Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jan 10, 2024 | Privilege Escalation | Microsoft SharePoint Server | Critical 9.8 | >99.9% |
| Jan 8, 2024 | Code Execution | Apple Multiple Products | High 7.8 | 1.4% |
| Jan 8, 2024 | Deserialization of Untrusted Data | Adobe ColdFusion | Critical 9.8 | 97% |
| Jan 8, 2024 | Deserialization of Untrusted Data | Adobe ColdFusion | Critical 9.8 | >99.9% |
| Jan 8, 2024 | Insecure Default Initialization of Resource | Apache Superset | High 8.9 | 98% |
| Jan 8, 2024 | Improper Access Control | Joomla! Joomla! | Medium 5.3 | 99.8% |
| Jan 8, 2024 | Command Injection | D-Link DSL-2750B Devices | Critical 9.8 | 66% |
| Jan 2, 2024 | Remote Code Execution | Spreadsheet::ParseExcel Spreadsheet::ParseExcel | High 7.8 | 19% |
| Jan 2, 2024 | Heap Buffer Overflow | Google Chromium WebRTC | High 8.8 | 6.7% |
| Dec 21, 2023 | OS Command Injection | FXC AE1021, AE1021PE | High 8.8 | 50% |
| Dec 21, 2023 | OS Command Injection | QNAP VioStor NVR | High 8.0 | 73% |
| Dec 11, 2023 | Insecure Default Password | Unitronics Vision PLC and HMI | Critical 9.8 | 2.1% |
| Dec 7, 2023 | Path Traversal | Qlik Sense | High 8.2 | 85% |
| Dec 7, 2023 | HTTP Tunneling | Qlik Sense | Critical 9.6 | 88% |
| Dec 5, 2023 | Integer Overflow | Qualcomm Multiple Chipsets | High 8.4 | 0.7% |
| Dec 5, 2023 | Use of Out-of-Range Pointer Offset | Qualcomm Multiple Chipsets | High 8.4 | 0.8% |
| Dec 5, 2023 | Use-After-Free | Qualcomm Multiple Chipsets | High 7.8 | 0.7% |
| Dec 5, 2023 | Use-After-Free | Qualcomm Multiple Chipsets | High 8.4 | 0.4% |
| Dec 4, 2023 | WebKit Memory Corruption | Apple Multiple Products | High 8.8 | 9.3% |
| Dec 4, 2023 | WebKit Out-of-Bounds Read | Apple Multiple Products | Medium 6.5 | 18% |
| Nov 30, 2023 | Skia Integer Overflow | Google Chromium Skia | Critical 9.6 | 16% |
| Nov 30, 2023 | graphapi Information Disclosure | ownCloud ownCloud graphapi | Critical 10.0 | 78% |
| Nov 21, 2023 | C Library Buffer Overflow | GNU GNU C Library | High 7.8 | 64% |
| Nov 16, 2023 | Mark of the Web (MOTW) Security Feature Bypass | Microsoft Windows | Medium 5.4 | 3.3% |
| Nov 16, 2023 | Command Injection | Sophos Web Appliance | Critical 9.8 | >99.9% |
| Nov 16, 2023 | Unspecified | Oracle Fusion Middleware | Critical 9.8 | 93% |
| Nov 14, 2023 | Cloud Files Mini Filter Driver Privilege Escalation | Microsoft Windows | High 7.8 | 17% |
| Nov 14, 2023 | Desktop Window Manager (DWM) Core Library Privilege Escalation | Microsoft Windows | High 7.8 | 11% |
| Nov 14, 2023 | SmartScreen Security Feature Bypass | Microsoft Windows | High 8.8 | 88% |
| Nov 13, 2023 | Server Path Traversal | SysAid SysAid Server | Critical 9.8 | 99% |
| Nov 13, 2023 | SRX Series Missing Authentication for Critical Function | Juniper Junos OS | Medium 5.3 | 1.1% |
| Nov 13, 2023 | EX Series Missing Authentication for Critical Function | Juniper Junos OS | Medium 5.3 | 83% |
| Nov 13, 2023 | SRX Series Missing Authentication for Critical Function | Juniper Junos OS | Medium 5.3 | 93% |
| Nov 13, 2023 | EX Series and SRX Series PHP External Variable Modification | Juniper Junos OS | Critical 9.8 | 95% |
| Nov 13, 2023 | EX Series PHP External Variable Modification | Juniper Junos OS | Medium 5.3 | 90% |
| Nov 8, 2023 | Denial-of-Service | IETF Service Location Protocol (SLP) | High 7.5 | 64% |
| Nov 7, 2023 | Improper Authorization | Atlassian Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Nov 2, 2023 | Deserialization of Untrusted Data | Apache ActiveMQ | Critical 10.0 | >99.9% |
| Oct 31, 2023 | SQL Injection | F5 BIG-IP Configuration Utility | High 8.8 | 4.2% |
| Oct 31, 2023 | Authentication Bypass | F5 BIG-IP Configuration Utility | Critical 9.8 | 97% |
| Oct 26, 2023 | Persistent Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.1 | 76% |
| Oct 23, 2023 | IOS XE Web UI Command Injection | Cisco Cisco IOS XE Web UI | High 7.2 | 93% |
| Oct 18, 2023 | Buffer Overflow | Citrix NetScaler ADC and NetScaler Gateway | Critical 9.4 | >99.9% |
| Oct 16, 2023 | Privilege Escalation | Cisco IOS XE Web UI | Critical 10.0 | 99.6% |
| Oct 10, 2023 | Rapid Reset Attack | IETF HTTP/2 | High 7.5 | >99.9% |
| Oct 10, 2023 | Privilege Escalation | Microsoft Skype for Business | Medium 5.3 | 91% |
| Oct 10, 2023 | Information Disclosure | Microsoft WordPad | Medium 6.5 | 20% |
| Oct 10, 2023 | Use-After-Free | Adobe Acrobat and Reader | High 7.8 | 59% |
| Oct 10, 2023 | Group Encrypted Transport VPN Out-of-Bounds Write | Cisco IOS and IOS XE | Medium 6.6 | 2.5% |
| Oct 5, 2023 | Kernel Privilege Escalation | Apple iOS and iPadOS | High 7.8 | 1.0% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.