https://patchfirst.co/technique/T1204/New and newly exploited CVEs that lead to ATT&CK T1204 User Execution, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-24993/CVE-2025-24993#kevTue, 11 Mar 2025 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.2% (higher than 82.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1203 Exploitation for Client Execution; T1204 User Execution; T1055 Process Injection; T1565 Data Manipulation. Priority 60.0 of 100.kevT1068T1203T1204T1055T1565https://patchfirst.co/cve/CVE-2023-38831/CVE-2023-38831#kevThu, 24 Aug 2023 00:00:00 GMTRARLAB · WinRAR. In CISA KEV since 2023-08-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204 User Execution; T1005 Data from Local System; T1041 Exfiltration Over C2 Channel; T1053 Scheduled Task/Job; T1105 Ingress Tool Transfer; T1112 Modify Registry; +1 more. Named in 1 threat report. Priority 82.3 of 100.kevransomwarepublic-exploitT1204T1005T1041T1053T1105T1112T1486