Flaws added in August 2024
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in August 2024. For the newest, see Exploited flaws.
In August 2024, CISA added 19 flaws to its list of vulnerabilities being used in attacks, 11 of them in things people have at home; 1 has been used by ransomware gangs. Most came from Microsoft (8), Google (2) and Apache (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in August 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-7965At home |
Chrome and other Chromium browsers. Attackers are using a flaw in Chrome and other Chromium browsers. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-38856At work |
Apache OFBiz. Attackers can run their own code on Apache OFBiz from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-7971At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-39717At work |
Versa Director. Attackers can upload a file to Versa Director and make it run. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-0185At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2021-33045At home |
Dahua IP Camera Firmware. Attackers can get into Dahua IP Camera Firmware without a valid password. | At home |
CVE-2021-33044At home |
Dahua IP Camera Firmware. Attackers can get into Dahua IP Camera Firmware without a valid password. | At home |
CVE-2021-31196At work |
Microsoft Exchange Server. Attackers can run their own code on Microsoft Exchange Server. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-23897† Used in ransomwareAt work |
Jenkins Command Line Interface (CLI). Attackers can run their own code on Jenkins Command Line Interface (CLI) from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-28986At work |
SolarWinds Web Help Desk. Attackers can run their own code on SolarWinds Web Help Desk from anywhere, without logging in. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-38213At home |
Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. | At home |
CVE-2024-38193At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2024-38189At work |
Microsoft Project. Opening a booby-trapped file can let an attacker run their own code through Microsoft Project. | At work |
CVE-2024-38178At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows from anywhere, without logging in. | At home |
CVE-2024-38107At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2024-38106At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-36971At home |
Android Kernel. Attackers can run their own code on Android Kernel. | At home |
CVE-2024-32113At work |
Apache OFBiz. Attackers can run their own code on Apache OFBiz. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2018-0824At home |
Microsoft Windows. Opening a booby-trapped file can let an attacker run their own code through Microsoft Windows. | At home |
Companies
The flaws were in nine companies’ products; the most were in Microsoft’s (8).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 8 | – |
| Apache | 2 | – |
| Dahua | 2 | – |
| 2 | – | |
| Android | 1 | – |
| Jenkins | 1 | 1 |
| Linux | 1 | – |
| SolarWinds | 1 | – |
| Versa | 1 | – |
Other months
Every month since CISA started the list; August 2024 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.