https://patchfirst.co/technique/T1553.005/New and newly exploited CVEs that lead to ATT&CK T1553.005 Mark-of-the-Web Bypass, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2025-0411/CVE-2025-0411#kevThu, 06 Feb 2025 00:00:00 GMT7-Zip · 7-Zip. In CISA KEV since 2025-02-06. ENISA EUVD lists it as exploited. EPSS 67.1% (higher than 99.3% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1553.005 Mark-of-the-Web Bypass; T1566.001 Spearphishing Attachment; T1588.001 Malware. Priority 67.8 of 100.kevpublic-exploitT1553.005T1566.001T1588.001https://patchfirst.co/cve/CVE-2024-38217/CVE-2024-38217#kevTue, 10 Sep 2024 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2024-09-10. ENISA EUVD lists it as exploited. EPSS 10.0% (higher than 95.6% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1553.005 Mark-of-the-Web Bypass. Priority 65.9 of 100.kevpublic-exploitT1553.005https://patchfirst.co/cve/CVE-2024-38213/CVE-2024-38213#kevTue, 13 Aug 2024 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2024-08-13. ENISA EUVD lists it as exploited. EPSS 13.6% (higher than 96.5% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1553.005 Mark-of-the-Web Bypass. Priority 61.8 of 100.kevT1553.005https://patchfirst.co/cve/CVE-2024-21412/CVE-2024-21412#kevTue, 13 Feb 2024 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2024-02-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1553.005 Mark-of-the-Web Bypass. Named in 1 threat report. Priority 82.5 of 100.kevransomwarepublic-exploitT1204.001T1553.005https://patchfirst.co/cve/CVE-2024-21351/CVE-2024-21351#kevTue, 13 Feb 2024 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2024-02-13. ENISA EUVD lists it as exploited. EPSS 27.8% (higher than 98.1% of CVEs). CVSS 7.6 HIGH. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 62.9 of 100.kevT1204.002T1553.005https://patchfirst.co/cve/CVE-2023-36584/CVE-2023-36584#kevThu, 16 Nov 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-11-16. ENISA EUVD lists it as exploited. EPSS 3.3% (higher than 88.3% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1553.005 Mark-of-the-Web Bypass. Priority 59.4 of 100.kevT1204.001T1553.005https://patchfirst.co/cve/CVE-2023-36884/CVE-2023-36884#kevMon, 17 Jul 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-07-17, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1566 Phishing; T1204.002 Malicious File; T1005 Data from Local System; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; +1 more. Priority 78.2 of 100.kevransomwarepublic-exploitT1566T1204.002T1005T1486T1489T1490T1553.005https://patchfirst.co/cve/CVE-2023-32049/CVE-2023-32049#kevTue, 11 Jul 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-07-11. ENISA EUVD lists it as exploited. EPSS 4.2% (higher than 90.9% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 62.3 of 100.kevT1204.002T1553.005https://patchfirst.co/cve/CVE-2023-24880/CVE-2023-24880#kevTue, 14 Mar 2023 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2023-03-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 78.0% (higher than 99.57% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1553.005 Mark-of-the-Web Bypass. Priority 71.0 of 100.kevransomwareT1204.001T1553.005https://patchfirst.co/cve/CVE-2022-41049/CVE-2022-41049#kevMon, 14 Nov 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-11-14. ENISA EUVD lists it as exploited. EPSS 2.6% (higher than 85.5% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1553.005 Mark-of-the-Web Bypass. Priority 58.9 of 100.kevT1204.001T1553.005https://patchfirst.co/cve/CVE-2022-41091/CVE-2022-41091Wed, 09 Nov 2022 00:00:00 GMTMicrosoft · Windows. In CISA KEV since 2022-11-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 79.8% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 67.7 of 100.kevransomwareT1204.002T1553.005