Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 20, 2024 | Type Confusion | Google Chromium V8 | Critical 9.6 | 15% |
| May 20, 2024 | Deserialization of Untrusted Data | NextGen Healthcare Mirth Connect | Critical 9.8 | 85% |
| May 16, 2024 | Out-of-Bounds Memory Write | Google Chromium V8 | High 8.3 | 11% |
| May 16, 2024 | Information Disclosure | D-Link DIR-605 Router | High 7.5 | 87% |
| May 16, 2024 | Cross-Site Request Forgery (CSRF) | D-Link DIR-600 Router | High 8.0 | 43% |
| May 14, 2024 | Microsoft DWM Core Library Privilege Escalation | Microsoft DWM Core Library | High 7.8 | 5.7% |
| May 14, 2024 | MSHTML Platform Security Feature Bypass | Microsoft Windows | High 8.8 | 3.9% |
| May 13, 2024 | Visuals Use-After-Free | Google Chromium | Critical 9.6 | 8.3% |
| May 1, 2024 | Community and Enterprise Editions Improper Access Control | GitLab GitLab CE/EE | Critical 10.0 | 94% |
| Apr 30, 2024 | Security Feature Bypass | Microsoft SmartScreen Prompt | High 8.8 | 45% |
| Apr 24, 2024 | VFS Sandbox Escape | CrushFTP CrushFTP | Critical 9.8 | 99.5% |
| Apr 24, 2024 | ASA and FTD Privilege Escalation | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Medium 6.0 | 19% |
| Apr 24, 2024 | ASA and FTD Denial of Service | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | High 8.6 | 70% |
| Apr 23, 2024 | Print Spooler Privilege Escalation Vulnerability | Microsoft Windows | High 7.8 | 15% |
| Apr 12, 2024 | Command Injection | Palo Alto Networks PAN-OS | Critical 10.0 | >99.9% |
| Apr 11, 2024 | Command Injection | D-Link Multiple NAS Devices | High 7.3 | >99.9% |
| Apr 11, 2024 | Use of Hard-Coded Credentials | D-Link Multiple NAS Devices | Critical 9.8 | 98% |
| Apr 4, 2024 | Privilege Escalation | Android Pixel | High 7.8 | 0.7% |
| Apr 4, 2024 | Information Disclosure | Android Pixel | Medium 5.5 | 0.5% |
| Mar 26, 2024 | Code Injection | Microsoft SharePoint Server | High 7.2 | 85% |
| Mar 25, 2024 | SQL Injection | Fortinet FortiClient EMS | Critical 9.3 | 98% |
| Mar 25, 2024 | Code Injection Vulnerability | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) | Critical 9.8 | 99.1% |
| Mar 25, 2024 | OS Command Injection | Nice Linear eMerge E3-Series | Critical 9.8 | 97% |
| Mar 7, 2024 | Authentication Bypass | JetBrains TeamCity | Critical 9.8 | 99.9% |
| Mar 6, 2024 | Memory Corruption | Apple Multiple Products | High 7.8 | 1.4% |
| Mar 6, 2024 | Memory Corruption | Apple Multiple Products | High 7.8 | 1.5% |
| Mar 5, 2024 | Information Disclosure Vulnerability | Android Pixel | Medium 6.2 | 0.3% |
| Mar 5, 2024 | OS Command Injection Vulnerablity | Sunhillo SureLine | Critical 9.8 | 98% |
| Mar 4, 2024 | Kernel Exposed IOCTL with Insufficient Access Control | Microsoft Windows | High 7.8 | 60% |
| Feb 29, 2024 | Untrusted Pointer Dereference | Microsoft Streaming Service | High 8.4 | 22% |
| Feb 22, 2024 | Authentication Bypass | ConnectWise ScreenConnect | Critical 10.0 | >99.9% |
| Feb 15, 2024 | Privilege Escalation | Microsoft Exchange Server | Critical 9.8 | 13% |
| Feb 15, 2024 | ASA and FTD Information Disclosure | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | High 7.5 | 72% |
| Feb 13, 2024 | Internet Shortcut Files Security Feature Bypass | Microsoft Windows | High 8.1 | 99.4% |
| Feb 13, 2024 | SmartScreen Security Feature Bypass | Microsoft Windows | High 7.6 | 28% |
| Feb 12, 2024 | Persistent Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.1 | 64% |
| Feb 9, 2024 | Out-of-Bound Write | Fortinet FortiOS | Critical 9.6 | 85% |
| Feb 6, 2024 | Type Confusion | Google Chromium V8 | High 8.8 | 41% |
| Jan 31, 2024 | Server-Side Request Forgery (SSRF) | Ivanti Connect Secure, Policy Secure, and Neurons | High 8.2 | >99.9% |
| Jan 31, 2024 | Memory Corruption | Apple Multiple Products | High 7.0 | 0.5% |
| Jan 24, 2024 | Template Injection | Atlassian Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Jan 23, 2024 | WebKit Type Confusion | Apple Multiple Products | High 8.8 | 11% |
| Jan 22, 2024 | Out-of-Bounds Write | VMware vCenter Server | Critical 9.8 | 99.2% |
| Jan 18, 2024 | Authentication Bypass | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core | Critical 10.0 | >99.9% |
| Jan 17, 2024 | Out-of-Bounds Memory Access | Google Chromium V8 | High 8.8 | 3.8% |
| Jan 17, 2024 | Buffer Overflow | Citrix NetScaler ADC and NetScaler Gateway | High 8.2 | 58% |
| Jan 17, 2024 | Code Injection | Citrix NetScaler ADC and NetScaler Gateway | Medium 5.5 | 3.2% |
| Jan 16, 2024 | Deserialization of Untrusted Data | Laravel Laravel Framework | High 8.1 | 77% |
| Jan 10, 2024 | Command Injection | Ivanti Connect Secure and Policy Secure | Critical 9.1 | >99.9% |
| Jan 10, 2024 | Authentication Bypass | Ivanti Connect Secure and Policy Secure | High 8.2 | >99.9% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.