Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 13, 2022 | Heap-Based Buffer Overflow | Fortinet FortiOS | Critical 9.3 | 99.5% |
| Dec 13, 2022 | Authentication Bypass | Citrix Application Delivery Controller (ADC) and Gateway | Critical 9.8 | 6.9% |
| Dec 13, 2022 | Remote Code Execution | Veeam Backup & Replication | Critical 9.8 | 4.1% |
| Dec 13, 2022 | Remote Code Execution | Veeam Backup & Replication | High 8.8 | 5.8% |
| Dec 5, 2022 | Type Confusion | Google Chromium V8 | High 8.8 | 24% |
| Nov 28, 2022 | Heap Buffer Overflow | Google Chromium GPU | Critical 9.6 | 32% |
| Nov 28, 2022 | Unspecified | Oracle Fusion Middleware | Critical 9.8 | 96% |
| Nov 14, 2022 | Mark of the Web (MOTW) Security Feature Bypass | Microsoft Windows | Medium 5.4 | 2.6% |
| Nov 8, 2022 | Scripting Languages Remote Code Execution | Microsoft Windows | High 8.8 | 25% |
| Nov 8, 2022 | CNG Key Isolation Service Privilege Escalation | Microsoft Windows | High 7.8 | 3.0% |
| Nov 8, 2022 | Mark of the Web (MOTW) Security Feature Bypass | Microsoft Windows | Medium 5.4 | 1.9% |
| Nov 8, 2022 | Print Spooler Privilege Escalation | Microsoft Windows | High 7.8 | 2.4% |
| Nov 8, 2022 | Memory Corruption | Samsung Mobile Devices | Medium 6.1 | 0.9% |
| Nov 8, 2022 | Improper Access Control | Samsung Mobile Devices | Medium 6.2 | 1.1% |
| Nov 8, 2022 | Improper Access Control | Samsung Mobile Devices | Medium 4.4 | 2.8% |
| Oct 28, 2022 | Type Confusion | Google Chromium V8 | High 8.8 | 7.9% |
| Oct 25, 2022 | Out-of-Bounds Write | Apple iOS and iPadOS | High 7.8 | 1.1% |
| Oct 24, 2022 | Mobility Client for Windows DLL Hijacking | Cisco AnyConnect Secure | High 7.8 | 10% |
| Oct 24, 2022 | Mobility Client for Windows Uncontrolled Search Path | Cisco AnyConnect Secure | Medium 6.5 | 28% |
| Oct 24, 2022 | Privilege Escalation | GIGABYTE Multiple Products | Critical 9.8 | 8.4% |
| Oct 24, 2022 | Code Execution | GIGABYTE Multiple Products | High 7.8 | 1.8% |
| Oct 24, 2022 | Privilege Escalation | GIGABYTE Multiple Products | High 7.8 | 3.7% |
| Oct 24, 2022 | Unspecified | GIGABYTE Multiple Products | High 7.8 | 4.6% |
| Oct 20, 2022 | Arbitrary File Upload | Synacor Zimbra Collaboration Suite (ZCS) | Critical 9.8 | 95% |
| Oct 20, 2022 | Privilege Escalation | Linux Kernel | High 8.8 | 49% |
| Oct 11, 2022 | Privilege Escalation | Microsoft Windows COM+ Event System Service | High 7.8 | 1.9% |
| Oct 11, 2022 | Authentication Bypass | Fortinet Multiple Products | Critical 9.8 | >99.9% |
| Sep 30, 2022 | Remote Code Execution | Microsoft Exchange Server | High 8.0 | >99.9% |
| Sep 30, 2022 | Server-Side Request Forgery | Microsoft Exchange Server | High 8.8 | >99.9% |
| Sep 30, 2022 | Command Injection | Atlassian Bitbucket Server and Data Center | High 8.8 | 99.2% |
| Sep 23, 2022 | Code Injection | Sophos Firewall | Critical 9.8 | 99% |
| Sep 22, 2022 | Multiple Products Remote Code Execution | Zoho ManageEngine | Critical 9.8 | 99.9% |
| Sep 15, 2022 | Improper Validation | Trend Micro Apex One and Apex One as a Service | High 7.2 | 3.4% |
| Sep 15, 2022 | Improper Input Validation | Linux Kernel | High 8.8 | 40% |
| Sep 15, 2022 | Stack-based Buffer Overflow | Code Aurora ACDB Audio Driver | High 8.4 | 1.5% |
| Sep 15, 2022 | Integer Overflow | Linux Kernel | High 7.8 | 3.2% |
| Sep 15, 2022 | Privilege Escalation | Linux Kernel | High 8.4 | 48% |
| Sep 15, 2022 | Remote Code Execution | Microsoft Windows | High 7.8 | 90% |
| Sep 14, 2022 | Common Log File System (CLFS) Driver Privilege Escalation | Microsoft Windows | High 7.8 | 28% |
| Sep 14, 2022 | Remote Code Execution | Apple iOS, iPadOS, and macOS | High 7.8 | 5.6% |
| Sep 8, 2022 | Insufficient Data Validation | Google Chromium Mojo | Critical 9.6 | 5.8% |
| Sep 8, 2022 | Externally Controlled Reference | QNAP Photo Station | Critical 10.0 | 88% |
| Sep 8, 2022 | Remote Code Execution | D-Link DIR-820L | Critical 9.8 | 92% |
| Sep 8, 2022 | Input Validation | Apple iOS, iPadOS, and macOS | Medium 5.5 | 3.2% |
| Sep 8, 2022 | Stack-Based Buffer Overflow | MikroTik RouterOS | Critical 9.8 | 66% |
| Sep 8, 2022 | OS Command Injection | D-Link Multiple Routers | Critical 9.8 | 97% |
| Sep 8, 2022 | Unspecified | Oracle WebLogic Server | Critical 9.8 | >99.9% |
| Sep 8, 2022 | Improper Access Control | Fortinet FortiOS and FortiADC | Medium 4.3 | 38% |
| Sep 8, 2022 | Exposure of Sensitive Information | NETGEAR Multiple Devices | High 8.1 | 89% |
| Sep 8, 2022 | Cleartext Storage of a Password | D-Link DIR-300 Router | Medium 5.7 | 3.1% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.