Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,758exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,758 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 26, 2026 | Stale Internal Request-State | PHP Group PHP | Critical 9.2 | >99.9% |
| Oct 26, 2026 | Memory Corruption | PHP Group PHP | Critical 9.2 | >99.9% |
| Oct 23, 2026 | SQL Injection | Arista VeloCloud Orchestrator | Critical 9.4 | 1.0% |
| Oct 23, 2026 | Online – Built-in CODE Server OS Command Injection | Collabora Collabora Online – Built-in CODE Server | Critical 9.2 | 12% |
| Oct 20, 2026 | External Control of File Name or Path | Plex Media Server | High 8.6 | 1.8% |
| Oct 20, 2026 | Server-Side Request Forgery (SSRF) | Plex Media Server | Medium 5.3 | 1.6% |
| Oct 20, 2026 | Improper Neutralization of Encoded URI Schemes in a Web Page | Plex Media Server | Medium 6.9 | 1.9% |
| Oct 20, 2026 | Server-Side Request Forgery (SSRF) | Plex Media Server | Medium 5.3 | 1.8% |
| Oct 20, 2026 | Uncontrolled Search Path Element | Siemens Software Center | High 8.4 | 1.0% |
| Oct 20, 2026 | OS Command Injection | EG Secure Solutions SiteGuard Server Edition | High 8.5 | 2.5% |
| Oct 16, 2026 | Authentication Bypass by Spoofing | BeyondTrust Remote Support | Critical 9.3 | 20% |
| Oct 16, 2026 | Path Traversal | Fortinet Multiple Products | Medium 5.4 | 1.3% |
| Oct 15, 2026 | Files or Directories Accessible to External Parties | Atlassian Multiple Products | Critical 9.3 | 99.5% |
| Oct 14, 2026 | Relative Path Traversal | Cisco Secure Email Gateway | Critical 9.8 | 2.2% |
| Oct 14, 2026 | Command Injection | Ahsay AhsayCBS | Critical 10.0 | 86% |
| Oct 14, 2026 | Improper Authentication | Ahsay AhsayCBS | Medium 6.9 | 79% |
| Oct 14, 2026 | Code Injection | Palo Alto Networks PAN-OS | High 8.6 | 1.7% |
| Oct 13, 2026 | Command Injection | Microsoft Windows | High 8.8 | 9.8% |
| Oct 13, 2026 | Authentication Bypass by Spoofing | Ivanti Connect Secure | High 8.6 | 87% |
| Oct 8, 2026 | Cleartext Storage of Sensitive Information | Strapi Strapi | High 7.2 | 4.1% |
| Oct 8, 2026 | Server Path Traversal | ONLYOFFICE Docs | Critical 9.8 | 30% |
| Oct 8, 2026 | Command Injection | Apache Struts | High 8.1 | 97% |
| Oct 8, 2026 | ISC BIND Data Processing Errors | ISC BIND | High 7.5 | 99.6% |
| Oct 8, 2026 | Improper Access Control | ProFTPD ProFTPD | Critical 10.0 | 99.5% |
| Oct 4, 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler | High 8.7 | 11% |
| Oct 2, 2026 | Improper Privilege Management | Zammad GmbH Zammad | High 8.5 | 0.9% |
| Oct 2, 2026 | Session Fixation | Zammad GmbH Zammad | High 8.7 | 2.0% |
| Oct 1, 2026 | Path Traversal | Fortinet FortiMail | Critical 9.8 | 4.6% |
| Sep 30, 2026 | Hex Encoding | Cisco Catalyst SD-WAN Manager | Critical 9.8 | 39% |
| Sep 29, 2026 | Out-of-Bounds Write | Apple Multiple Products | High 8.8 | 26% |
| Sep 27, 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler | Critical 9.5 | 78% |
| Sep 27, 2026 | Improper Input Validation | Citrix NetScaler | Critical 9.5 | 82% |
| Sep 25, 2026 | Remote File Inclusion | WordPress Core | High 8.1 | 96% |
| Sep 25, 2026 | Improper Enforcement of Behavioral Workflow | MikroTik RouterOS | Medium 6.9 | 2.3% |
| Sep 25, 2026 | Code Injection | Microsoft SharePoint | High 8.8 | 8.2% |
| Sep 24, 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Adobe Commerce and Magento | Critical 9.1 | 90% |
| Sep 24, 2026 | Path Traversal Vulnerability | WSO2 Multiple Products | Critical 10.0 | 22% |
| Sep 22, 2026 | Heap-based Buffer Overflow | F5 BIG-IP APM | Critical 9.3 | 25% |
| Sep 22, 2026 | Improper Input Validation | Arista VeloCloud Orchestrator | Critical 9.5 | 1.4% |
| Sep 22, 2026 | Path Traversal | Check Point Multiple Products | Critical 9.8 | 92% |
| Sep 22, 2026 | Improper Certificate Validation | Check Point Multiple Products | Critical 9.8 | 54% |
| Sep 21, 2026 | Stack-Based Buffer Overflow | Zyxel GS1900 Series Switches | High 8.8 | 2.8% |
| Sep 18, 2026 | Out-of-Bounds Write | Linux Kernel | High 8.8 | 0.9% |
| Sep 18, 2026 | Race Condition | Linux Kernel | High 7.8 | 1.6% |
| Sep 18, 2026 | Improper Check for Unusual or Exceptional Conditions | Linux Kernel | Critical 9.8 | 3.3% |
| Sep 16, 2026 | Incorrect Default Permissions | Acronis Backup | High 7.8 | 0.2% |
| Sep 16, 2026 | Incorrect Use of Privileged APIs | Cisco Identity Services Engine | Critical 10.0 | 76% |
| Sep 16, 2026 | Improper Authorization | Google Pixel | High 8.8 | 0.6% |
| Sep 14, 2026 | SQL Injection | Cisco Secure Email Gateway | Critical 9.8 | 30% |
| Sep 11, 2026 | Path Traversal | GitLab Community Edition and Enterprise Edition | Critical 10.0 | 97% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 82
- Google 75
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 31
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.