Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 12, 2024 | Task Scheduler Privilege Escalation | Microsoft Windows | High 8.8 | 14% |
| Nov 12, 2024 | NTLMv2 Hash Disclosure Spoofing | Microsoft Windows | Medium 6.5 | 84% |
| Nov 12, 2024 | GeoJSON API Local File Inclusion | Metabase Metabase | Critical 10.0 | 97% |
| Nov 12, 2024 | Path Traversal | Atlassian Jira Server and Data Center | Medium 5.3 | >99.9% |
| Nov 12, 2024 | Cross-Site Scripting (XSS) | Cisco Adaptive Security Appliance (ASA) | Medium 5.4 | 23% |
| Nov 7, 2024 | Missing Authentication | Palo Alto Networks Expedition | Critical 9.3 | 92% |
| Nov 7, 2024 | Incorrect Default Permissions | CyberPersons CyberPanel | Critical 10.0 | 84% |
| Nov 7, 2024 | Privilege Escalation | Android Framework | High 7.3 | 0.7% |
| Nov 7, 2024 | Directory Traversal | Nostromo nhttpd | Critical 9.8 | 99.0% |
| Nov 4, 2024 | OS Command Injection | PTZOptics PT30X-SDI/NDI Cameras | High 7.2 | 80% |
| Nov 4, 2024 | Authentication Bypass | PTZOptics PT30X-SDI/NDI Cameras | Critical 9.1 | 59% |
| Oct 24, 2024 | Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.1 | 74% |
| Oct 24, 2024 | ASA and FTD Denial-of-Service | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Medium 5.8 | 16% |
| Oct 23, 2024 | Missing Authentication | Fortinet FortiManager | Critical 9.8 | 95% |
| Oct 22, 2024 | Deserialization | Microsoft SharePoint | High 7.2 | 51% |
| Oct 21, 2024 | Unspecified | ScienceLogic SL1 | Critical 9.3 | 3.8% |
| Oct 17, 2024 | Backup and Replication Deserialization | Veeam Backup & Replication | Critical 9.8 | 90% |
| Oct 15, 2024 | Use-After-Free | Mozilla Firefox | Critical 9.8 | 23% |
| Oct 15, 2024 | Windows Kernel TOCTOU Race Condition | Microsoft Windows | High 7.0 | 68% |
| Oct 15, 2024 | Hardcoded Credential | SolarWinds Web Help Desk | Critical 9.1 | 93% |
| Oct 9, 2024 | OS Command Injection | Ivanti Cloud Services Appliance (CSA) | High 7.2 | 58% |
| Oct 9, 2024 | SQL Injection | Ivanti Cloud Services Appliance (CSA) | Medium 6.5 | 44% |
| Oct 9, 2024 | Format String | Fortinet Multiple Products | Critical 9.8 | 62% |
| Oct 8, 2024 | MSHTML Platform Spoofing | Microsoft Windows | Medium 6.5 | 46% |
| Oct 8, 2024 | Management Console Remote Code Execution | Microsoft Windows | High 7.8 | 67% |
| Oct 8, 2024 | Multiple Chipsets Use-After-Free | Qualcomm Multiple Chipsets | High 7.8 | 0.7% |
| Oct 3, 2024 | Command Execution | Synacor Zimbra Collaboration Suite (ZCS) | Critical 10.0 | 99.9% |
| Oct 2, 2024 | SQL Injection | Ivanti Endpoint Manager (EPM) | Critical 9.6 | 99.9% |
| Sep 30, 2024 | OS Command Injection | D-Link DIR-820 Router | Critical 9.8 | 98% |
| Sep 30, 2024 | OS Command Injection | DrayTek Multiple Vigor Routers | Critical 9.8 | 84% |
| Sep 30, 2024 | Deserialization of Untrusted Data | SAP Commerce Cloud | Critical 9.8 | 7.5% |
| Sep 24, 2024 | Authentication Bypass | Ivanti Virtual Traffic Manager | Critical 9.8 | >99.9% |
| Sep 19, 2024 | Path Traversal | Ivanti Cloud Services Appliance (CSA) | Critical 9.4 | 99% |
| Sep 18, 2024 | Improper Access Control | Apache HugeGraph-Server | Critical 9.8 | 99.2% |
| Sep 18, 2024 | Deserialization of Untrusted Data | Oracle ADF Faces | Critical 9.8 | 62% |
| Sep 18, 2024 | Remote Code Execution | Oracle WebLogic Server | Critical 9.8 | 95% |
| Sep 18, 2024 | Reporting Services Remote Code Execution | Microsoft SQL Server | Critical 9.8 | 99.0% |
| Sep 17, 2024 | Double Free Vulnerablity | Adobe Flash Player | High 8.8 | 25% |
| Sep 17, 2024 | Integer Underflow Vulnerablity | Adobe Flash Player | High 8.8 | 99.9% |
| Sep 17, 2024 | Code Execution | Adobe Flash Player | High 8.8 | 11% |
| Sep 17, 2024 | Incorrect Default Permissions | Adobe Flash Player | High 8.8 | 11% |
| Sep 16, 2024 | SQL Injection | Progress WhatsUp Gold | Critical 9.8 | 93% |
| Sep 16, 2024 | MSHTML Platform Spoofing | Microsoft Windows | High 8.8 | 54% |
| Sep 13, 2024 | OS Command Injection | Ivanti Cloud Services Appliance | High 7.2 | 89% |
| Sep 10, 2024 | Protection Mechanism Failure | Microsoft Publisher | High 7.3 | 2.7% |
| Sep 10, 2024 | Mark of the Web (MOTW) Protection Mechanism Failure | Microsoft Windows | Medium 5.4 | 10% |
| Sep 10, 2024 | Installer Improper Privilege Management | Microsoft Windows | High 7.8 | 6.3% |
| Sep 9, 2024 | Improper Access Control | SonicWall SonicOS | Critical 9.3 | 18% |
| Sep 9, 2024 | PIE Stack Buffer Corruption Vulnerability | Linux Kernel | High 7.8 | 11% |
| Sep 9, 2024 | Improper Input Validation | ImageMagick ImageMagick | High 8.4 | 97% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.