Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 3, 2024 | Path Traversal | Kingsoft WPS Office | Critical 9.3 | 3.1% |
| Sep 3, 2024 | Path Traversal Vulnerability | DrayTek VigorConnect | High 7.5 | 96% |
| Sep 3, 2024 | Path Traversal Vulnerability | DrayTek VigorConnect | High 7.5 | 90% |
| Aug 28, 2024 | Inappropriate Implementation | Google Chromium V8 | High 8.8 | 19% |
| Aug 27, 2024 | Incorrect Authorization | Apache OFBiz | High 8.1 | 99.4% |
| Aug 26, 2024 | Type Confusion | Google Chromium V8 | High 8.8 | 21% |
| Aug 23, 2024 | Dangerous File Type Upload | Versa Director | Medium 6.6 | 4.0% |
| Aug 21, 2024 | Heap-Based Buffer Overflow | Linux Kernel | High 8.4 | 25% |
| Aug 21, 2024 | IP Camera Authentication Bypass | Dahua IP Camera Firmware | Critical 9.8 | 99.6% |
| Aug 21, 2024 | IP Camera Authentication Bypass | Dahua IP Camera Firmware | Critical 9.8 | >99.9% |
| Aug 21, 2024 | Information Disclosure | Microsoft Exchange Server | High 7.2 | 54% |
| Aug 19, 2024 | Command Line Interface (CLI) Path Traversal | Jenkins Jenkins Command Line Interface (CLI) | Critical 9.8 | >99.9% |
| Aug 15, 2024 | Deserialization of Untrusted Data | SolarWinds Web Help Desk | Critical 9.8 | 85% |
| Aug 13, 2024 | SmartScreen Security Feature Bypass | Microsoft Windows | Medium 6.5 | 14% |
| Aug 13, 2024 | Ancillary Function Driver for WinSock Privilege Escalation | Microsoft Windows | High 7.8 | 29% |
| Aug 13, 2024 | Remote Code Execution Vulnerability | Microsoft Project | High 8.8 | 8.2% |
| Aug 13, 2024 | Scripting Engine Memory Corruption | Microsoft Windows | High 7.5 | 41% |
| Aug 13, 2024 | Power Dependency Coordinator Privilege Escalation | Microsoft Windows | High 7.8 | 1.6% |
| Aug 13, 2024 | Kernel Privilege Escalation | Microsoft Windows | High 7.0 | 6.3% |
| Aug 7, 2024 | Remote Code Execution | Android Kernel | High 7.8 | 2.7% |
| Aug 7, 2024 | Path Traversal | Apache OFBiz | Critical 9.1 | 99.9% |
| Aug 5, 2024 | COM for Windows Deserialization of Untrusted Data | Microsoft Windows | High 7.5 | 73% |
| Jul 30, 2024 | Authentication Bypass | VMware ESXi | Medium 6.8 | 27% |
| Jul 29, 2024 | Incomplete List of Disallowed Inputs | ServiceNow Utah, Vancouver, and Washington DC Now Platform | Critical 9.2 | 99.6% |
| Jul 29, 2024 | Improper Input Validation | ServiceNow Utah, Vancouver, and Washington DC Now Platform | Critical 9.3 | >99.9% |
| Jul 29, 2024 | Insecure Default Password | Acronis Cyber Infrastructure (ACI) | Critical 9.8 | 53% |
| Jul 23, 2024 | Information Disclosure | Twilio Authy | Medium 5.3 | 1.7% |
| Jul 23, 2024 | Use-After-Free | Microsoft Internet Explorer | High 8.8 | 79% |
| Jul 17, 2024 | Improper Restriction of XML External Entity Reference (XXE) | Adobe Commerce and Magento Open Source | Critical 9.8 | >99.9% |
| Jul 17, 2024 | Path Traversal Vulnerability | SolarWinds Serv-U | High 8.6 | 99.6% |
| Jul 17, 2024 | Incorrect Default File Permissions Vulnerability | VMware vCenter Server | Medium 6.5 | 13% |
| Jul 15, 2024 | GeoTools Eval Injection | OSGeo GeoServer | Critical 9.8 | 99.8% |
| Jul 9, 2024 | MSHTML Platform Spoofing | Microsoft Windows | High 7.5 | 84% |
| Jul 9, 2024 | Windows Hyper-V Privilege Escalation | Microsoft Windows | High 7.8 | 7.1% |
| Jul 9, 2024 | Improper Neutralization of Special Elements Used in a Template Engine | Rejetto HTTP File Server | Critical 9.8 | 99.5% |
| Jul 2, 2024 | Command Injection | Cisco NX-OS | Medium 6.0 | 4.3% |
| Jun 26, 2024 | Use-After-Free | Linux Kernel | Medium 5.3 | 10% |
| Jun 26, 2024 | GeoServer JAI-EXT Code Injection | OSGeo JAI-EXT | Critical 10.0 | 99.9% |
| Jun 26, 2024 | Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.3 | 77% |
| Jun 13, 2024 | Authentication Bypass by Spoofing | Progress Telerik Report Server | Critical 9.8 | 97% |
| Jun 13, 2024 | Privilege Escalation | Android Pixel | High 8.1 | 3.0% |
| Jun 13, 2024 | Error Reporting Service Improper Privilege Management | Microsoft Windows | High 7.8 | 4.0% |
| Jun 12, 2024 | Use-After-Free | Arm Mali GPU Kernel Driver | High 7.4 | 0.8% |
| Jun 12, 2024 | PHP-CGI OS Command Injection | PHP Group PHP | Critical 9.8 | >99.9% |
| Jun 3, 2024 | OS Command Injection | Oracle WebLogic Server | High 7.4 | 96% |
| May 30, 2024 | Information Disclosure | Check Point Quantum Security Gateways | High 8.6 | >99.9% |
| May 30, 2024 | Use-After-Free | Linux Kernel | High 7.8 | 28% |
| May 29, 2024 | (JAVS) Viewer Installer Embedded Malicious Code | Justice AV Solutions Viewer | High 8.7 | 27% |
| May 28, 2024 | Type Confusion | Google Chromium V8 | High 8.3 | 7.7% |
| May 23, 2024 | Improper Access Control | Apache Flink | Critical 9.1 | 98% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.