2024: 186 exploited CVEs added

Every number below is computed from CISA's Known Exploited Vulnerabilities catalog and refreshed daily. That's -1% versus the same period of 2023 (187).

Year: 2026 202520242023 2022

186Added 2024

187Same period 2023

21 daysMedian add → due

64Vendors hit

Adds per month

2024 against 2023. Hover a month for exact counts.

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

20242023 (187 total)

How urgent, how dangerous

Shares of the 186 entries added in 2024.

8 with ≤ 7 daysto the federal due date. Median window is 21 days.

44 ransomware-linkedCISA marks known use in ransomware campaigns.

18 old CVEsassigned 2019 or earlier, newly confirmed exploited.

Top vendors in 2024

Most KEV additions. R = ransomware-linked. Click a vendor for every entry.

01Microsoft 36 10R02Ivanti 11 5R 03Google 9 04Adobe 8 2R 05Apple 7 06Palo Alto Networks 7 3R 07Android 6 08Cisco 6 1R 09D-Link 6 10Apache 5 11VMware 5 1R 12Fortinet 4 2R

Plus 52 more vendors. See all vendors.

Old bugs, new exploitation

CVEs from 2019 or earlier added in 2024. Patch backlogs matter.

CVE	Vendor / product	Added	Age
CVE-2012-4792	Microsoft Internet Explorer	2024-07-23	12y
CVE-2013-0643	Adobe Flash Player	2024-09-17	11y
CVE-2013-0648	Adobe Flash Player	2024-09-17	11y
CVE-2014-0497	Adobe Flash Player	2024-09-17	10y
CVE-2014-0502	Adobe Flash Player	2024-09-17	10y
CVE-2014-2120	Cisco Adaptive Security Appliance (ASA)	2024-11-12	10y
CVE-2014-100005	D-Link DIR-600 Router	2024-05-16	10y
CVE-2016-3714	ImageMagick ImageMagick	2024-09-09	8y
CVE-2016-20017	D-Link DSL-2750B Devices	2024-01-08	8y
CVE-2017-3506	Oracle WebLogic Server	2024-06-03	7y
CVE-2017-1000253	Linux Kernel RANSOMWARE	2024-09-09	7y
CVE-2018-0824	Microsoft Windows	2024-08-05	6y
CVE-2018-14933	NUUO NVRmini Devices	2024-12-18	6y
CVE-2018-15133	Laravel Laravel Framework	2024-01-16	6y
CVE-2019-0344	SAP Commerce Cloud	2024-09-30	5y

Showing the 15 oldest of 18.

Only see the ones that hit your stack.

Pick your vendors. Get a free weekly digest of new KEV entries for just those.

Get the free weekly digest

Method: counts use the catalog's dateAdded; "same period" is Jan 1 – 2023-12-31. Due window = dueDate − dateAdded. Data: CISA Known Exploited Vulnerabilities Catalog (CC0). KEV Watch is not affiliated with or endorsed by CISA. Also available as an RSS feed.