Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 31, 2025 | Static Credential | Cisco Smart Licensing Utility | Critical 9.8 | 97% |
| Mar 27, 2025 | Sandbox Escape | Google Chromium Mojo | High 8.3 | 9.2% |
| Mar 26, 2025 | Deserialization | Sitecore CMS and Experience Platform (XP) | High 8.8 | 25% |
| Mar 26, 2025 | Deserialization | Sitecore CMS and Experience Platform (XP) | Critical 9.8 | 84% |
| Mar 24, 2025 | reviewdog/action-setup GitHub Action Embedded Malicious Code | reviewdog action-setup GitHub Action | High 8.6 | 2.5% |
| Mar 19, 2025 | OS Command Injection | Edimax IC-7100 IP Camera | Critical 9.3 | 74% |
| Mar 19, 2025 | Absolute Path Traversal | NAKIVO Backup and Replication | High 8.6 | 94% |
| Mar 19, 2025 | Directory Traversal | SAP NetWeaver | High 7.5 | 95% |
| Mar 18, 2025 | tj-actions/changed-files GitHub Action Embedded Malicious Code | tj-actions changed-files GitHub Action | High 8.6 | 72% |
| Mar 18, 2025 | Authentication Bypass | Fortinet FortiOS and FortiProxy | High 8.1 | 7.2% |
| Mar 13, 2025 | WebKit Out-of-Bounds Write | Apple Multiple Products | Critical 10.0 | 3.8% |
| Mar 13, 2025 | Improper Isolation or Compartmentalization | Juniper Junos OS | Medium 6.7 | 1.7% |
| Mar 11, 2025 | Management Console (MMC) Improper Neutralization | Microsoft Windows | High 7.0 | 30% |
| Mar 11, 2025 | NTFS Heap-Based Buffer Overflow | Microsoft Windows | High 7.8 | 2.2% |
| Mar 11, 2025 | NTFS Out-Of-Bounds Read | Microsoft Windows | Medium 5.5 | 2.0% |
| Mar 11, 2025 | Fast FAT File System Driver Integer Overflow | Microsoft Windows | High 7.8 | 3.9% |
| Mar 11, 2025 | NTFS Information Disclosure | Microsoft Windows | Medium 4.6 | 2.0% |
| Mar 11, 2025 | Win32k Use-After-Free | Microsoft Windows | High 7.0 | 1.9% |
| Mar 10, 2025 | Advantive VeraCore SQL Injection | Advantive VeraCore | Medium 5.8 | 56% |
| Mar 10, 2025 | Unrestricted File Upload | Advantive VeraCore | Critical 9.9 | 32% |
| Mar 10, 2025 | Absolute Path Traversal | Ivanti Endpoint Manager (EPM) | Critical 9.8 | 90% |
| Mar 10, 2025 | Absolute Path Traversal | Ivanti Endpoint Manager (EPM) | Critical 9.8 | 91% |
| Mar 10, 2025 | Absolute Path Traversal | Ivanti Endpoint Manager (EPM) | Critical 9.8 | >99.9% |
| Mar 4, 2025 | Information Disclosure | VMware ESXi, Workstation, and Fusion | High 7.1 | 1.6% |
| Mar 4, 2025 | Arbitrary Write | VMware ESXi | High 8.2 | 1.0% |
| Mar 4, 2025 | TOCTOU Race Condition | VMware ESXi and Workstation | Critical 9.3 | 1.6% |
| Mar 4, 2025 | Use of Uninitialized Resource | Linux Kernel | Medium 5.5 | 0.8% |
| Mar 3, 2025 | Path Traversal | Progress WhatsUp Gold | Critical 9.8 | 99.3% |
| Mar 3, 2025 | Command Injection | Cisco Small Business RV Series Routers | Medium 6.5 | 54% |
| Mar 3, 2025 | Pentaho BA Server Authorization Bypass | Hitachi Vantara Pentaho Business Analytics (BA) Server | High 8.6 | 92% |
| Mar 3, 2025 | Pentaho BA Server Special Element Injection | Hitachi Vantara Pentaho Business Analytics (BA) Server | High 8.8 | 98% |
| Mar 3, 2025 | Win32k Improper Resource Shutdown or Release | Microsoft Windows | High 8.4 | 22% |
| Feb 25, 2025 | Improper Access Control | Microsoft Partner Center | High 8.7 | 1.3% |
| Feb 25, 2025 | Cross-Site Scripting (XSS) | Synacor Zimbra Collaboration Suite (ZCS) | Critical 9.0 | 77% |
| Feb 24, 2025 | Deserialization | Oracle Agile Product Lifecycle Management (PLM) | High 8.8 | 3.9% |
| Feb 24, 2025 | Deserialization | Adobe ColdFusion | Critical 9.8 | 91% |
| Feb 21, 2025 | Improper Access Control | Microsoft Power Pages | High 8.2 | 1.6% |
| Feb 20, 2025 | Code Injection | Craft CMS Craft CMS | High 8.1 | 22% |
| Feb 20, 2025 | File Read | Palo Alto Networks PAN-OS | High 7.1 | 2.0% |
| Feb 18, 2025 | Authentication Bypass | Palo Alto Networks PAN-OS | High 8.8 | 98% |
| Feb 18, 2025 | SSLVPN Improper Authentication | SonicWall SonicOS | High 8.2 | 95% |
| Feb 13, 2025 | Path Traversal | SimpleHelp SimpleHelp | Critical 9.1 | 97% |
| Feb 12, 2025 | Incorrect Authorization | Apple iOS and iPadOS | Medium 6.1 | 4.5% |
| Feb 12, 2025 | Argument Injection | Mitel SIP Phones | Medium 6.8 | 42% |
| Feb 11, 2025 | Ancillary Function Driver for WinSock Heap-Based Buffer Overflow | Microsoft Windows | High 7.8 | 2.1% |
| Feb 11, 2025 | Storage Link Following | Microsoft Windows | High 7.1 | 2.3% |
| Feb 11, 2025 | DSL CPE OS Command Injection | Zyxel DSL CPE Devices | High 8.8 | 23% |
| Feb 11, 2025 | DSL CPE OS Command Injection | Zyxel DSL CPE Devices | High 8.8 | 21% |
| Feb 7, 2025 | Deserialization | Trimble Cityworks | High 8.6 | 31% |
| Feb 6, 2025 | Mark of the Web Bypass | 7-Zip 7-Zip | High 7.0 | 67% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.