 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-55550 — Mitel MiCollab LFI | Medium (4.4) | 2025-01-07 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-41713 — Mitel MiCollab Path Traversal | Critical (9.1) | 2025-01-07 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-3393 — Palo Alto DNS DoS | High (8.7) | 2024-12-30 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-12356 — A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote… | Critical (9.8) | 2024-12-19 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-55956 — Cleo Harmony/VLTrader/LexiCom RCE | Critical (9.8) | 2024-12-17 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-35250 — Windows Kernel EoP | High (7.8) | 2024-12-16 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-20767 — ColdFusion Path Traversal | High (8.2) | 2024-12-16 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-50623 — Cleo File Transfer RCE | Critical (9.8) | 2024-12-13 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-49138 — Windows CLFS Driver Privilege Escalation | High (7.8) | 2024-12-10 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-51378 — CyberPanel Command Injection | Critical (10.0) | 2024-12-04 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-11667 — Zyxel Firewall Path Traversal | High (7.5) | 2024-12-03 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-11680 — ProjectSend RCE | Critical (9.8) | 2024-12-03 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-44309 — Apple WebKit XSS | Medium (6.1) | 2024-11-21 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-44308 — Apple WebKit RCE | High (8.8) | 2024-11-21 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38813 — VMware vCenter EoP | High (7.5) | 2024-11-20 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38812 — VMware vCenter RCE | Critical (9.8) | 2024-11-20 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-9474 — Palo Alto PAN-OS Privilege Escalation | High (7.2) | 2024-11-18 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-0012 — Palo Alto PAN-OS Management Interface Auth Bypass | Critical (9.8) | 2024-11-18 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-1212 — Progress LoadMaster RCE | Critical (10.0) | 2024-11-18 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-9465 — Palo Alto Expedition SQL Injection | Critical (9.2) | 2024-11-14 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-9463 — Palo Alto Expedition OS Command Injection | Critical (9.9) | 2024-11-14 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-43451 — Windows NTLM Hash | Medium (6.5) | 2024-11-12 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-49039 — Windows Task Scheduler | High (8.8) | 2024-11-12 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-43093 — Android Framework LPE | High (7.8) | 2024-11-07 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-5910 — Palo Alto Expedition | Critical (9.3) | 2024-11-07 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-51567 — CyberPanel RCE | Critical (10.0) | 2024-11-07 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-37383 — Roundcube XSS | Medium (6.1) | 2024-10-24 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-47575 — FortiManager Auth Bypass | Critical (9.8) | 2024-10-23 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38094 — SharePoint RCE | High (7.2) | 2024-10-22 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-40711 — Veeam Backup RCE | Critical (9.8) | 2024-10-17 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-30088 — Windows Kernel Elevation of Privilege | High (8.8) | 2024-10-15 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-28987 — SolarWinds WHD Credentials | Critical (9.1) | 2024-10-15 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-9680 — Firefox Use-After-Free | Critical (9.8) | 2024-10-15 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-9379 — Ivanti CSA SQLi | Medium (6.5) | 2024-10-09 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-9380 — Ivanti CSA OS Injection | High (7.2) | 2024-10-09 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-23113 — Fortinet FortiOS Format String RCE | Critical (9.8) | 2024-10-09 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-43573 — Windows MSHTML Spoofing | Medium (6.5) | 2024-10-08 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-43047 — Qualcomm DSP UAF | High (7.8) | 2024-10-08 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-43572 — Microsoft MMC RCE | High (7.8) | 2024-10-08 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-45519 — Zimbra Postjournal RCE | Critical (10.0) | 2024-10-03 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-29824 — Ivanti EPM SQLi | Critical (9.6) | 2024-10-02 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-7593 — Ivanti Virtual Traffic Manager Authentication Bypass | Critical (9.8) | 2024-09-24 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-8963 — Ivanti vTM Auth Bypass | Critical (9.4) | 2024-09-19 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-27348 — Apache HugeGraph Server RCE | Critical (9.8) | 2024-09-18 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-43461 — Windows MSHTML Spoofing | High (8.8) | 2024-09-16 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-6670 — WhatsUp Gold SQLi | Critical (9.8) | 2024-09-16 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-8190 — Ivanti CSA Command Injection | High (7.2) | 2024-09-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-40766 — SonicWall SSLVPN Bypass | Critical (9.3) | 2024-09-09 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-7965 — Chrome V8 Type Confusion | High (8.8) | 2024-08-28 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38856 — Apache OFBiz Pre-Auth RCE | Critical (9.8) | 2024-08-27 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-7971 — Chrome V8 Type Confusion | Critical (9.6) | 2024-08-26 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-39717 — Versa Director RCE | Medium (6.6) | 2024-08-23 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-23897 — Jenkins CLI Arbitrary File Read | Critical (9.8) | 2024-08-19 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-28986 — SolarWinds Deserialization | Critical (9.8) | 2024-08-15 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38213 — Windows Mark of Web Bypass | Medium (6.5) | 2024-08-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38106 — Windows Kernel EoP | High (7.0) | 2024-08-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38178 — Microsoft Scripting RCE | High (7.5) | 2024-08-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38107 — Windows Power Mgmt EoP | High (7.8) | 2024-08-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38193 — Windows AFD EoP | High (7.8) | 2024-08-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38189 — Microsoft Project RCE | High (8.8) | 2024-08-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-36971 — Linux Kernel UAF | High (7.8) | 2024-08-07 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-32113 — Apache OFBiz Path | Critical (9.8) | 2024-08-07 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-37085 — VMware ESXi Auth Bypass | High (7.2) | 2024-07-30 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-28995 — SolarWinds Serv-U Path Traversal | High (8.6) | 2024-07-17 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-36401 — GeoServer RCE via Eval Property | Critical (9.8) | 2024-07-15 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-38112 — Windows MSHTML RCE | High (7.5) | 2024-07-09 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-23692 — Rejetto HFS RCE | Critical (9.8) | 2024-07-09 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-4358 — Progress Telerik RCE | Critical (9.8) | 2024-06-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-4577 — PHP CGI Argument Injection | Critical (9.8) | 2024-06-12 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-1086 — Linux Kernel Netfilter Privilege Escalation | High (7.8) | 2024-05-30 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-24919 — Checkpoint VPN Info Leak | High (8.6) | 2024-05-30 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-5274 — Chrome V8 Type Confusion | Critical (9.6) | 2024-05-28 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-4761 — Chrome V8 OOB Write | High (8.8) | 2024-05-16 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-30051 — Windows DWM EoP | High (7.8) | 2024-05-14 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-30040 — Windows MSHTML Bypass | High (8.8) | 2024-05-14 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-4671 — Chrome Visuals UAF | Critical (9.6) | 2024-05-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-7028 — GitLab Password Reset Account Takeover | Critical (10.0) | 2024-05-01 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-29988 — Windows SmartScreen Bypass | High (8.8) | 2024-04-30 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-20359 — Cisco ASA RCE | Medium (6.0) | 2024-04-24 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-20353 — Cisco ASA WebVPN | High (8.6) | 2024-04-24 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-4040 — CrushFTP VFS Escape | Critical (10.0) | 2024-04-24 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-3400 — Palo Alto PAN-OS GlobalProtect Command Injection | Critical (10.0) | 2024-04-12 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-3273 — D-Link NAS RCE | Critical (9.8) | 2024-04-11 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-48788 — Fortinet FortiClientEMS SQL Injection | Critical (9.8) | 2024-03-25 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-27198 — JetBrains TeamCity Authentication Bypass | Critical (9.8) | 2024-03-07 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-23225 — Apple Kernel Read | High (7.1) | 2024-03-06 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-23296 — Apple RTKit RCE | High (7.8) | 2024-03-06 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-21338 — Windows Kernel AppLocker Bypass | High (7.8) | 2024-03-04 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-1709 — ConnectWise ScreenConnect Auth Bypass | Critical (10.0) | 2024-02-22 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-21410 — Exchange Server EoP | Critical (9.8) | 2024-02-15 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-21351 — Windows SmartScreen Security Bypass | High (7.6) | 2024-02-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-21412 — Windows Defender Bypass | High (8.1) | 2024-02-13 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-21762 — Fortinet FortiOS Out-of-Bounds Write | Critical (9.6) | 2024-02-09 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-21893 — Ivanti Connect SSRF | High (8.2) | 2024-01-31 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-22527 — Atlassian Confluence Template Injection RCE | Critical (10.0) | 2024-01-24 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-23222 — Apple WebKit RCE | High (8.8) | 2024-01-23 | — | Snort, YARA, Nginx, Apache |
| CVE-2024-0519 — Chrome V8 Out-of-Bounds Memory Access | High (8.8) | 2024-01-17 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-46805 — Ivanti Connect Secure Authentication Bypass | High (8.2) | 2024-01-10 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2024-21887 — A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x)… | Critical (9.1) | 2024-01-10 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-29357 — Microsoft SharePoint Server Privilege Escalation | Critical (9.8) | 2024-01-10 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-49103 — ownCloud graphapi Information Disclosure | Critical (10.0) | 2023-11-30 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-36845 — Juniper Junos OS PHP External Variable Modification | Critical (9.8) | 2023-11-13 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-22518 — Atlassian Confluence Improper Authorization | Critical (9.8) | 2023-11-07 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-46604 — Apache ActiveMQ RCE | Critical (10.0) | 2023-11-02 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-20273 — Cisco IOS XE Web UI Privilege Escalation | High (7.2) | 2023-10-23 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-4966 — Citrix Bleed - Session Token Leakage | High (7.5) | 2023-10-18 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation | Critical (10.0) | 2023-10-16 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-44487 — HTTP/2 Rapid Reset Attack | High (7.5) | 2023-10-10 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-22515 — Atlassian Confluence Broken Access Control | Critical (10.0) | 2023-10-05 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-40044 — WS_FTP Server .NET Deserialization RCE | Critical (10.0) | 2023-10-05 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-42793 — JetBrains TeamCity Authentication Bypass RCE | Critical (9.8) | 2023-10-04 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-20269 — Cisco ASA VPN Brute Force / Unauthorized Access | Critical (9.1) | 2023-09-13 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-32315 — Openfire Path Traversal Admin Bypass | High (8.6) | 2023-08-24 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-35078 — Ivanti EPMM Authentication Bypass | Critical (10.0) | 2023-07-25 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-3519 — Citrix NetScaler ADC/Gateway RCE | Critical (9.8) | 2023-07-19 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-36884 — Windows Search RCE (Office/Windows) | High (8.3) | 2023-07-17 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-34362 — MOVEit Transfer SQL Injection | Critical (9.8) | 2023-06-02 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-28771 — Zyxel Firewall Command Injection | Critical (9.8) | 2023-05-31 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-2868 — Barracuda ESG Command Injection | Critical (9.4) | 2023-05-26 | — | Snort, YARA, Nginx, Apache |
| CVE-2023-27350 — PaperCut MF/NG Authentication Bypass RCE | Critical (9.8) | 2023-04-21 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2023-23397 — Microsoft Outlook Privilege Escalation | Critical (9.8) | 2023-03-14 | — | Snort, YARA, Nginx, Apache |
| CVE-2022-47966 — Zoho ManageEngine RCE | Critical (9.8) | 2023-01-23 | Yes | Snort, YARA, Nginx, Apache |
| CVE-2022-22963 — Spring Cloud Function SpEL Injection | Critical (9.8) | 2022-08-25 | — | Snort, YARA, Nginx, Apache |
| CVE-2022-22965 — Spring4Shell RCE | Critical (9.8) | 2022-04-04 | — | Snort, YARA, Nginx, Apache |
946 of this repository's CVEs are on the CISA KEV catalog in total (including those still being fitted with detection rules). Browse the full detection & prevention rules catalog.