Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 29, 2023 | Out-of-Bounds Read | Samsung Mobile Devices | High 7.3 | 0.6% |
| Jun 29, 2023 | Race Condition | Samsung Mobile Devices | Medium 6.4 | 0.4% |
| Jun 29, 2023 | Race Condition | Samsung Mobile Devices | Medium 6.4 | 0.4% |
| Jun 29, 2023 | Improper Boundary Check | Samsung Mobile Devices | Medium 6.1 | 0.8% |
| Jun 29, 2023 | Unspecified | Samsung Mobile Devices | Medium 6.1 | 0.8% |
| Jun 29, 2023 | Command Injection | D-Link DWL-2600AP Access Point | High 7.8 | 97% |
| Jun 29, 2023 | Command Execution | D-Link DIR-859 Router | Critical 9.8 | 91% |
| Jun 23, 2023 | WebKit Type Confusion | Apple Multiple Products | High 8.8 | 24% |
| Jun 23, 2023 | WebKit Memory Corruption | Apple Multiple Products | High 8.8 | 23% |
| Jun 23, 2023 | Integer Overflow | Apple Multiple Products | High 7.8 | 52% |
| Jun 23, 2023 | Multiple NAS Devices Command Injection | Zyxel Multiple Network-Attached Storage (NAS) Devices | Critical 9.8 | 82% |
| Jun 23, 2023 | Authentication Bypass | VMware Tools | Low 3.9 | 14% |
| Jun 22, 2023 | Command Injection | VMware Aria Operations for Networks | Critical 9.8 | 98% |
| Jun 22, 2023 | Webmail SQL Injection | Roundcube Roundcube Webmail | Critical 9.8 | 70% |
| Jun 22, 2023 | Webmail Cross-Site Scripting (XSS) | Roundcube Roundcube Webmail | Medium 6.1 | 33% |
| Jun 22, 2023 | Webmail Remote Code Execution | Roundcube Roundcube Webmail | Critical 9.8 | 84% |
| Jun 22, 2023 | Use-After-Free | Mozilla Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
| Jun 22, 2023 | Privilege Escalation | Microsoft Win32k | High 7.8 | 14% |
| Jun 13, 2023 | Heap-Based Buffer Overflow | Fortinet FortiOS and FortiProxy SSL-VPN | Critical 9.2 | 86% |
| Jun 7, 2023 | Type Confusion | Google Chromium V8 | High 8.8 | 38% |
| Jun 5, 2023 | Buffer Overflow | Zyxel Multiple Firewalls | Critical 9.8 | 29% |
| Jun 5, 2023 | Buffer Overflow | Zyxel Multiple Firewalls | Critical 9.8 | 28% |
| Jun 2, 2023 | SQL Injection | Progress MOVEit Transfer | Critical 9.8 | 99.9% |
| May 31, 2023 | OS Command Injection | Zyxel Multiple Firewalls | Critical 9.8 | 99.3% |
| May 26, 2023 | ESG Appliance Improper Input Validation | Barracuda Networks Email Security Gateway (ESG) Appliance | Critical 9.4 | 87% |
| May 22, 2023 | WebKit Sandbox Escape | Apple Multiple Products | High 8.6 | 17% |
| May 22, 2023 | WebKit Use-After-Free | Apple Multiple Products | High 8.8 | 12% |
| May 22, 2023 | WebKit Out-of-Bounds Read | Apple Multiple Products | Medium 6.5 | 14% |
| May 19, 2023 | Insertion of Sensitive Information Into Log File | Samsung Mobile Devices | Medium 4.4 | 2.6% |
| May 19, 2023 | IKEv1 Information Disclosure | Cisco IOS, IOS XR, and IOS XE | High 7.5 | 88% |
| May 19, 2023 | Denial-of-Service | Cisco IOS | Medium 5.9 | 4.8% |
| May 12, 2023 | Multiple Ruckus Wireless Products CSRF and RCE | Ruckus Wireless Multiple Products | Critical 9.8 | 98% |
| May 12, 2023 | Incorrect Authorization | Red Hat Polkit | High 7.8 | 24% |
| May 12, 2023 | Remote Code Execution | Apache Tomcat | Critical 9.8 | 90% |
| May 12, 2023 | Unspecified | Oracle Java SE and JRockit | Critical 9.8 | 92% |
| May 12, 2023 | User Interface (UI) Information Disclosure | Jenkins Jenkins User Interface (UI) | High 7.5 | 23% |
| May 12, 2023 | Race Condition | Linux Kernel | Medium 5.5 | 20% |
| May 12, 2023 | Improper Input Validation | Linux Kernel | High 7.8 | 16% |
| May 9, 2023 | Privilege Escalation | Microsoft Win32k | High 7.8 | 41% |
| May 1, 2023 | Unspecified | Oracle WebLogic Server | High 7.5 | 99.9% |
| May 1, 2023 | Archer AX-21 Command Injection | TP-Link Archer AX21 | High 8.8 | >99.9% |
| May 1, 2023 | Deserialization of Untrusted Data | Apache Log4j2 | Critical 9.0 | >99.9% |
| Apr 21, 2023 | Information Disclosure | MinIO MinIO | High 7.5 | 84% |
| Apr 21, 2023 | Improper Access Control | PaperCut MF/NG | Critical 9.8 | >99.9% |
| Apr 21, 2023 | Chrome Skia Integer Overflow | Google Chromium Skia | Critical 9.6 | 5.7% |
| Apr 19, 2023 | SNMP Remote Code Execution | Cisco IOS and IOS XE Software | High 8.8 | 21% |
| Apr 17, 2023 | Type Confusion | Google Chromium V8 | High 8.8 | 41% |
| Apr 17, 2023 | Use-After-Free | Apple macOS | High 7.8 | 0.7% |
| Apr 13, 2023 | Insecure Deserialization | Novi Survey Novi Survey | Critical 9.8 | 2.7% |
| Apr 13, 2023 | Privilege Escalation | Android Framework | High 7.8 | 1.5% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.