Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 16, 2022 | OS Command Injection | Zyxel Multiple Firewalls | Critical 9.8 | 99.9% |
| May 16, 2022 | Code Injection | VMware Spring Cloud Gateway | Critical 10.0 | 98% |
| May 10, 2022 | Missing Authentication | F5 BIG-IP | Critical 9.8 | >99.9% |
| May 4, 2022 | Type Confusion | Apple Multiple Products | High 8.8 | 14% |
| May 4, 2022 | Type Confusion | Apple Multiple Products | High 8.8 | 16% |
| May 4, 2022 | Privilege Escalation | Microsoft Win32k | High 7.8 | 87% |
| May 4, 2022 | Use-After-Free | Microsoft Internet Explorer | High 8.8 | 85% |
| May 4, 2022 | Information Disclosure | OpenSSL OpenSSL | High 7.5 | >99.9% |
| Apr 25, 2022 | Unrestrictive Upload of File | WSO2 Multiple Products | Critical 9.8 | >99.9% |
| Apr 25, 2022 | User Profile Service Privilege Escalation | Microsoft Windows | High 7.0 | 17% |
| Apr 25, 2022 | User Profile Service Privilege Escalation | Microsoft Windows | High 7.0 | 2.4% |
| Apr 25, 2022 | Privilege Escalation | Linux Kernel | High 7.8 | 93% |
| Apr 25, 2022 | Privilege Escalation | Microsoft Win32k | High 7.8 | 1.6% |
| Apr 25, 2022 | Privilege Escalation | Microsoft Win32k | High 7.8 | 1.6% |
| Apr 25, 2022 | Sandbox Bypass | Jenkins Script Security Plugin | Critical 9.9 | 74% |
| Apr 19, 2022 | Print Spooler Privilege Escalation | Microsoft Windows | High 7.8 | 18% |
| Apr 19, 2022 | VOIP Stack Buffer Overflow | Meta Platforms WhatsApp | Critical 9.8 | 30% |
| Apr 19, 2022 | Cross-Site Scripting (XSS) | Synacor Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 30% |
| Apr 15, 2022 | Privilege Escalation | VMware Multiple Products | High 7.8 | 36% |
| Apr 15, 2022 | Type Confusion | Google Chromium V8 | High 8.8 | 14% |
| Apr 15, 2022 | Command Injection | Crestron Multiple Products | Critical 9.8 | 99% |
| Apr 15, 2022 | DNS-320 Remote Code Execution | D-Link DNS-320 Storage Device | Critical 9.8 | 86% |
| Apr 15, 2022 | SQL Injection | Schneider Electric U.motion Builder | Critical 9.8 | 72% |
| Apr 15, 2022 | Denial-of-Service | Trihedral VTScada (formerly VTS) | High 7.5 | 31% |
| Apr 15, 2022 | NTWebServer Directory Traversal | InduSoft Web Studio | High 7.5 | 75% |
| Apr 15, 2022 | Command Injection | Ubiquiti AirOS | Critical 9.8 | 40% |
| Apr 15, 2022 | Remote Code Execution | Alcatel OmniPCX Enterprise | Critical 9.8 | 97% |
| Apr 14, 2022 | Server-Side Template Injection | VMware Workspace ONE Access and Identity Manager | Critical 9.8 | >99.9% |
| Apr 13, 2022 | CLFS Driver Privilege Escalation | Microsoft Windows | High 7.8 | 7.1% |
| Apr 13, 2022 | Remote Code Execution | Drupal Core | High 8.1 | 99.2% |
| Apr 13, 2022 | VSA Remote Code Execution | Kaseya Virtual System/Server Administrator (VSA) | Critical 9.8 | 30% |
| Apr 13, 2022 | Use-After-Free | Adobe Flash Player | High 7.8 | 19% |
| Apr 13, 2022 | Use-After-Free | Adobe Flash Player | High 7.8 | 87% |
| Apr 13, 2022 | Heap-Based Buffer Overflow | Adobe Flash Player | High 7.8 | 99.8% |
| Apr 13, 2022 | Memory Corruption | Microsoft Internet Explorer | High 8.8 | 51% |
| Apr 13, 2022 | Use-After-Free | Adobe Flash Player | High 7.8 | 95% |
| Apr 13, 2022 | Remote Code Execution | Adobe Flash Player | High 7.8 | 86% |
| Apr 13, 2022 | Stack-Based Buffer Overflow | Adobe Flash Player | High 7.8 | 45% |
| Apr 11, 2022 | Privilege Escalation | WatchGuard Firebox and XTM | High 8.8 | 11% |
| Apr 11, 2022 | Domain Services Privilege Escalation | Microsoft Active Directory | High 7.5 | 77% |
| Apr 11, 2022 | Domain Services Privilege Escalation | Microsoft Active Directory | High 7.5 | 73% |
| Apr 11, 2022 | Out-of-Bounds Write | Google Pixel | High 7.8 | 0.7% |
| Apr 11, 2022 | Survey Deserialization of Untrusted Data | Checkbox Checkbox Survey | Critical 9.8 | 30% |
| Apr 11, 2022 | Privilege Escalation | Linux Kernel | Medium 6.6 | 6.6% |
| Apr 11, 2022 | Network-Attached Storage (NAS) Command Injection | QNAP QNAP Network-Attached Storage (NAS) | Critical 9.8 | 34% |
| Apr 11, 2022 | UI for ASP.NET AJAX Unrestricted File Upload | Telerik User Interface (UI) for ASP.NET AJAX | Critical 9.8 | 84% |
| Apr 6, 2022 | Heap-Based Buffer Overflow | Sudo Sudo | High 7.8 | >99.9% |
| Apr 6, 2022 | Remote Code Execution | Microsoft HTTP Protocol Stack | Critical 9.8 | 99.9% |
| Apr 6, 2022 | Remote Code Execution | Microsoft SMBv1 server | High 8.1 | 99.4% |
| Apr 4, 2022 | JDK 9+ Remote Code Execution | VMware Spring Framework | Critical 9.8 | 99.6% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.