{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T17:40:31.642Z", "tag": { "id": "windows", "label": "Windows", "isStack": false, "url": "https://pwn.watch/t/windows", "feed": "https://pwn.watch/t/windows/feed.xml" }, "counts": { "incidents": 55, "live": 1, "notFullyPatched": 0, "patched": 55 }, "incidents": [ { "slug": "opencode-mcp-oauth-rce-windows", "title": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows", "json": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "OpenCode AI coding agent (Anomaly) on Windows and WSL", "tags": [ "ai", "devtools", "windows", "opencode", "mcp" ], "cveIds": [], "affectedVersions": [ "OpenCode 1.0.137 through 1.18.32 on Windows and WSL" ], "fixedVersions": [ "OpenCode 1.18.33" ], "startedAt": "2026-10-19", "closedAt": null, "updatedAt": "2026-10-22T16:00:44+02:00", "summary": "A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.", "xPost": null }, { "slug": "windows-shell-cve-2026-96951-motw", "title": "Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)", "url": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw", "json": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows Shell (and related Oct Patch Tuesday components)", "tags": [ "microsoft", "windows", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2026-96951", "CVE-2026-108398", "CVE-2026-92707" ], "affectedVersions": [ "Supported Windows versions receiving the October 2026 cumulative updates (see Microsoft Security Update Guide)" ], "fixedVersions": [ "October 2026 Patch Tuesday cumulative updates (KB packages per SKU)" ], "startedAt": "2026-10-13", "closedAt": "2026-10-13", "updatedAt": "2026-10-22T11:20:00+02:00", "summary": "Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.", "xPost": null }, { "slug": "microsoft-windows-cve-2026-81963", "title": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2026-81963", "json": "https://pwn.watch/i/microsoft-windows-cve-2026-81963.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-81963", "CVE-2026-85880" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-08", "closedAt": "2026-09-08", "updatedAt": "2026-09-08", "summary": "Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CISA added CVE-2026-81963, CVE-2026-85880 to the Known Exploited Vulnerabilities catalog on 2026-09-08 based on evidence of active exploitation.", "xPost": null }, { "slug": "microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820", "title": "Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820", "json": "https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows Ancillary Function Driver for WinSock ", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-68820" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-11", "closedAt": "2026-08-11", "updatedAt": "2026-08-11", "summary": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-08-11.", "xPost": null }, { "slug": "microsoft-windows-cve-2026-32202", "title": "Microsoft Windows: Microsoft Windows Protection Mechanism Failure Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2026-32202", "json": "https://pwn.watch/i/microsoft-windows-cve-2026-32202.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-32202" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-28", "closedAt": "2026-04-28", "updatedAt": "2026-04-28", "summary": "Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-28.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-60710", "title": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-60710", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-60710.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-60710", "CVE-2023-36424" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-13", "closedAt": "2026-04-13", "updatedAt": "2026-04-13", "summary": "Microsoft Windows contains a link following vulnerability that allows for privilege escalation CISA added CVE-2025-60710, CVE-2023-36424 to the Known Exploited Vulnerabilities catalog on 2026-04-13 based on evidence of active exploitation.", "xPost": null }, { "slug": "microsoft-windows-cve-2026-21513", "title": "Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2026-21513", "json": "https://pwn.watch/i/microsoft-windows-cve-2026-21513.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-21513", "CVE-2026-21525", "CVE-2026-21510", "CVE-2026-21533", "CVE-2026-21519" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-10", "closedAt": "2026-02-10", "updatedAt": "2026-02-10", "summary": "Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. CISA added CVE-2026-21513, CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519 to the Known Exploited Vulnerabilities catalog on 2026-02-10 based on evidence of active exploitation.", "xPost": null }, { "slug": "react-native-community-cli-cve-2025-11953", "title": "React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability", "url": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953", "json": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "React Native Community CLI", "tags": [ "node", "windows", "react-native", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-11953" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-05", "closedAt": "2026-02-05", "updatedAt": "2026-02-05", "summary": "React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Added to CISA KEV on 2026-02-05.", "xPost": null }, { "slug": "microsoft-windows-cve-2026-20805", "title": "Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2026-20805", "json": "https://pwn.watch/i/microsoft-windows-cve-2026-20805.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-20805" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-01-13", "closedAt": "2026-01-13", "updatedAt": "2026-01-13", "summary": "Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally. Added to CISA KEV on 2026-01-13.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-62221", "title": "Microsoft Windows: Windows Use After Free Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-62221", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-62221.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-62221" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-12-09", "closedAt": "2025-12-09", "updatedAt": "2025-12-09", "summary": "Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-12-09.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-62215", "title": "Microsoft Windows: Windows Race Condition Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-62215", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-62215.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-62215" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-11-12", "closedAt": "2025-11-12", "updatedAt": "2025-11-12", "summary": "Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access. Added to CISA KEV on 2025-11-12.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-59287", "title": "Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-59287", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-59287.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-59287" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-24", "closedAt": "2025-10-24", "updatedAt": "2025-10-24", "summary": "Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2025-10-24.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-33073", "title": "Microsoft Windows: Windows SMB Client Improper Access Control Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-33073", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-33073.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-33073" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-20", "closedAt": "2025-10-20", "updatedAt": "2025-10-20", "summary": "Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. Added to CISA KEV on 2025-10-20.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-24990", "title": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-24990, CVE-2025-59230)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24990", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-24990.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-24990", "CVE-2025-59230" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-14", "closedAt": "2025-10-14", "updatedAt": "2025-10-14", "summary": "CVE-2025-24990: Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2025-59230: Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-10-14.", "xPost": null }, { "slug": "microsoft-windows-cve-2011-3402", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402", "json": "https://pwn.watch/i/microsoft-windows-cve-2011-3402.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2011-3402", "CVE-2013-3918", "CVE-2021-43226" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-06", "closedAt": "2025-10-06", "updatedAt": "2025-10-06", "summary": "CVE-2011-3402: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. CVE-2013-3918: Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2021-43226: Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms. Added to CISA KEV on 2025-10-06.", "xPost": null }, { "slug": "citrix-session-recording-cve-2024-8068", "title": "Citrix Session Recording: 2 exploited vulnerabilities (CVE-2024-8068, CVE-2024-8069)", "url": "https://pwn.watch/i/citrix-session-recording-cve-2024-8068", "json": "https://pwn.watch/i/citrix-session-recording-cve-2024-8068.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Citrix Session Recording", "tags": [ "citrix", "windows", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-8068", "CVE-2024-8069" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-25", "closedAt": "2025-08-25", "updatedAt": "2025-08-25", "summary": "CVE-2024-8068: Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain. CVE-2024-8069: Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server. Added to CISA KEV on 2025-08-25.", "xPost": null }, { "slug": "rarlab-winrar-cve-2025-8088", "title": "RARLAB WinRAR: WinRAR Path Traversal Vulnerability", "url": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088", "json": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "RARLAB WinRAR", "tags": [ "rarlab", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-8088" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-12", "closedAt": "2025-08-12", "updatedAt": "2025-08-12", "summary": "RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files. Added to CISA KEV on 2025-08-12.", "xPost": null }, { "slug": "eslint-config-prettier-npm-phishing-cve-2025-54313", "title": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)", "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313", "json": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, is", "tags": [ "npm", "node", "eslint", "phishing", "windows", "supply-chain", "infostealer" ], "cveIds": [ "CVE-2025-54313" ], "affectedVersions": [ "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7", "is 3.3.1, 5.0.0" ], "fixedVersions": [ "Malicious versions removed; use other eslint-config-prettier versions (see CVE record)" ], "startedAt": "2025-07-18", "closedAt": "2025-07-22", "updatedAt": "2025-07-22", "summary": "A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-33053", "title": "Microsoft Windows: Microsoft Windows External Control of File Name or Path Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-33053", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-33053.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-33053" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-10", "closedAt": "2025-06-10", "updatedAt": "2025-06-10", "summary": "Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files. Added to CISA KEV on 2025-06-10.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-30397", "title": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-30397.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-30397", "CVE-2025-30400", "CVE-2025-32701", "CVE-2025-32706", "CVE-2025-32709" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-13", "closedAt": "2025-05-13", "updatedAt": "2025-05-13", "summary": "CVE-2025-30397: Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL. CVE-2025-30400: Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-32701: Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-32706: Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-32709: Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator. Added to CISA KEV on 2025-05-13.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-24054", "title": "Microsoft Windows: Windows NTLM Hash Disclosure Spoofing Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24054", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-24054.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-24054" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-17", "closedAt": "2025-04-17", "updatedAt": "2025-04-17", "summary": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2025-04-17.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-29824", "title": "Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-29824", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-29824.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-29824" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-08", "closedAt": "2025-04-08", "updatedAt": "2025-04-08", "summary": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-04-08.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-24983", "title": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-24983.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-24983", "CVE-2025-24984", "CVE-2025-24985", "CVE-2025-24991", "CVE-2025-24993", "CVE-2025-26633" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-11", "closedAt": "2025-03-11", "updatedAt": "2025-03-11", "summary": "CVE-2025-24983: Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-24984: Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory. CVE-2025-24985: Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally. CVE-2025-24991: Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally. CVE-2025-24993: Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally. CVE-2025-26633: Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally. Added to CISA KEV on 2025-03-11.", "xPost": null }, { "slug": "microsoft-windows-cve-2018-8639", "title": "Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-8639", "json": "https://pwn.watch/i/microsoft-windows-cve-2018-8639.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2018-8639" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-03", "closedAt": "2025-03-03", "updatedAt": "2025-03-03", "summary": "Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. Added to CISA KEV on 2025-03-03.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-21391", "title": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21391", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-21391.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-21391", "CVE-2025-21418" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-11", "closedAt": "2025-02-11", "updatedAt": "2025-02-11", "summary": "CVE-2025-21391: Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable. CVE-2025-21418: Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Added to CISA KEV on 2025-02-11.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-21333", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21333", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-21333.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-21333", "CVE-2025-21334", "CVE-2025-21335" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-14", "closedAt": "2025-01-14", "updatedAt": "2025-01-14", "summary": "CVE-2025-21333: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges. CVE-2025-21334: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. CVE-2025-21335: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. Added to CISA KEV on 2025-01-14.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-49138", "title": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-49138", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-49138.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2024-49138" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-12-10", "closedAt": "2024-12-10", "updatedAt": "2024-12-10", "summary": "Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-12-10.", "xPost": null }, { "slug": "microsoft-zero-days-november-2024-43451-49039", "title": "Microsoft November 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039", "json": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-43451", "CVE-2024-49039" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-12", "closedAt": "2024-11-12", "updatedAt": "2024-11-12", "summary": "CVE-2024-43451: Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. CVE-2024-49039: Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions. Added to the CISA KEV catalog on 2024-11-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-october-2024-43572-43573", "title": "Microsoft October 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573", "json": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day", "rce" ], "cveIds": [ "CVE-2024-43572", "CVE-2024-43573" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-08", "closedAt": "2024-10-08", "updatedAt": "2024-10-08", "summary": "CVE-2024-43572: Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution. CVE-2024-43573: Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. Added to the CISA KEV catalog on 2024-10-08.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-43461", "title": "Microsoft Windows MSHTML Platform Spoofing", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-43461", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-43461.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2024-43461" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-10", "closedAt": "2024-09-16", "updatedAt": "2024-09-16", "summary": "Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112. Added to the CISA KEV catalog on 2024-09-16.", "xPost": null }, { "slug": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "title": "Microsoft September 2024: 3 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more", "json": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Publisher, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day" ], "cveIds": [ "CVE-2024-38014", "CVE-2024-38217", "CVE-2024-38226" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-10", "closedAt": "2024-09-10", "updatedAt": "2024-09-10", "summary": "CVE-2024-38014: Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges. CVE-2024-38217: Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. CVE-2024-38226: Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files. Added to the CISA KEV catalog on 2024-09-10.", "xPost": null }, { "slug": "kingsoft-wps-office-cve-2024-7262", "title": "Kingsoft WPS Office Path Traversal", "url": "https://pwn.watch/i/kingsoft-wps-office-cve-2024-7262", "json": "https://pwn.watch/i/kingsoft-wps-office-cve-2024-7262.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Kingsoft WPS Office", "tags": [ "kingsoft", "wps-office", "cisa-kev", "windows" ], "cveIds": [ "CVE-2024-7262" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-15", "closedAt": "2024-09-03", "updatedAt": "2024-09-03", "summary": "Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library. Added to the CISA KEV catalog on 2024-09-03.", "xPost": null }, { "slug": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "title": "Microsoft August 2024: 6 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more", "json": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Project, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day", "rce" ], "cveIds": [ "CVE-2024-38106", "CVE-2024-38107", "CVE-2024-38178", "CVE-2024-38189", "CVE-2024-38193", "CVE-2024-38213" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-13", "closedAt": "2024-08-13", "updatedAt": "2024-08-13", "summary": "CVE-2024-38106: Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. CVE-2024-38107: Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CVE-2024-38178: Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CVE-2024-38189: Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. CVE-2024-38193: Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CVE-2024-38213: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. Added to the CISA KEV catalog on 2024-08-13.", "xPost": null }, { "slug": "microsoft-windows-cve-2018-0824", "title": "Microsoft COM for Windows Deserialization of Untrusted Data", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-0824", "json": "https://pwn.watch/i/microsoft-windows-cve-2018-0824.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "rce" ], "cveIds": [ "CVE-2018-0824" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-05", "closedAt": "2024-08-05", "updatedAt": "2024-08-05", "summary": "Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script. Added to the CISA KEV catalog on 2024-08-05. CVE-2018-0824 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "crowdstrike-falcon-channel-file-291-outage", "title": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage", "json": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CrowdStrike Falcon sensor for Windows", "tags": [ "crowdstrike", "windows", "outage", "edr", "microsoft" ], "cveIds": [], "affectedVersions": [ "Falcon sensor for Windows 7.11 and above, online 04:09-05:27 UTC on 2024-07-19 (CrowdStrike)" ], "fixedVersions": [ "Channel File 291 content reverted at 05:27 UTC; affected hosts needed manual remediation (CrowdStrike)" ], "startedAt": "2024-07-19", "closedAt": "2024-08-06", "updatedAt": "2024-08-06", "summary": "A faulty CrowdStrike Falcon sensor configuration update (Channel File 291) caused a logic error that blue-screened Windows hosts running sensor 7.11 and later that were online between 04:09 and 05:27 UTC on 2024-07-19. Microsoft estimated 8.5 million Windows devices were affected CrowdStrike stressed it was not a cyberattack; it is tracked here because a security agent with kernel-level access took down machines worldwide.", "xPost": null }, { "slug": "microsoft-zero-days-july-2024-38080-38112", "title": "Microsoft July 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112", "json": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day" ], "cveIds": [ "CVE-2024-38080", "CVE-2024-38112" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-09", "closedAt": "2024-07-09", "updatedAt": "2024-07-09", "summary": "CVE-2024-38080: Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CVE-2024-38112: Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. Added to the CISA KEV catalog on 2024-07-09.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-30088", "title": "Microsoft Windows Kernel TOCTOU Race Condition", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-30088.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-30088" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-11", "closedAt": "2024-10-15", "updatedAt": "2024-10-15", "summary": "Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. Added to the CISA KEV catalog on 2024-10-15. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-35250", "title": "Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-35250", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-35250.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2024-35250" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-11", "closedAt": "2024-12-16", "updatedAt": "2024-12-16", "summary": "Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-12-16.", "xPost": null }, { "slug": "php-cgi-argument-injection-cve-2024-4577", "title": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577", "json": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "PHP Group PHP", "tags": [ "php", "windows", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-4577" ], "affectedVersions": [ "PHP < 8.3.8, < 8.2.20, < 8.1.29 (GitHub advisory); exploitable on Windows in CGI mode" ], "fixedVersions": [ "8.3.8", "8.2.20", "8.1.29" ], "startedAt": "2024-06-06", "closedAt": "2024-06-12", "updatedAt": "2024-06-12", "summary": "A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-may-2024-30040-30051", "title": "Microsoft May 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051", "json": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft DWM Core Library, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-30040", "CVE-2024-30051" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-14", "closedAt": "2024-05-14", "updatedAt": "2024-05-14", "summary": "CVE-2024-30040: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. CVE-2024-30051: Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-05-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2022-38028", "title": "Microsoft Windows Print Spooler Privilege Escalation", "url": "https://pwn.watch/i/microsoft-windows-cve-2022-38028", "json": "https://pwn.watch/i/microsoft-windows-cve-2022-38028.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2022-38028" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-04-23", "closedAt": "2024-04-23", "updatedAt": "2024-04-23", "summary": "Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions. Added to the CISA KEV catalog on 2024-04-23. CVE-2022-38028 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-26169", "title": "Microsoft Windows Error Reporting Service Improper Privilege Management", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-26169.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-26169" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-12", "closedAt": "2024-06-13", "updatedAt": "2024-06-13", "summary": "Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-06-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-21338", "title": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-21338.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-21338" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-13", "closedAt": "2024-03-04", "updatedAt": "2024-03-04", "summary": "Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation. Added to the CISA KEV catalog on 2024-03-04. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-february-2024-21351-21412", "title": "Microsoft February 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412", "json": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-21351", "CVE-2024-21412" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-13", "closedAt": "2024-02-13", "updatedAt": "2024-02-13", "summary": "CVE-2024-21351: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. CVE-2024-21412: Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. Added to the CISA KEV catalog on 2024-02-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-36584", "title": "Microsoft Windows: Mark of the Web (MOTW) Security Feature Bypass (CVE-2023-36584)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36584", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36584.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2023-36584" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-11-16", "closedAt": "2023-11-16", "updatedAt": "2023-11-16", "summary": "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. Added to CISA KEV on 2023-11-16.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-36025-36033-36036", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-36025", "CVE-2023-36033", "CVE-2023-36036" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-11-14", "closedAt": "2023-11-14", "updatedAt": "2023-11-14", "summary": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts. Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges. Added to CISA KEV on 2023-11-14.", "xPost": null }, { "slug": "microsoft-windows-cng-key-isolation-service-cve-2023-28229", "title": "Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)", "url": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229", "json": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows CNG Key Isolation Service", "tags": [ "microsoft", "windows", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-28229" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-10-04", "closedAt": "2023-10-04", "updatedAt": "2023-10-04", "summary": "Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges. Added to CISA KEV on 2023-10-04.", "xPost": null }, { "slug": "winrar-zero-day-cve-2023-38831", "title": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831", "json": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "RARLAB WinRAR", "tags": [ "winrar", "rarlab", "windows", "zero-day", "rce", "cisa-kev" ], "cveIds": [ "CVE-2023-38831" ], "affectedVersions": [ "Before 6.23 (NVD)" ], "fixedVersions": [ "6.23" ], "startedAt": "2023-08-02", "closedAt": "2023-10-18", "updatedAt": "2023-10-18", "summary": "WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-36884", "title": "Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36884", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36884.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-36884" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-17", "closedAt": "2023-07-17", "updatedAt": "2023-07-17", "summary": "Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. Added to CISA KEV on 2023-07-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-32046-32049-36874", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-32046", "CVE-2023-32049", "CVE-2023-36874" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-11", "closedAt": "2023-07-11", "updatedAt": "2023-07-11", "summary": "Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-07-11.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-28252", "title": "Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-28252", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-28252.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-28252" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-04-11", "closedAt": "2023-04-11", "updatedAt": "2023-04-11", "summary": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-04-11. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "3cx-desktopapp-supply-chain-attack-2023", "title": "3CX DesktopApp supply-chain attack (trojanized signed builds)", "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023", "json": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "3CX DesktopApp (Electron)", "tags": [ "3cx", "supply-chain", "electron", "north-korea", "windows", "macos" ], "cveIds": [ "CVE-2023-29059" ], "affectedVersions": [ "Windows Electron app 18.12.407 and 18.12.416 (Update 7) (NVD)", "macOS Electron app 18.11.1213, 18.12.402, 18.12.407 and 18.12.416 (NVD)" ], "fixedVersions": [ "See vendor advisory" ], "startedAt": "2023-03-29", "closedAt": "2023-04-20", "updatedAt": "2023-04-20", "summary": "Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-24880", "title": "Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-24880", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-24880.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-24880" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-14", "closedAt": "2023-03-14", "updatedAt": "2023-03-14", "summary": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. Added to CISA KEV on 2023-03-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-21823-23376", "title": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-21823", "CVE-2023-23376" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-14", "closedAt": "2023-02-14", "updatedAt": "2023-02-14", "summary": "Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-02-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-21674", "title": "Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21674", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-21674.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-21674" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-10", "closedAt": "2023-01-10", "updatedAt": "2023-01-10", "summary": "Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-01-10.", "xPost": null } ], "posts": [ { "authorName": "The Hacker News", "handle": "TheHackersNews", "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg", "text": "🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.\n\nFixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.\n\nWhat developers need to know: https://t.co/l6N4LCjhWt", "date": "2026-10-22T10:44:40.000Z", "url": "https://x.com/TheHackersNews/status/2113219984365359340", "media": [], "incident": "opencode-mcp-oauth-rce-windows" }, { "authorName": "bvcyberguardian", "handle": "bvcyberguardian", "avatarUrl": "https://pbs.twimg.com/profile_images/2072419215970082816/V3aI9G5b_bigger.jpg", "text": "🔴 Patch Windows right now.\n\nCVE-2026-96951 — a \"Mark of the Web\" bypass — is being actively exploited in the wild. A malicious ZIP or ISO can run code on your machine without triggering security warnings.\n\nStart → Settings → Windows Update → Check for updates.\n\nDon't postpone", "date": "2026-10-19T13:07:34.000Z", "url": "https://x.com/bvcyberguardian/status/2112168782596833559", "media": [], "incident": "windows-shell-cve-2026-96951-motw" }, { "authorName": "Novacybersecurity Inc. & Associates", "handle": "thenovacyberXBT", "avatarUrl": "https://pbs.twimg.com/profile_images/2109756295289131008/LyqgwmUQ_bigger.jpg", "text": "Patch fast, stay safe. Attackers exploit known flaws within days, like this month's Windows Shell zero-day (CVE-2026-96951) and the Linux \"PwnEscape\" bug (CVE-2026-99999).\nUpdate Windows and Linux today, turn on auto-updates, and use MFA.\n#CyberSecurity #PatchManagement #InfoSec https://t.co/WYVnDmsENU", "date": "2026-10-18T11:30:36.000Z", "url": "https://x.com/thenovacyberXBT/status/2111781993109495979", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HU6OgPJbAAAo_t6.jpg" } ], "incident": "windows-shell-cve-2026-96951-motw" }, { "authorName": "InfraSecurity Services", "handle": "infrasecserv", "avatarUrl": "https://pbs.twimg.com/profile_images/2033955264173338626/ClYbz4n0_bigger.png", "text": "October Patch Tuesday: 1,408 CVEs, 72 critical. Zero-day CVE-2026-96951 (Windows Shell Mark of the Web bypass) is exploited, CISA deadline Oct 16. SharePoint CVE-2026-65660 is also exploited, yet Microsoft's guide still says No. #PatchTuesday #InfoSec", "date": "2026-10-18T08:03:54.000Z", "url": "https://x.com/infrasecserv/status/2111729974159827024", "media": [], "incident": "windows-shell-cve-2026-96951-motw" } ], "changes": [ { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-19", "title": "Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary.", "body": null, "sourceUrl": "https://x.com/Pillar_sec/status/2112166888985722937", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "windows-shell-cve-2026-96951-motw", "incidentTitle": "Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-10-13", "title": "Microsoft ships patches; CISA KEV lists CVE-2026-96951.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-09-28", "title": "OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "microsoft-windows-cve-2026-81963", "incidentTitle": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-08", "title": "CISA added CVE-2026-81963, CVE-2026-85880 to the KEV catalog (due 2026-09-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-81963" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-08-29", "title": "Pillar Security privately reports the flaw to Anomaly.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820", "incidentTitle": "Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-11", "title": "CISA added CVE-2026-68820 to the KEV catalog (due 2026-08-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820" }, { "incident": "microsoft-windows-cve-2026-32202", "incidentTitle": "Microsoft Windows: Microsoft Windows Protection Mechanism Failure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-28", "title": "CISA added CVE-2026-32202 to the KEV catalog (due 2026-05-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-32202" }, { "incident": "microsoft-windows-cve-2025-60710", "incidentTitle": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-13", "title": "CISA added CVE-2025-60710, CVE-2023-36424 to the KEV catalog (due 2026-04-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-60710" }, { "incident": "microsoft-windows-cve-2026-21513", "incidentTitle": "Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-10", "title": "CISA added CVE-2026-21513, CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519 to the KEV catalog (due 2026-03-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-21513" }, { "incident": "react-native-community-cli-cve-2025-11953", "incidentTitle": "React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-05", "title": "CISA added CVE-2025-11953 to the KEV catalog (due 2026-02-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/react-native-community-cli-cve-2025-11953" }, { "incident": "microsoft-windows-cve-2026-20805", "incidentTitle": "Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-13", "title": "CISA added CVE-2026-20805 to the KEV catalog (due 2026-02-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-20805" }, { "incident": "microsoft-windows-cve-2025-62221", "incidentTitle": "Microsoft Windows: Windows Use After Free Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-12-09", "title": "CISA added CVE-2025-62221 to the KEV catalog (due 2025-12-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-62221" }, { "incident": "microsoft-windows-cve-2025-62215", "incidentTitle": "Microsoft Windows: Windows Race Condition Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-11-12", "title": "CISA added CVE-2025-62215 to the KEV catalog (due 2025-12-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-62215" }, { "incident": "microsoft-windows-cve-2025-59287", "incidentTitle": "Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-24", "title": "CISA added CVE-2025-59287 to the KEV catalog (due 2025-11-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-59287" }, { "incident": "microsoft-windows-cve-2025-33073", "incidentTitle": "Microsoft Windows: Windows SMB Client Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA added CVE-2025-33073 to the KEV catalog (due 2025-11-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-33073" }, { "incident": "microsoft-windows-cve-2025-24990", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-24990, CVE-2025-59230)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-14", "title": "CISA added CVE-2025-24990 to the KEV catalog (due 2025-11-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24990" }, { "incident": "microsoft-windows-cve-2025-24990", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-24990, CVE-2025-59230)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-14", "title": "CISA added CVE-2025-59230 to the KEV catalog (due 2025-11-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24990" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2011-3402 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2013-3918 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2021-43226 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "citrix-session-recording-cve-2024-8068", "incidentTitle": "Citrix Session Recording: 2 exploited vulnerabilities (CVE-2024-8068, CVE-2024-8069)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-08-25", "title": "CISA added CVE-2024-8068 to the KEV catalog (due 2025-09-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-session-recording-cve-2024-8068" }, { "incident": "citrix-session-recording-cve-2024-8068", "incidentTitle": "Citrix Session Recording: 2 exploited vulnerabilities (CVE-2024-8068, CVE-2024-8069)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-08-25", "title": "CISA added CVE-2024-8069 to the KEV catalog (due 2025-09-15).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-session-recording-cve-2024-8068" }, { "incident": "rarlab-winrar-cve-2025-8088", "incidentTitle": "RARLAB WinRAR: WinRAR Path Traversal Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-12", "title": "CISA added CVE-2025-8088 to the KEV catalog (due 2025-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/rarlab-winrar-cve-2025-8088" }, { "incident": "eslint-config-prettier-npm-phishing-cve-2025-54313", "incidentTitle": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "Malicious 'is' package versions found in the same campaign", "body": null, "sourceUrl": "https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack", "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313" }, { "incident": "eslint-config-prettier-npm-phishing-cve-2025-54313", "incidentTitle": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-07-18", "title": "Malicious eslint-config-prettier versions published after maintainer phishing", "body": null, "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2025-54313", "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313" }, { "incident": "microsoft-windows-cve-2025-33053", "incidentTitle": "Microsoft Windows: Microsoft Windows External Control of File Name or Path Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-06-10", "title": "CISA added CVE-2025-33053 to the KEV catalog (due 2025-07-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-33053" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-30397 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-30400 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-32701 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-32706 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-32709 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-24054", "incidentTitle": "Microsoft Windows: Windows NTLM Hash Disclosure Spoofing Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-04-17", "title": "CISA added CVE-2025-24054 to the KEV catalog (due 2025-05-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24054" }, { "incident": "microsoft-windows-cve-2025-29824", "incidentTitle": "Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-08", "title": "CISA added CVE-2025-29824 to the KEV catalog (due 2025-04-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-29824" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24983 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24984 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24985 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24991 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24993 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-26633 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2018-8639", "incidentTitle": "Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-03", "title": "CISA added CVE-2018-8639 to the KEV catalog (due 2025-03-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2018-8639" }, { "incident": "microsoft-windows-cve-2025-21391", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-11", "title": "CISA added CVE-2025-21391 to the KEV catalog (due 2025-03-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21391" }, { "incident": "microsoft-windows-cve-2025-21391", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-11", "title": "CISA added CVE-2025-21418 to the KEV catalog (due 2025-03-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21391" }, { "incident": "microsoft-windows-cve-2025-21333", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-01-14", "title": "CISA added CVE-2025-21333 to the KEV catalog (due 2025-02-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21333" }, { "incident": "microsoft-windows-cve-2025-21333", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-01-14", "title": "CISA added CVE-2025-21334 to the KEV catalog (due 2025-02-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21333" }, { "incident": "microsoft-windows-cve-2025-21333", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-01-14", "title": "CISA added CVE-2025-21335 to the KEV catalog (due 2025-02-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21333" }, { "incident": "microsoft-windows-cve-2024-35250", "incidentTitle": "Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-16", "title": "CISA added CVE-2024-35250 to the KEV catalog (federal deadline 2025-01-06)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-35250" }, { "incident": "microsoft-windows-cve-2024-49138", "incidentTitle": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-10", "title": "CVE-2024-49138 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49138", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-49138" }, { "incident": "microsoft-windows-cve-2024-49138", "incidentTitle": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-10", "title": "CISA added CVE-2024-49138 to the KEV catalog (federal deadline 2024-12-31)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-49138" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CVE-2024-43451 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43451", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CVE-2024-49039 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49039", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2024-43451 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2024-49039 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-windows-cve-2024-30088", "incidentTitle": "Microsoft Windows Kernel TOCTOU Race Condition", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-15", "title": "CISA added CVE-2024-30088 to the KEV catalog (federal deadline 2024-11-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-43572 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43572", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-43573 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43573", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CISA added CVE-2024-43572 to the KEV catalog (federal deadline 2024-10-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CISA added CVE-2024-43573 to the KEV catalog (federal deadline 2024-10-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-windows-cve-2024-43461", "incidentTitle": "Microsoft Windows MSHTML Platform Spoofing", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-16", "title": "CISA added CVE-2024-43461 to the KEV catalog (federal deadline 2024-10-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-43461" }, { "incident": "microsoft-windows-cve-2024-43461", "incidentTitle": "Microsoft Windows MSHTML Platform Spoofing", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-43461 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43461", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-43461" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38014 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38014", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38217 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38217", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38226 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38226", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38014 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38217 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38226 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "kingsoft-wps-office-cve-2024-7262", "incidentTitle": "Kingsoft WPS Office Path Traversal", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-03", "title": "CISA added CVE-2024-7262 to the KEV catalog (federal deadline 2024-09-24)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/kingsoft-wps-office-cve-2024-7262" }, { "incident": "kingsoft-wps-office-cve-2024-7262", "incidentTitle": "Kingsoft WPS Office Path Traversal", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-15", "title": "CVE-2024-7262 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-7262", "url": "https://pwn.watch/i/kingsoft-wps-office-cve-2024-7262" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38106 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38106", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38107 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38107", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38178 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38178", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38189 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38189", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38193 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38193", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38213 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38213", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38106 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38107 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38178 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38189 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38193 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38213 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "crowdstrike-falcon-channel-file-291-outage", "incidentTitle": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-06", "title": "CrowdStrike publishes the Channel File 291 root cause analysis", "body": null, "sourceUrl": "https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage" }, { "incident": "microsoft-windows-cve-2018-0824", "incidentTitle": "Microsoft COM for Windows Deserialization of Untrusted Data", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-05", "title": "CISA added CVE-2018-0824 to the KEV catalog (federal deadline 2024-08-26)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-0824" }, { "incident": "crowdstrike-falcon-channel-file-291-outage", "incidentTitle": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-20", "title": "CrowdStrike publishes technical details; Microsoft estimates 8.5 million Windows devices affected", "body": null, "sourceUrl": "https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage" }, { "incident": "crowdstrike-falcon-channel-file-291-outage", "incidentTitle": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-19", "title": "04:09 UTC: CrowdStrike pushes the Channel File 291 update; Windows hosts crash", "body": null, "sourceUrl": "https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage" }, { "incident": "crowdstrike-falcon-channel-file-291-outage", "incidentTitle": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-19", "title": "05:27 UTC: the faulty update is remediated", "body": null, "sourceUrl": "https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38080 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38080", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38112 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38112", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CISA added CVE-2024-38080 to the KEV catalog (federal deadline 2024-07-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CISA added CVE-2024-38112 to the KEV catalog (federal deadline 2024-07-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-windows-cve-2024-26169", "incidentTitle": "Microsoft Windows Error Reporting Service Improper Privilege Management", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-13", "title": "CISA added CVE-2024-26169 to the KEV catalog (federal deadline 2024-07-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-12", "title": "CISA added CVE-2024-4577 to the KEV catalog (federal deadline 2024-07-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "microsoft-windows-cve-2024-30088", "incidentTitle": "Microsoft Windows Kernel TOCTOU Race Condition", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-11", "title": "CVE-2024-30088 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30088", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088" }, { "incident": "microsoft-windows-cve-2024-35250", "incidentTitle": "Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-11", "title": "CVE-2024-35250 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-35250", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-35250" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-09", "title": "CVE-2024-4577 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "php-cgi-argument-injection-cve-2024-4577", "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-06-06", "title": "DEVCORE discloses CVE-2024-4577; fixed PHP releases available", "body": null, "sourceUrl": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/", "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CVE-2024-30040 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30040", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CVE-2024-30051 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30051", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CISA added CVE-2024-30040 to the KEV catalog (federal deadline 2024-06-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CISA added CVE-2024-30051 to the KEV catalog (federal deadline 2024-06-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-windows-cve-2022-38028", "incidentTitle": "Microsoft Windows Print Spooler Privilege Escalation", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-23", "title": "CISA added CVE-2022-38028 to the KEV catalog (federal deadline 2024-05-14)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2022-38028" }, { "incident": "microsoft-windows-cve-2024-26169", "incidentTitle": "Microsoft Windows Error Reporting Service Improper Privilege Management", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-12", "title": "CVE-2024-26169 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-26169", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169" }, { "incident": "microsoft-windows-cve-2024-21338", "incidentTitle": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CISA added CVE-2024-21338 to the KEV catalog (federal deadline 2024-03-25)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338" }, { "incident": "microsoft-windows-cve-2024-21338", "incidentTitle": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21338 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21338", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21351 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21351", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21412 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21412", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CISA added CVE-2024-21351 to the KEV catalog (federal deadline 2024-03-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CISA added CVE-2024-21412 to the KEV catalog (federal deadline 2024-03-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-windows-cve-2023-36584", "incidentTitle": "Microsoft Windows: Mark of the Web (MOTW) Security Feature Bypass (CVE-2023-36584)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-11-16", "title": "CISA added CVE-2023-36584 to the KEV catalog (due 2023-12-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36584" }, { "incident": "microsoft-windows-cve-2023-36025-36033-36036", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-11-14", "title": "CISA added CVE-2023-36025 to the KEV catalog (due 2023-12-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036" }, { "incident": "microsoft-windows-cve-2023-36025-36033-36036", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-11-14", "title": "CISA added CVE-2023-36033 to the KEV catalog (due 2023-12-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036" }, { "incident": "microsoft-windows-cve-2023-36025-36033-36036", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-11-14", "title": "CISA added CVE-2023-36036 to the KEV catalog (due 2023-12-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-18", "title": "Google TAG: government-backed actors exploiting the WinRAR bug", "body": null, "sourceUrl": "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "microsoft-windows-cng-key-isolation-service-cve-2023-28229", "incidentTitle": "Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-04", "title": "CISA added CVE-2023-28229 to the KEV catalog (due 2023-10-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-24", "title": "CISA adds CVE-2023-38831 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-23", "title": "Group-IB: zero-day exploited since April 2023 against traders", "body": null, "sourceUrl": "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-02", "title": "WinRAR 6.23 released with the fix", "body": null, "sourceUrl": "https://www.rarlab.com/rarnew.htm", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "microsoft-windows-cve-2023-36884", "incidentTitle": "Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-17", "title": "CISA added CVE-2023-36884 to the KEV catalog (due 2023-08-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36884" }, { "incident": "microsoft-windows-cve-2023-32046-32049-36874", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "CISA added CVE-2023-32046 to the KEV catalog (due 2023-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874" }, { "incident": "microsoft-windows-cve-2023-32046-32049-36874", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "CISA added CVE-2023-32049 to the KEV catalog (due 2023-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874" }, { "incident": "microsoft-windows-cve-2023-32046-32049-36874", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "CISA added CVE-2023-36874 to the KEV catalog (due 2023-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874" }, { "incident": "3cx-desktopapp-supply-chain-attack-2023", "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-04-20", "title": "Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise", "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023" }, { "incident": "microsoft-windows-cve-2023-28252", "incidentTitle": "Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-04-11", "title": "CISA added CVE-2023-28252 to the KEV catalog (due 2023-05-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-28252" }, { "incident": "3cx-desktopapp-supply-chain-attack-2023", "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-30", "title": "3CX confirms the compromise and tells customers to uninstall the Electron desktop app", "body": null, "sourceUrl": "https://www.3cx.com/blog/news/desktopapp-security-alert/", "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023" }, { "incident": "3cx-desktopapp-supply-chain-attack-2023", "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-29", "title": "CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines", "body": null, "sourceUrl": "https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/", "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023" }, { "incident": "microsoft-windows-cve-2023-24880", "incidentTitle": "Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-03-14", "title": "CISA added CVE-2023-24880 to the KEV catalog (due 2023-04-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-24880" }, { "incident": "microsoft-windows-cve-2023-21823-23376", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-14", "title": "CISA added CVE-2023-21823 to the KEV catalog (due 2023-03-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376" }, { "incident": "microsoft-windows-cve-2023-21823-23376", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-14", "title": "CISA added CVE-2023-23376 to the KEV catalog (due 2023-03-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376" }, { "incident": "microsoft-windows-cve-2023-21674", "incidentTitle": "Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-01-10", "title": "CISA added CVE-2023-21674 to the KEV catalog (due 2023-01-31).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21674" } ] }