Zero-day report: May 2024
CISA added 14 exploited vulnerabilities to its catalog in May 2024, 4 more than April (10). 8 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Google, with 4.
By technology
Most-hit vendors
Every flaw added in May 2024
- Linux · KernelLinux Kernel Use-After-Free Vulnerability
- Check Point · Quantum Security GatewaysCheck Point Quantum Security Gateways Information Disclosure Vulnerability
- Justice AV Solutions · Viewer Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Apache · FlinkApache Flink Improper Access Control Vulnerability
- NextGen Healthcare · Mirth ConnectNextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- D-Link · DIR-600 RouterD-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
- D-Link · DIR-605 RouterD-Link DIR-605 Router Information Disclosure Vulnerability
- Google · Chromium V8Google Chromium V8 Out-of-Bounds Memory Write Vulnerability
- Microsoft · WindowsMicrosoft Windows MSHTML Platform Security Feature Bypass Vulnerability
- Microsoft · DWM Core Library Microsoft DWM Core Library Privilege Escalation Vulnerability
- Google · ChromiumGoogle Chromium Visuals Use-After-Free Vulnerability
- GitLab · GitLab CE/EEGitLab Community and Enterprise Editions Improper Access Control Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.