悪用された脆弱性のライブラリ
米国サイバーセキュリティ・インフラストラクチャセキュリティ庁（CISA）が2021年11月から管理しているカタログに基づく、攻撃者による使用が確認されているすべてのソフトウェアの欠陥。1時間ごとに更新。
- 1,779件の悪用された脆弱性
- 361ランサムウェアで使用
- 294社のベンダー
1,779件の脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/11/10 | Improper Restriction of XML External Entity Reference | Cisco BroadWorks | 高 7.5 | 0.8% |
| 2026/11/10 | Use-After-Free | Google Chromium | 高 8.8 | 1.0% |
| 2026/11/10 | Outlook Missing User Interaction for Potentially Unsafe Action | Microsoft Office | 中 6.5 | 1.6% |
| 2026/11/10 | Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel | Barracuda Networks Barracuda Email Security Gateway (ESG) | 緊急 9.3 | 8.9% |
| 2026/11/10 | Incorrect Resource Transfer Between Spheres | Openwave Messaging Limited Webtop Media Transcoder | 中 4.3 | 0.6% |
| 2026/11/10 | OS Command Injection | Barracuda Networks Multiple Products | 高 8.6 | 6.2% |
| 2026/11/09 | Incorrect Authorization | IBM Aspera Faspex | 緊急 9.8 | 0.5% |
| 2026/11/09 | Unexpected Status Code or Return Value | OpenBSD OpenSSH | 高 8.1 | 19% |
| 2026/11/09 | Code Injection | SignalWire FreeSwitch | 緊急 9.8 | 2.5% |
| 2026/11/09 | Improper Authentication | GPUStack GPUStack | 緊急 9.8 | 0.5% |
| 2026/11/06 | Use of Single-factor Authentication | SonicWall SonicOS SSLVPN | 高 7.5 | 0.5% |
| 2026/11/04 | Improper Authentication | Apple Multiple Products | 中 5.5 | 1.5% |
| 2026/11/03 | Time-of-check Time-of-use (TOCTOU) Race Condition | WordPress WordPress Core | 高 8.1 | 1.2% |
| 2026/10/30 | Generation of Predictable Numbers or Identifiers | Ivanti Connect Secure | 0.8% | |
| 2026/10/30 | Missing Authentication for Critical Function | Ivanti Connect Secure | 高 7.0 | 0.5% |
| 2026/10/29 | Integer Overflow or Wraparound | GitLab Community Edition and Enterprise Edition | 緊急 10.0 | 69% |
| 2026/10/29 | Unchecked Return Value to NULL Pointer Dereference | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | 高 8.6 | 0.8% |
| 2026/10/28 | Missing Initialization of a Variable | Linux Kernel | 高 7.8 | 16% |
| 2026/10/28 | Insufficient Logging | Broadcom VMware ESX | 低 2.7 | 0.7% |
| 2026/10/27 | Unrestricted Upload of File with Dangerous Type | Adobe Commerce and Magento | 緊急 9.3 | 47% |
| 2026/10/27 | Unchecked Return Value | Google Brotli | 緊急 9.2 | 83% |
| 2026/10/26 | Stale Internal Request-State | PHP Group PHP | 緊急 9.2 | >99.9% |
| 2026/10/26 | Memory Corruption | PHP Group PHP | 緊急 9.2 | >99.9% |
| 2026/10/23 | SQL Injection | Arista VeloCloud Orchestrator | 緊急 9.4 | 1.0% |
| 2026/10/23 | Online – Built-in CODE Server OS Command Injection | Collabora Collabora Online – Built-in CODE Server | 緊急 9.2 | 73% |
| 2026/10/20 | External Control of File Name or Path | Plex Media Server | 高 8.6 | 1.8% |
| 2026/10/20 | Server-Side Request Forgery (SSRF) | Plex Media Server | 中 5.3 | 11% |
| 2026/10/20 | Improper Neutralization of Encoded URI Schemes in a Web Page | Plex Media Server | 中 6.9 | 1.9% |
| 2026/10/20 | Server-Side Request Forgery (SSRF) | Plex Media Server | 中 5.3 | 12% |
| 2026/10/20 | Uncontrolled Search Path Element | Siemens Software Center | 高 8.4 | 1.0% |
| 2026/10/20 | OS Command Injection | EG Secure Solutions SiteGuard Server Edition | 高 8.5 | 2.5% |
| 2026/10/16 | Authentication Bypass by Spoofing | BeyondTrust Remote Support | 緊急 9.3 | 79% |
| 2026/10/16 | Path Traversal | Fortinet Multiple Products | 中 5.4 | 1.4% |
| 2026/10/15 | Files or Directories Accessible to External Parties | Atlassian Multiple Products | 緊急 9.3 | 99.7% |
| 2026/10/14 | Relative Path Traversal | Cisco Secure Email Gateway | 緊急 9.8 | 6.2% |
| 2026/10/14 | Command Injection | Ahsay AhsayCBS | 緊急 10.0 | 82% |
| 2026/10/14 | Improper Authentication | Ahsay AhsayCBS | 中 6.9 | 84% |
| 2026/10/14 | Code Injection | Palo Alto Networks PAN-OS | 高 8.6 | 2.1% |
| 2026/10/13 | Command Injection | Microsoft Windows | 高 8.8 | 9.8% |
| 2026/10/13 | Authentication Bypass by Spoofing | Ivanti Connect Secure | 高 8.6 | 89% |
| 2026/10/08 | Cleartext Storage of Sensitive Information | Strapi Strapi | 高 7.2 | 4.1% |
| 2026/10/08 | Server Path Traversal | ONLYOFFICE Docs | 緊急 9.8 | 30% |
| 2026/10/08 | Command Injection | Apache Struts | 高 8.1 | 97% |
| 2026/10/08 | ISC BIND Data Processing Errors | ISC BIND | 高 7.5 | 99.6% |
| 2026/10/08 | Improper Access Control | ProFTPD ProFTPD | 緊急 10.0 | 99.5% |
| 2026/10/04 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler | 高 8.7 | 11% |
| 2026/10/02 | Improper Privilege Management | Zammad GmbH Zammad | 高 8.5 | 11% |
| 2026/10/02 | Session Fixation | Zammad GmbH Zammad | 高 8.7 | 50% |
| 2026/10/01 | Path Traversal | Fortinet FortiMail | 緊急 9.8 | 4.6% |
| 2026/09/30 | Hex Encoding | Cisco Catalyst SD-WAN Manager | 緊急 9.8 | 39% |
最も標的にされているベンダー
- Microsoft 391
- Cisco 103
- Apple 96
- Adobe 83
- Google 77
- Oracle 46
- Apache 41
- Ivanti 38
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。