Flaws added in January 2024
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in January 2024. For the newest, see Exploited flaws.
In January 2024, CISA added 21 flaws to its list of vulnerabilities being used in attacks, 6 of them in things people have at home; 8 have been used by ransomware gangs. Most came from Ivanti (4), Apple (3) and Google (2).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the third most CISA added in any month of 2024.
List of flaws
Every flaw CISA added in January 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-21893† Used in ransomwareAt work |
Ivanti Connect Secure, Policy Secure, and Neurons. Attackers can make Ivanti Connect Secure, Policy Secure, and Neurons send requests into the network behind it from anywhere, without logging in. | At work |
CVE-2022-48618At home |
Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-22527† Used in ransomwareAt work |
Atlassian Confluence Data Center and Server. Attackers can run their own code on Atlassian Confluence Data Center and Server from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-23222At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-34048At work |
VMware vCenter Server. Attackers can run their own code on VMware vCenter Server. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-35082† Used in ransomwareAt work |
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core. Attackers can get into Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core without a valid password. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-0519At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
CVE-2023-6549At work |
Citrix NetScaler ADC and NetScaler Gateway. Attackers can corrupt memory in Citrix NetScaler ADC and NetScaler Gateway from anywhere, without logging in, which they use to take it over. | At work |
CVE-2023-6548At work |
Citrix NetScaler ADC and NetScaler Gateway. Someone who already has a way in can use Citrix NetScaler ADC and NetScaler Gateway to run their own code. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2018-15133At work |
Laravel Framework. Attackers can run their own code on Laravel Framework. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-21887† Used in ransomwareAt work |
Ivanti Connect Secure and Policy Secure. Attackers can run their own code on Ivanti Connect Secure and Policy Secure. | At work |
CVE-2023-46805† Used in ransomwareAt work |
Ivanti Connect Secure and Policy Secure. Attackers can run commands on Ivanti Connect Secure and Policy Secure. | At work |
CVE-2023-29357† Used in ransomwareAt work |
Microsoft SharePoint Server. Attackers can use Microsoft SharePoint Server to take full control of the machine from anywhere, without logging in. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-41990At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2023-38203† Used in ransomwareAt work |
Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion. | At work |
CVE-2023-29300† Used in ransomwareAt work |
Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion. | At work |
CVE-2023-27524At work |
Apache Superset. Attackers can read information from Apache Superset that should be private. | At work |
CVE-2023-23752At work |
Joomla!. Attackers can reach parts of Joomla! that should be locked to them. | At work |
CVE-2016-20017At home |
D-Link DSL-2750B Devices. Attackers can run commands on D-Link DSL-2750B Devices from anywhere, without logging in. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-7101At work |
Spreadsheet::ParseExcel. Attackers can run their own code on Spreadsheet::ParseExcel. | At work |
CVE-2023-7024At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
Companies
The flaws were in 13 companies’ products; the most were in Ivanti’s (4).
| Company | Flaws | Ransomware |
|---|---|---|
| Ivanti | 4 | 4 |
| Apple | 3 | – |
| Adobe | 2 | 2 |
| Citrix | 2 | – |
| 2 | – | |
| Apache | 1 | – |
| Atlassian | 1 | 1 |
| D-Link | 1 | – |
| Joomla! | 1 | – |
| Laravel | 1 | – |
| Microsoft | 1 | 1 |
| Spreadsheet::ParseExcel | 1 | – |
| VMware | 1 | – |
Other months
Every month since CISA started the list; January 2024 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.