Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,758exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,758 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 11, 2026 | Improper Privilege Management and Missing Authorization | ConnectWise ScreenConnect | Critical 9.9 | 0.9% |
| Sep 11, 2026 | Improper Authentication | JFrog Artifactory | High 7.5 | 9.8% |
| Sep 11, 2026 | Incorrect Authorization | JFrog Artifactory | High 8.1 | 8.6% |
| Sep 10, 2026 | Improper Neutralization of Argument Delimiters in a Command | MikroTik RouterOS | Critical 9.2 | 6.4% |
| Sep 10, 2026 | Missing Authentication for Critical Function | MikroTik RouterOS | High 8.8 | 1.6% |
| Sep 9, 2026 | Out of Bounds Write | Google Chromium V8 | High 8.8 | 3.5% |
| Sep 9, 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Critical 10.0 | 88% |
| Sep 9, 2026 | Authentication Bypass Using an Alternate Path or Channel | Citrix NetScaler | Critical 9.3 | 33% |
| Sep 9, 2026 | Heap-based Buffer Overflow | Fortinet Multiple Products | High 7.4 | 3.7% |
| Sep 8, 2026 | Static Code Injection | N-able N-central | Critical 10.0 | 15% |
| Sep 8, 2026 | Heap-Based Buffer Overflow | Microsoft Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Link Following | Microsoft Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Adobe Commerce and Magento | Critical 10.0 | 3.9% |
| Sep 4, 2026 | Type Confusion | Google Chromium V8 | High 8.8 | 1.8% |
| Sep 2, 2026 | SQL Injection | Sangoma Switchvox | Critical 9.3 | 19% |
| Sep 2, 2026 | OS Command Injection | SonicWall SMA1000 Appliances | High 7.8 | 9.9% |
| Sep 2, 2026 | Server-Side Request Forgery | SonicWall SMA1000 Appliances | Critical 10.0 | 8.0% |
| Sep 2, 2026 | Improper Authentication | JFrog Artifactory | Critical 9.8 | 14% |
| Sep 2, 2026 | Improper Authentication | BerriAI LiteLLM | High 8.8 | 0.8% |
| Sep 2, 2026 | OSS OS Command Injection | Kestra Kestra OSS | Critical 10.0 | 2.1% |
| Sep 2, 2026 | HTTP Request/Response Smuggling | Kludex Starlette | Medium 6.5 | 70% |
| Aug 31, 2026 | Unsafe Reflection | PaperCut NG/MF | Critical 9.4 | 61% |
| Aug 31, 2026 | Missing Authentication for Critical Function | PaperCut NG/MF | High 8.8 | 84% |
| Aug 27, 2026 | Improper Limitation of a Pathname to a Restricted Directory | JFrog Artifactory | Medium 5.3 | 0.7% |
| Aug 27, 2026 | Unspecified | Linux Kernel | High 7.8 | 0.7% |
| Aug 27, 2026 | Improper Authentication | ownCloud ownCloud | Critical 9.8 | 43% |
| Aug 26, 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler ADC and NetScaler Gateway | High 8.8 | 1.0% |
| Aug 26, 2026 | Out-of-Bounds Write | Linux Kernel | High 7.8 | 8.9% |
| Aug 26, 2026 | Deserialization of Untrusted Data | Ajax.NET Professional Ajax.NET Professional | High 8.1 | 83% |
| Aug 26, 2026 | Remote Code Execution | Microsoft SQL Server | High 8.8 | 57% |
| Aug 26, 2026 | Privilege Escalation | Red Hat Automatic Bug Reporting Tool | High 7.8 | 5.0% |
| Aug 26, 2026 | Race Condition | Red Hat Libuser | High 7.4 | 8.5% |
| Aug 25, 2026 | Code Injection | Gitea Gitea | Critical 9.8 | 24% |
| Aug 24, 2026 | Improper Access Control | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | Critical 10.0 | 73% |
| Aug 21, 2026 | OS Command Injection | Synacor Zimbra Collaboration Suite (ZCS) | High 8.9 | 72% |
| Aug 20, 2026 | Code Injection | TrueConf Server | Critical 9.5 | 1.7% |
| Aug 20, 2026 | Missing Authentication for Critical Function | TrueConf Server | Critical 9.3 | 1.5% |
| Aug 19, 2026 | Server-Side Request Forgery | MLflow MLflow | Critical 9.3 | 10% |
| Aug 18, 2026 | Improper Authentication | Apple macOS | Critical 9.8 | 1.7% |
| Aug 18, 2026 | Path Traversal | Broadcom VMware vCenter | Critical 9.8 | 2.6% |
| Aug 18, 2026 | Weak Authentication | Microsoft SharePoint | Critical 9.1 | 70% |
| Aug 18, 2026 | Double Free | Microsoft Internet Key Exchange (IKE) Service Extensions | Critical 9.8 | 77% |
| Aug 17, 2026 | Code Injection | Ray-Project Ray | Critical 9.4 | 62% |
| Aug 11, 2026 | SQL Injection | Metabase Metabase | Critical 10.0 | 99% |
| Aug 11, 2026 | Windows Ancillary Function Driver for WinSock Use-After-Free | Microsoft Windows Ancillary Function Driver for WinSock | High 7.0 | 0.3% |
| Aug 11, 2026 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | High 8.6 | 1.0% |
| Aug 7, 2026 | Command Injection | Progress LoadMaster | Critical 9.6 | 99.8% |
| Aug 5, 2026 | Deserialization of Untrusted Data | JetBrains TeamCity | Critical 9.8 | 94% |
| Aug 4, 2026 | Code Injection | IBM Langflow | Critical 9.8 | 29% |
| Aug 4, 2026 | Missing Encryption of Sensitive Data | Apache Tomcat | High 7.5 | 99% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 82
- Google 75
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 31
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.