Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 11, 2023 | Common Log File System (CLFS) Driver Privilege Escalation | Microsoft Windows | High 7.8 | 49% |
| Apr 10, 2023 | IOSurfaceAccelerator Out-of-Bounds Write | Apple iOS, iPadOS, and macOS | High 8.6 | 23% |
| Apr 10, 2023 | WebKit Use-After-Free | Apple Multiple Products | High 8.8 | 27% |
| Apr 7, 2023 | Mali GPU Kernel Driver Information Disclosure | Arm Mali Graphics Processing Unit (GPU) | Low 3.3 | 1.2% |
| Apr 7, 2023 | Command Execution | Veritas Backup Exec Agent | High 8.8 | 24% |
| Apr 7, 2023 | Improper Authentication | Veritas Backup Exec Agent | High 8.2 | 65% |
| Apr 7, 2023 | File Access | Veritas Backup Exec Agent | High 8.1 | 14% |
| Apr 7, 2023 | Certificate Dialog Privilege Escalation | Microsoft Windows | High 7.8 | 8.6% |
| Apr 3, 2023 | Cross-Site Scripting (XSS) | Synacor Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 18% |
| Mar 30, 2023 | Use-After-Free | Linux Kernel | High 7.9 | 3.7% |
| Mar 30, 2023 | User Interface Remote Code Execution | Fortra Cobalt Strike | Critical 9.8 | 2.7% |
| Mar 30, 2023 | Teamserver Cross-Site Scripting (XSS) | Fortra Cobalt Strike | Medium 6.1 | 47% |
| Mar 30, 2023 | Mali GPU Kernel Driver Use-After-Free | Arm Mali Graphics Processing Unit (GPU) | High 8.8 | 18% |
| Mar 30, 2023 | Use-After-Free | Google Chromium Network Service | High 8.8 | 25% |
| Mar 30, 2023 | Mali GPU Kernel Driver Unspecified | Arm Mali Graphics Processing Unit (GPU) | High 7.8 | 1.1% |
| Mar 30, 2023 | Out-of-Bounds Write | Apple iOS, iPadOS, and macOS | High 7.8 | 5.2% |
| Mar 30, 2023 | Remote Code Execution | Samba Samba | Critical 9.8 | 99.4% |
| Mar 30, 2023 | Memory Corruption | Microsoft Internet Explorer | High 8.8 | 71% |
| Mar 15, 2023 | Deserialization of Untrusted Data | Adobe ColdFusion | High 8.6 | 97% |
| Mar 14, 2023 | SmartScreen Security Feature Bypass | Microsoft Windows | Medium 4.4 | 78% |
| Mar 14, 2023 | Outlook Privilege Escalation | Microsoft Office | Critical 9.8 | 97% |
| Mar 14, 2023 | Path Traversal | Fortinet FortiOS | Medium 6.5 | 11% |
| Mar 10, 2023 | Remote Code Execution | XStream XStream | High 8.5 | 98% |
| Mar 10, 2023 | Remote Code Execution | Plex Media Server | High 7.2 | 73% |
| Mar 7, 2023 | Remote Code Execution | Teclib GLPI | Critical 9.8 | 99.9% |
| Mar 7, 2023 | Command Injection | Apache Spark | High 8.8 | 93% |
| Mar 7, 2023 | ADSelfService Plus Remote Code Execution | Zoho ManageEngine | Medium 6.8 | 71% |
| Feb 27, 2023 | Unspecified | ZK Framework AuUploader | High 7.5 | 95% |
| Feb 21, 2023 | Code Execution | IBM Aspera Faspex | Critical 9.8 | >99.9% |
| Feb 21, 2023 | Code Injection | Mitel MiVoice Connect | Medium 6.8 | 11% |
| Feb 21, 2023 | Command Injection | Mitel MiVoice Connect | Medium 6.8 | 11% |
| Feb 16, 2023 | Command Injection | Cacti Cacti | Critical 9.8 | 99.8% |
| Feb 14, 2023 | WebKit Type Confusion | Apple Multiple Products | High 8.8 | 9.4% |
| Feb 14, 2023 | Common Log File System (CLFS) Driver Privilege Escalation | Microsoft Windows | High 7.8 | 11% |
| Feb 14, 2023 | Graphic Component Privilege Escalation | Microsoft Windows | High 7.8 | 5.6% |
| Feb 14, 2023 | Publisher Security Feature Bypass | Microsoft Office | High 7.3 | 12% |
| Feb 10, 2023 | Remote Code Execution | Fortra GoAnywhere MFT | High 7.2 | >99.9% |
| Feb 10, 2023 | OS Remote Command Execution | TerraMaster TerraMaster OS | Critical 9.8 | 83% |
| Feb 10, 2023 | Denial-of-Service | Intel Ethernet Diagnostics Driver for Windows | High 7.8 | 16% |
| Feb 2, 2023 | Multiple SugarCRM Products Remote Code Execution | SugarCRM Multiple Products | High 8.8 | 80% |
| Feb 2, 2023 | Unspecified | Oracle E-Business Suite | Critical 9.8 | 98% |
| Jan 26, 2023 | UI for ASP.NET AJAX Insecure Direct Object Reference | Telerik User Interface (UI) for ASP.NET AJAX | Critical 9.8 | 78% |
| Jan 23, 2023 | Multiple Products Remote Code Execution | Zoho ManageEngine | Critical 9.8 | 99.8% |
| Jan 17, 2023 | OS Command Injection | CWP Control Web Panel | Critical 9.8 | >99.9% |
| Jan 10, 2023 | Advanced Local Procedure Call (ALPC) Privilege Escalation | Microsoft Windows | High 8.8 | 34% |
| Jan 10, 2023 | Privilege Escalation | Microsoft Exchange Server | High 8.8 | 77% |
| Dec 29, 2022 | Server Information Disclosure | TIBCO JasperReports | High 7.7 | 48% |
| Dec 29, 2022 | Library Directory Traversal | TIBCO JasperReports | Critical 9.9 | 79% |
| Dec 14, 2022 | Type Confusion | Apple iOS | High 8.8 | 8.5% |
| Dec 13, 2022 | SmartScreen Security Feature Bypass | Microsoft Defender | Medium 5.4 | 76% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.