2024 in review

All of 2024. Numbers as of 12 October 2026.

Exploited
186
down 1% from 2023
Exploited from day one
22%
40 of 186 were already under attack when they went public
down from 24% in 2023
Typical time to exploitation
22 days
from going public to confirmed attacks
up from 12 days in 2023
Used in ransomware
44
24% of the exploited ones
up 2% from 2023
New vulnerabilities
39,953
up 39% from 2023
Rated critical
4,997
up 8% from 2023

exploited each month

all exploited exploited each month

Vulnerabilities added to KEV each month in 2024. KEV (Known Exploited Vulnerabilities) is the US government agency CISA's list of flaws attackers are known to be using. Each counts in the month it was added, however old it is.

  • 2024
  • 2023

Busiest month: September, with 25. CISA usually gave US federal agencies 21 days to patch each one.

MonthExploitedUsed in ransomware2023
January2185
February9414
March10518
April10117
May14419
June9224
July14216
August1918
September25419
October17418
November22518
December16411

time to exploitation

Time from going public to being added to KEV, for each vulnerability added in 2024.

  • Critical
  • High
  • Medium
  • Low
  • No score
By the day it went public40
Within a week38
Within a month17
Within a year46
1 to 5 years later29
Over 5 years later16
Time to exploitationExploitedCriticalHighMediumLowNo score
By the day it went public40827500
Within a week381817300
Within a month17106100
Within a year462517400
1 to 5 years later291313300
Over 5 years later16411100

new vulnerabilities each month

browse new vulnerabilities each month

CVEs published each month in 2024, by severity. A CVE is the public ID given to one vulnerability; its severity comes from its CVSS score.

  • Critical
  • High
  • Medium
  • Low
  • No score
MonthCVEsCriticalHighMediumLowNo score
January2,5945109601,080440
February2,7783879911,356440
March3,3093881,1191,730693
April3,6213551,2851,8711082
May4,9994801,9682,456950
June3,0783981,0271,581720
July3,1133321,1461,558770
August2,8964881,0461,311510
September2,5142999251,234560
October3,5644571,2911,739761
November4,0564801,5531,943782
December3,4314231,1731,776581

how many were confirmed exploited

All of 2024's CVEs against the ones added to KEV before the year was out, by severity.

  • Critical
  • High
  • Medium
  • Low
  • No score
All new vulnerabilities 100%39,953
Exploited within 2024 0.3%125
VulnerabilitiesCVEsCriticalHighMediumLowNo score
All new vulnerabilities39,9534,99714,48419,6358289
Exploited within 202412554611000

most exploited vendors

Top 10 vendors by vulnerabilities added to KEV in 2024.

  • Critical
  • High
  • Medium
  • Low
  • No score
Microsoft39
Google15
Debian12
Fedoraproject11
Ivanti11
Adobe8
Apple7
Palo Alto Networks7
Cisco6
D-Link6
VendorExploitedCriticalHighMediumLowNo score
Microsoft39333300
Google1558200
Debian1217400
Fedoraproject1146100
Ivanti1156000
Adobe844000
Apple706100
Palo Alto Networks743000
Cisco602400
D-Link642000

most vulnerabilities

Top 10 vendors by new vulnerabilities in 2024.

  • Critical
  • High
  • Medium
  • Low
  • No score
Linux4,363
Microsoft1,127
Google887
Adobe760
Apple602
IBM510
Debian509
Tenda433
D-Link411
Oracle374
VendorCVEsCriticalHighMediumLowNo score
Linux4,363261,2313,072340
Microsoft1,1276077328851
Google88745457374110
Adobe76015238496110
Apple60213178344670
IBM51038153302170
Debian5091721526890
Tenda4331422434710
D-Link411872527200
Oracle374984232490

most common weaknesses

Top 10 weaknesses behind 2024's vulnerabilities. A CWE (Common Weakness Enumeration) names the kind of mistake that caused a flaw, such as cross-site scripting or a buffer overflow.

  • Critical
  • High
  • Medium
  • Low
  • No score
Cross-site Scripting CWE-797,371
SQL Injection CWE-892,687
Out-of-bounds Write CWE-7872,017
Missing Authorization CWE-8621,908
Cross-Site Request Forgery (CSRF) CWE-3521,423
Use After Free CWE-4161,264
Out-of-bounds Read CWE-1251,231
NULL Pointer Dereference CWE-4761,165
Path Traversal CWE-221,074
Stack-based Buffer Overflow CWE-121898
WeaknessCVEsCriticalHighMediumLowNo score
Cross-site Scripting (CWE-79)7,371905356,667790
SQL Injection (CWE-89)2,6871,2761,07832490
Out-of-bounds Write (CWE-787)2,0172781,40133170
Missing Authorization (CWE-862)1,9081564571,275200
Cross-Site Request Forgery (CSRF) (CWE-352)1,42323637741220
Use After Free (CWE-416)1,264501,019179160
Out-of-bounds Read (CWE-125)1,23154575546560
NULL Pointer Dereference (CWE-476)1,16511155984141
Path Traversal (CWE-22)1,074195529326240
Stack-based Buffer Overflow (CWE-121)89818258113230

old flaws, newly exploited

The 10 oldest vulnerabilities added to KEV in 2024: when each went public, and when it was confirmed exploited.

  • Went public
  • Confirmed exploited
CVE-2012-4792 Microsoft Internet Explorer11 years
CVE-2013-0643 Adobe Flash Player11 years
CVE-2013-0648 Adobe Flash Player11 years
CVE-2014-0497 Adobe Flash Player10 years
CVE-2014-0502 Adobe Air10 years
CVE-2014-2120 Cisco Adaptive Security Appliance Software10 years
CVE-2014-100005 D-Link DIR-600 Firmware9 years
CVE-2016-3714 Canonical Ubuntu Linux8 years
CVE-2017-3506 Oracle WebLogic Server7 years
CVE-2017-1000253 Centos6 years
CVEProductWent publicAttacks confirmedGap
CVE-2012-4792Microsoft Internet Explorer2012-12-302024-07-2311 years
CVE-2013-0643Adobe Flash Player2013-02-272024-09-1711 years
CVE-2013-0648Adobe Flash Player2013-02-272024-09-1711 years
CVE-2014-0497Adobe Flash Player2014-02-052024-09-1710 years
CVE-2014-0502Adobe Air2014-02-212024-09-1710 years
CVE-2014-2120Cisco Adaptive Security Appliance Software2014-03-192024-11-1210 years
CVE-2014-100005D-Link DIR-600 Firmware2015-01-132024-05-169 years
CVE-2016-3714Canonical Ubuntu Linux2016-05-052024-09-098 years
CVE-2017-3506Oracle WebLogic Server2017-04-242024-06-037 years
CVE-2017-1000253Centos2017-10-052024-09-096 years

About these numbers

  • Vulnerabilities are counted by the date NVD published them. Rejected ones aren't counted.
  • "Exploited" means CISA added it to its Known Exploited Vulnerabilities list that year, however old it is. The list started in late 2021 and spent 2022 mostly catching up on older flaws, so these reviews start with 2023.
  • Severity is NVD's current rating. "No score" means NVD hasn't rated it yet.
  • Everything about exploitation counts only what CISA added within the year, so it doesn't change once the year is over. The two exceptions: severity and the ransomware link are NVD's and CISA's current values, as neither keeps a history.
  • A vulnerability that affects several vendors counts once for each.
  • Late ratings and rejections can still shift these numbers a little.