Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 5, 2023 | Deserialization of Untrusted Data | Progress WS_FTP Server | Critical 10.0 | 90% |
| Oct 5, 2023 | Broken Access Control | Atlassian Confluence Data Center and Server | Critical 10.0 | 99.2% |
| Oct 4, 2023 | Authentication Bypass | JetBrains TeamCity | Critical 9.8 | >99.9% |
| Oct 4, 2023 | Privilege Escalation | Microsoft Windows CNG Key Isolation Service | High 7.0 | 1.7% |
| Oct 3, 2023 | Use-After-Free | Arm Mali GPU Kernel Driver | Medium 5.5 | 1.1% |
| Oct 2, 2023 | Heap Buffer Overflow | Google Chromium libvpx | High 8.8 | 49% |
| Sep 28, 2023 | Expression Language Injection | Red Hat JBoss RichFaces Framework | Critical 9.8 | 74% |
| Sep 25, 2023 | WebKit Code Execution | Apple Multiple Products | High 8.8 | 24% |
| Sep 25, 2023 | Kernel Privilege Escalation | Apple Multiple Products | High 7.8 | 9.5% |
| Sep 25, 2023 | Improper Certificate Validation | Apple Multiple Products | Medium 5.5 | 13% |
| Sep 21, 2023 | Remote Code Execution | Trend Micro Apex One and Worry-Free Business Security | High 7.2 | 4.2% |
| Sep 19, 2023 | Security Feature Bypass | MinIO MinIO | High 8.8 | 7.9% |
| Sep 18, 2023 | Use-After-Free | Samsung Mobile Devices | Medium 5.0 | 0.4% |
| Sep 18, 2023 | File Upload | Laravel Ignition | Critical 9.8 | 99.9% |
| Sep 18, 2023 | Command Injection | Zyxel EMG2926 Routers | High 8.8 | 33% |
| Sep 18, 2023 | Improper Input Validation | Realtek SDK | Critical 9.8 | >99.9% |
| Sep 14, 2023 | Out-of-Bounds Write | Adobe Acrobat and Reader | High 7.8 | 6.7% |
| Sep 13, 2023 | Heap-Based Buffer Overflow | Google Chromium WebP | High 8.8 | >99.9% |
| Sep 13, 2023 | Privilege Escalation | Android Framework | High 8.8 | 2.6% |
| Sep 13, 2023 | Unauthorized Access | Cisco Adaptive Security Appliance and Firepower Threat Defense | Medium 5.0 | 27% |
| Sep 12, 2023 | Privilege Escalation | Microsoft Streaming Service Proxy | High 7.8 | 28% |
| Sep 12, 2023 | Information Disclosure | Microsoft Word | Medium 6.5 | 20% |
| Sep 11, 2023 | ImageIO Buffer Overflow | Apple iOS, iPadOS, and macOS | High 7.8 | 53% |
| Sep 11, 2023 | Wallet Code Execution | Apple iOS, iPadOS, and watchOS | High 7.8 | 4.4% |
| Sep 6, 2023 | Command Execution | Apache RocketMQ | Critical 9.8 | 97% |
| Aug 24, 2023 | Code Execution | RARLAB WinRAR | High 7.8 | 99.8% |
| Aug 24, 2023 | Path Traversal | Ignite Realtime Openfire | High 8.6 | >99.9% |
| Aug 22, 2023 | Authentication Bypass | Ivanti Sentry | Critical 9.8 | >99.9% |
| Aug 22, 2023 | Cloud Connect Missing Authentication for Critical Function | Veeam Backup & Replication | High 7.5 | 81% |
| Aug 21, 2023 | Deserialization of Untrusted Data | Adobe ColdFusion | Critical 9.8 | 17% |
| Aug 16, 2023 | ShareFile Improper Access Control | Citrix Content Collaboration | Critical 9.8 | 97% |
| Aug 9, 2023 | Denial-of-Service | Microsoft .NET Core and Visual Studio | High 7.5 | 14% |
| Aug 7, 2023 | Command Injection | Zyxel P660HN-T1A Routers | Critical 9.8 | 95% |
| Jul 31, 2023 | Path Traversal | Ivanti Endpoint Manager Mobile (EPMM) | High 7.2 | 64% |
| Jul 27, 2023 | Cross-Site Scripting (XSS) | Synacor Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 49% |
| Jul 26, 2023 | Kernel Unspecified | Apple Multiple Products | Medium 5.5 | 2.9% |
| Jul 25, 2023 | Endpoint Manager Mobile Authentication Bypass | Ivanti Endpoint Manager Mobile (EPMM) | Critical 10.0 | >99.9% |
| Jul 20, 2023 | Improper Access Control | Adobe ColdFusion | High 7.5 | 99.8% |
| Jul 20, 2023 | Improper Access Control | Adobe ColdFusion | High 7.5 | 99.8% |
| Jul 19, 2023 | Code Injection | Citrix NetScaler ADC and NetScaler Gateway | Critical 9.8 | 99.7% |
| Jul 17, 2023 | Search Remote Code Execution | Microsoft Windows | High 7.5 | 99.4% |
| Jul 13, 2023 | WebKit Code Execution | Apple Multiple Products | High 8.8 | 19% |
| Jul 13, 2023 | Command Injection | SolarView Compact | Critical 9.8 | 98% |
| Jul 11, 2023 | Error Reporting Service Privilege Escalation | Microsoft Windows | High 7.8 | 43% |
| Jul 11, 2023 | Security Feature Bypass | Microsoft Outlook | High 8.8 | 16% |
| Jul 11, 2023 | Defender SmartScreen Security Feature Bypass | Microsoft Windows | High 8.8 | 4.2% |
| Jul 11, 2023 | MSHTML Platform Privilege Escalation | Microsoft Windows | High 7.8 | 10.0% |
| Jul 11, 2023 | Insecure Object Deserialization | Netwrix Auditor | Critical 9.8 | 36% |
| Jul 7, 2023 | Mali GPU Kernel Driver Use-After-Free | Arm Mali Graphics Processing Unit (GPU) | High 8.8 | 3.0% |
| Jun 29, 2023 | Improper Input Validation | Samsung Mobile Devices | Low 3.3 | 0.5% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.