Top 10 CVEs of 2024
2024
Six data-derived top-10 lists for CVEs published or KEV-added in 2024. No editorial scoring; everything below is computed directly from the ingested corpus.
Top 10 most severe CVEs of 2024
Ranked by CVSS v3 base score, descending. Ties broken by KEV status, then EPSS score, then publish date.
| # | CVE | Severity | CVSS | KEV | Summary |
|---|---|---|---|---|---|
| 1 | CVE-2024-3400 | Critical | 10.0 | KEV | A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated atta… |
| 2 | CVE-2024-1709 | Critical | 10.0 | KEV | ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems. |
| 3 | CVE-2024-45519 | Critical | 10.0 | KEV | The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands. |
| 4 | CVE-2024-50603 | Critical | 10.0 | KEV | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. |
| 5 | CVE-2024-1212 | Critical | 10.0 | KEV | Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. |
| 6 | CVE-2024-51378 | Critical | 10.0 | KEV | getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secM… |
| 7 | CVE-2024-51567 | Critical | 10.0 | KEV | upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is… |
| 8 | CVE-2024-29895 | Critical | 10.0 | — | Cacti provides an operational monitoring and fault management framework. |
| 9 | CVE-2024-2389 | Critical | 10.0 | — | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the executio… |
| 10 | CVE-2024-21650 | Critical | 10.0 | — | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. |
Top 10 actively exploited CVEs of 2024
CVEs added to the CISA Known Exploited Vulnerabilities catalog during the year, newest first. Empty for pre-2021 years.
| # | CVE | Severity | CVSS | KEV | Added | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2024-3393 | High | 7.5 | KEV | 2024-12-30 | A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. |
| 2 | CVE-2021-44207 | High | 8.1 | KEV | 2024-12-23 | Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. |
| 3 | CVE-2024-12356 | Critical | 9.8 | KEV | 2024-12-19 | A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user. |
| 4 | CVE-2021-40407 | High | 7.2 | KEV | 2024-12-18 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. |
| 5 | CVE-2022-23227 | Critical | 9.8 | KEV | 2024-12-18 | NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. |
| 6 | CVE-2019-11001 | High | 7.2 | KEV | 2024-12-18 | On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 f… |
| 7 | CVE-2018-14933 | Critical | 9.8 | KEV | 2024-12-18 | upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. |
| 8 | CVE-2024-55956 | Critical | 9.8 | KEV | 2024-12-17 | In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autor… |
| 9 | CVE-2024-35250 | High | 7.8 | KEV | 2024-12-16 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability |
| 10 | CVE-2024-20767 | High | 7.4 | KEV | 2024-12-16 | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. |
Top 10 highest-EPSS CVEs of 2024
FIRST.org Exploit Prediction Scoring System scores, descending. EPSS estimates the probability a CVE will be exploited in the next 30 days.
| # | CVE | Severity | CVSS | KEV | EPSS | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2024-3400 | Critical | 10.0 | KEV | 1.000 | A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated atta… |
| 2 | CVE-2024-21893 | High | 8.2 | KEV | 1.000 | A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authen… |
| 3 | CVE-2024-21887 | Critical | 9.1 | KEV | 1.000 | A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the a… |
| 4 | CVE-2024-23897 | Critical | 9.8 | KEV | 1.000 | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to r… |
| 5 | CVE-2024-3273 | High | 7.3 | KEV | 1.000 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. |
| 6 | CVE-2024-34102 | Critical | 9.8 | KEV | 1.000 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. |
| 7 | CVE-2024-27199 | High | 7.3 | KEV | 1.000 | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible |
| 8 | CVE-2024-7593 | Critical | 9.8 | KEV | 1.000 | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. |
| 9 | CVE-2024-4577 | Critical | 9.8 | KEV | 1.000 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command… |
| 10 | CVE-2024-45195 | High | 7.5 | KEV | 1.000 | Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. |
Top 10 most PoC-covered CVEs of 2024
Ranked by the count of indexed public proof-of-concept repositories. Higher counts correlate with weaponisation effort.
| # | CVE | Severity | CVSS | KEV | PoCs | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2024-6387 | High | 8.1 | — | 252 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). |
| 2 | CVE-2024-3094 | Critical | 10.0 | — | 211 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. |
| 3 | CVE-2024-32002 | Critical | 9.0 | — | 191 | Git is a revision control system. |
| 4 | CVE-2024-4577 | Critical | 9.8 | KEV | 188 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command… |
| 5 | CVE-2024-23897 | Critical | 9.8 | KEV | 168 | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to r… |
| 6 | CVE-2024-1234 | Medium | 6.4 | — | 142 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. |
| 7 | CVE-2024-24919 | High | 8.6 | KEV | 140 | Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. |
| 8 | CVE-2024-21413 | Critical | 9.8 | KEV | 135 | Microsoft Outlook Remote Code Execution Vulnerability |
| 9 | CVE-2024-3400 | Critical | 10.0 | KEV | 131 | A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated atta… |
| 10 | CVE-2024-1086 | High | 7.8 | KEV | 99 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. |
Top 10 most-vulnerable vendors of 2024
Vendors ranked by distinct CVE count for the year. Counts include every CVE attached to any product the vendor ships in our CPE map.
| # | Vendor | CVE count |
|---|---|---|
| 1 | Linux | 3313 |
| 2 | Microsoft | 1740 |
| 3 | Apple | 877 |
| 4 | 797 | |
| 5 | Adobe | 751 |
| 6 | Sourcecodester | 563 |
| 7 | IBM | 525 |
| 8 | Debian | 455 |
Top 10 most-common CWEs of 2024
CWE classification ids ranked by the count of CVEs published in the year that carry them. Each CVE typically lists 1–3 CWE ids; counts reflect the union of those lists across the year's corpus.
| # | CWE | Name | CVE count |
|---|---|---|---|
| 1 | CWE-79 | Cross-site Scripting | 7926 |
| 2 | CWE-89 | SQL Injection | 2812 |
| 3 | CWE-862 | Missing Authorization | 1577 |
| 4 | CWE-787 | Out-of-bounds Write | 1550 |
| 5 | CWE-352 | Cross-Site Request Forgery (CSRF) | 1499 |
| 6 | CWE-22 | Path Traversal | 1039 |
| 7 | CWE-125 | Out-of-bounds Read | 995 |
| 8 | CWE-416 | Use After Free | 941 |
| 9 | CWE-476 | NULL Pointer Dereference | 890 |
| 10 | CWE-94 | Code Injection | 863 |