Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 6, 2025 | Outlook Improper Input Validation | Microsoft Office Outlook | Critical 9.8 | 95% |
| Feb 6, 2025 | Process Control | Audinate Dante Discovery | High 7.8 | 8.3% |
| Feb 6, 2025 | (CROS) SQL Injection | Sophos CyberoamOS | Critical 9.8 | 4.7% |
| Feb 6, 2025 | Buffer Overflow | Sophos XG Firewall | Critical 9.8 | 11% |
| Feb 5, 2025 | Out-of-Bounds Write | Linux Kernel | High 7.8 | 3.4% |
| Feb 4, 2025 | Forced Browsing | Apache OFBiz | Critical 9.8 | >99.9% |
| Feb 4, 2025 | Information Disclosure | Microsoft .NET Framework | High 7.5 | 99% |
| Feb 4, 2025 | OS Command Injection | Paessler PRTG Network Monitor | High 7.2 | 87% |
| Feb 4, 2025 | Local File Inclusion | Paessler PRTG Network Monitor | Critical 9.8 | 98% |
| Jan 29, 2025 | Use-After-Free | Apple Multiple Products | Critical 10.0 | 18% |
| Jan 24, 2025 | Deserialization | SonicWall SMA1000 Appliances | Critical 9.8 | 23% |
| Jan 23, 2025 | Cross-Site Scripting (XSS) | JQuery JQuery | Medium 6.9 | 85% |
| Jan 16, 2025 | OS Command Injection | Aviatrix Controllers | Critical 10.0 | 99% |
| Jan 14, 2025 | Hyper-V NT Kernel Integration VSP Use-After-Free | Microsoft Windows | High 7.8 | 1.4% |
| Jan 14, 2025 | Hyper-V NT Kernel Integration VSP Use-After-Free | Microsoft Windows | High 7.8 | 1.6% |
| Jan 14, 2025 | Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow | Microsoft Windows | High 7.8 | 10% |
| Jan 14, 2025 | Authentication Bypass | Fortinet FortiOS and FortiProxy | Critical 9.6 | 94% |
| Jan 13, 2025 | OS Command Injection | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) | Medium 6.6 | 32% |
| Jan 13, 2025 | HTTP Tunneling | Qlik Sense | Critical 9.6 | 48% |
| Jan 8, 2025 | Stack-Based Buffer Overflow | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | Critical 9.0 | >99.9% |
| Jan 7, 2025 | Path Traversal | Mitel MiCollab | Medium 4.4 | 38% |
| Jan 7, 2025 | Path Traversal | Mitel MiCollab | Critical 9.1 | 97% |
| Jan 7, 2025 | Unspecified | Oracle WebLogic Server | Critical 9.8 | 95% |
| Dec 30, 2024 | Malicious DNS Packet | Palo Alto Networks PAN-OS | High 8.7 | 29% |
| Dec 23, 2024 | Use of Hard-Coded Credentials Vulnerability | Acclaim Systems USAHERDS | High 8.1 | 18% |
| Dec 19, 2024 | Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) | Critical 9.8 | 87% |
| Dec 18, 2024 | Missing Authentication Vulnerability | NUUO NVRmini2 Devices | Critical 9.8 | 48% |
| Dec 18, 2024 | OS Command Injection Vulnerability | Reolink RLC-410W IP Camera | Critical 9.1 | 48% |
| Dec 18, 2024 | OS Command Injection | Reolink Multiple IP Cameras | High 7.2 | 38% |
| Dec 18, 2024 | OS Command Injection Vulnerability | NUUO NVRmini Devices | Critical 9.8 | 95% |
| Dec 17, 2024 | Unauthenticated File Upload | Cleo Multiple Products | Critical 9.8 | 94% |
| Dec 16, 2024 | Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability | Microsoft Windows | High 7.8 | 25% |
| Dec 16, 2024 | Improper Access Control | Adobe ColdFusion | High 7.4 | 99% |
| Dec 13, 2024 | Unrestricted File Upload | Cleo Multiple Products | Critical 9.8 | 99% |
| Dec 10, 2024 | Common Log File System (CLFS) Driver Heap-Based Buffer Overflow | Microsoft Windows | High 7.8 | 26% |
| Dec 4, 2024 | Incorrect Default Permissions | CyberPersons CyberPanel | Critical 10.0 | 95% |
| Dec 3, 2024 | Improper Authentication | ProjectSend ProjectSend | Critical 9.8 | 92% |
| Dec 3, 2024 | Path Traversal | Zyxel Multiple Firewalls | High 7.5 | 2.9% |
| Dec 3, 2024 | Improper Restriction of XML External Entity (XXE) Reference | North Grid Proself | High 7.5 | 4.8% |
| Nov 25, 2024 | Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function | Array Networks AG/vxAG ArrayOS | Critical 9.8 | 68% |
| Nov 21, 2024 | Cross-Site Scripting (XSS) | Apple Multiple Products | Medium 6.3 | 22% |
| Nov 21, 2024 | Code Execution | Apple Multiple Products | High 8.8 | 9.9% |
| Nov 21, 2024 | Incorrect Authorization | Oracle Agile Product Lifecycle Management (PLM) | High 7.5 | 1.7% |
| Nov 20, 2024 | Privilege Escalation | VMware vCenter Server | High 7.5 | 17% |
| Nov 20, 2024 | Heap-Based Buffer Overflow | VMware vCenter Server | Critical 9.8 | 55% |
| Nov 18, 2024 | Management Interface OS Command Injection | Palo Alto Networks PAN-OS | Medium 6.9 | 94% |
| Nov 18, 2024 | OS Command Injection | Progress Kemp LoadMaster | Critical 10.0 | 95% |
| Nov 18, 2024 | Management Interface Authentication Bypass | Palo Alto Networks PAN-OS | Critical 9.3 | 99.8% |
| Nov 14, 2024 | SQL Injection | Palo Alto Networks Expedition | Critical 9.2 | 99.6% |
| Nov 14, 2024 | OS Command Injection | Palo Alto Networks Expedition | Critical 9.9 | 99% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.