Flaws added in June 2024
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in June 2024. For the newest, see Exploited flaws.
In June 2024, CISA added 9 flaws to its list of vulnerabilities being used in attacks, 3 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Linux (1), OSGeo (1) and Roundcube (1).[1]
Seven of the nine let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in June 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-2586At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2022-24816At work |
OSGeo JAI-EXT. Attackers can run their own code on OSGeo JAI-EXT. | At work |
CVE-2020-13965At work |
Roundcube Webmail. Attackers can run code in the browser of someone using Roundcube Webmail and act as them. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-4358At work |
Progress Telerik Report Server. Attackers can get into Progress Telerik Report Server without a valid password. | At work |
CVE-2024-32896At home |
Android Pixel. Someone who already has a foothold can use Android Pixel to take full control of the machine. | At home |
CVE-2024-26169† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-4610At home |
Arm Mali GPU Kernel Driver. Attackers can corrupt memory in Arm Mali GPU Kernel Driver, which they use to take it over. | At home |
CVE-2024-4577† Used in ransomwareAt work |
PHP. Attackers can run their own code on PHP. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2017-3506At work |
Oracle WebLogic Server. Attackers can run their own code on Oracle WebLogic Server from anywhere, without logging in. | At work |
Companies
The flaws were in nine companies’ products; the most were in Android’s (1).
| Company | Flaws | Ransomware |
|---|---|---|
| Android | 1 | – |
| Arm | 1 | – |
| Linux | 1 | – |
| Microsoft | 1 | 1 |
| Oracle | 1 | – |
| OSGeo | 1 | – |
| PHP Group | 1 | 1 |
| Progress | 1 | – |
| Roundcube | 1 | – |
Other months
Every month since CISA started the list; June 2024 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.