Flaws added in May 2024
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in May 2024. For the newest, see Exploited flaws.
In May 2024, CISA added 14 flaws to its list of vulnerabilities being used in attacks, 8 of them in things people have at home; 4 have been used by ransomware gangs. Most came from Google (4), D-Link (2) and Microsoft (2).[1]
About half let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in May 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-24919† Used in ransomwareAt work |
Check Point Quantum Security Gateways. Attackers can read information from Check Point Quantum Security Gateways that should be private. | At work |
CVE-2024-1086† Used in ransomwareAt work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-4978At work |
Justice AV Solutions Viewer. A tampered release of Justice AV Solutions Viewer was published with malicious code built in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-5274At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2020-17519At work |
Apache Flink. Attackers can reach parts of Apache Flink that should be locked to them. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-4947At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
CVE-2023-43208† Used in ransomwareAt work |
NextGen Healthcare Mirth Connect. Attackers can run their own code on NextGen Healthcare Mirth Connect from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-4761At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
CVE-2021-40655At home |
D-Link DIR-605 Router. Attackers can read information from D-Link DIR-605 Router that should be private. | At home |
CVE-2014-100005At home |
D-Link DIR-600 Router. A malicious link or page can make D-Link DIR-600 Router carry out actions as a signed-in user. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-30051† Used in ransomwareAt home |
Microsoft DWM Core Library. Someone who already has a foothold can use Microsoft DWM Core Library to take full control of the machine. | At home |
CVE-2024-30040At home |
Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-4671At home |
Chrome and other Chromium browsers. Attackers can get past a security protection in Chrome and other Chromium browsers. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-7028At work |
GitLab CE/EE. Attackers can reach parts of GitLab CE/EE that should be locked to them. | At work |
Companies
The flaws were in nine companies’ products; the most were in Google’s (4).
| Company | Flaws | Ransomware |
|---|---|---|
| 4 | – | |
| D-Link | 2 | – |
| Microsoft | 2 | 1 |
| Apache | 1 | – |
| Check Point | 1 | 1 |
| GitLab | 1 | – |
| Justice AV Solutions | 1 | – |
| Linux | 1 | 1 |
| NextGen Healthcare | 1 | 1 |
Other months
Every month since CISA started the list; May 2024 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.