Exploited CVEs of 2024: Lessons for Vendors and Defenders
summary
2024 records show over 750 CVEs confirmed exploited in the wild, with roughly 2,000 reference citations from 100+ sources (Shadow Server, MSRC, CISA KEV, GitHub exploits). Evidence chain often runs from public PoC to Metasploit modules to observed exploitation; 62 WordPress plugins and ~53 CVEs tied to ransomware stand out. EPSS v4 improves prediction after retraining but scoring systems (CVSS/BT) only marginally reprioritize real exploit risk. Defenders should prioritize weaponization/exploit evidence, internet-facing network-edge devices, OSs, OSS components and rapid patch/mitigation workflows.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:08Known exploited vulnerabilities
- 3:38Exploitation evidence sources
- 7:122024 exploitation trends
- 10:29Exploited CVEs examples
- 13:41CISA KEV vs broader data
- 15:49Key tech categories
- 18:38Scoring system limits
- 22:32Defender considerations
- 24:20Rapid response & debt
- 25:27Q&A on CVSS BT
related talks
57mSeeing the Vulnerable Forest Through the Exploited Trees
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
15mKeynote
16mHistorical Analysis of Exploit Availability Timelines
54mTowards Real World Cyber Risk (Panel)
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
39mCVE 101: The Unfolding Of A Zero Day Attack