THE INTERNET IS THINKING
Earlier sources: Security
Digital security protects systems, software, accounts, and information from misuse. Explore cybersecurity, vulnerabilities, threat intelligence, cryptography, privacy, and identity, with links to the underlying advisories and research.
SYMTRI organizes observations from public sources into a living map. Connections reflect shared subject matter; they do not establish causation or endorse a source.
Open in the map ↗713 classified signals in the fourteen-day window. Recent momentum: steady. These counts include signals awaiting readable evidence.
Earlier sources
Up to ten sources with readable evidence, ordered by their feed timestamp. These archive sources can be older than the live fourteen-day window. This list is a sample, not a measure of total activity. Dates distinguish paper publication, repository creation, model/dataset activity, Hacker News posts, and KEV catalog additions. “First archived” records when SYMTRI first stored the signal.
- CISA · Added to KEV · First archived
CVE-2024-23222: Apple Multiple Products WebKit Type Confusion Vulnerability ↗
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-01-23 (not the first disclosure date). Action due date: 2024-02-13.
- CISA · Added to KEV · First archived
CVE-2023-34048: VMware vCenter Server Out-of-Bounds Write Vulnerability ↗
VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-01-22 (not the first disclosure date). Action due date: 2024-02-12.
- CISA · Added to KEV · First archived
CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability ↗
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Known. Added to the KEV catalog: 2024-01-18 (not the first disclosure date). Action due date: 2024-02-08.
- CISA · Added to KEV · First archived
CVE-2024-0519: Google Chromium V8 Out-of-Bounds Memory Access Vulnerability ↗
Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-01-17 (not the first disclosure date). Action due date: 2024-02-07.
- CISA · Added to KEV · First archived
CVE-2023-6549: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability ↗
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-01-17 (not the first disclosure date). Action due date: 2024-02-07.
- CISA · Added to KEV · First archived
CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability ↗
Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-01-17 (not the first disclosure date). Action due date: 2024-01-24.
- CISA · Added to KEV · First archived
CVE-2018-15133: Laravel Deserialization of Untrusted Data Vulnerability ↗
Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable). Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-01-16 (not the first disclosure date). Action due date: 2024-02-06.
- CISA · Added to KEV · First archived
CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability ↗
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Known. Added to the KEV catalog: 2024-01-10 (not the
- CISA · Added to KEV · First archived
CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability ↗
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Known. Added to the KEV catalog: 2024-01-10 (not the first disclosure date). Actio
- CISA · Added to KEV · First archived
CVE-2023-29357: Microsoft SharePoint Server Privilege Escalation Vulnerability ↗
Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Known. Added to the KEV catalog: 2024-01-10 (not the first disclosure date). Action due date: 2024-01-31.
Live window recorded . This is the ingestion observation time, not the publication or discovery date of each source.
How to assess evidence about Security
Check each original source for its methods, release status, limitations, and supporting data. A repository announcement, a preprint, and a published study provide different kinds of evidence. SYMTRI’s subject classification helps discovery; it does not independently validate the source’s claims.
See the collection and counting methodology ↗ · Read the weekly synthesis ↗
Follow a thread
Explore related regions
These navigation suggestions are part of the map’s editorial structure, rather than measured evidence of a connection.