Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 25, 2022 | Spring Cloud Config Directory Traversal | VMware Tanzu Spring Cloud Configuration (Config) Server | High 7.5 | 96% |
| Mar 25, 2022 | Remote Code Execution | Sophos SG UTM | Critical 9.8 | 97% |
| Mar 25, 2022 | QNAP Helpdesk Improper Access Control | QNAP Systems Helpdesk | High 7.3 | 2.0% |
| Mar 25, 2022 | Authentication Bypass | Palo Alto Networks PAN-OS | Critical 10.0 | 4.4% |
| Mar 25, 2022 | OS Command Injection | Apache Kylin | High 8.8 | 97% |
| Mar 25, 2022 | Path Traversal | Juniper Junos OS | High 8.8 | 4.9% |
| Mar 25, 2022 | Remote Code Execution | Drupal Core | High 8.1 | 92% |
| Mar 25, 2022 | BI Publisher Unauthorized Access | Oracle BI Publisher (Formerly XML Publisher) | High 7.2 | 92% |
| Mar 25, 2022 | Command Injection | D-Link Multiple Routers | Critical 9.8 | >99.9% |
| Mar 25, 2022 | Command Injection | Webmin Webmin | Critical 9.8 | 99.7% |
| Mar 25, 2022 | Command Injection | Citrix SD-WAN and NetScaler | High 8.8 | 74% |
| Mar 25, 2022 | SQL Injection | Citrix SD-WAN and NetScaler | Critical 9.8 | 95% |
| Mar 25, 2022 | Buffer Overflow | PHP FastCGI Process Manager (FPM) | High 8.7 | 99.7% |
| Mar 25, 2022 | Deserialization of Untrusted Data | Kentico Xperience | Critical 9.8 | 95% |
| Mar 25, 2022 | Remote Code Execution | Jenkins Matrix Project Plugin | Critical 9.9 | 97% |
| Mar 25, 2022 | GDI Remote Code Execution | Microsoft Graphics Device Interface (GDI) | High 8.8 | 22% |
| Mar 25, 2022 | Shell Remote Code Execution | Microsoft Windows | High 8.8 | 73% |
| Mar 25, 2022 | Scripting Engine Memory Corruption | Microsoft Internet Explorer Scripting Engine | High 7.5 | 62% |
| Mar 25, 2022 | by VeloCloud Command Injection | VMware SD-WAN Edge | High 8.1 | 85% |
| Mar 25, 2022 | Remote Command Execution | LG N1A1 NAS | Critical 9.8 | 89% |
| Mar 25, 2022 | Property Binder | VMware Tanzu Spring Data Commons | Critical 9.8 | 97% |
| Mar 25, 2022 | Remote Command Execution | Quest KACE System Management Appliance | Critical 9.8 | 92% |
| Mar 25, 2022 | Secure Access Control System Java Deserialization | Cisco Secure Access Control System (ACS) | Critical 9.8 | 18% |
| Mar 25, 2022 | Remote Code Execution | Cisco VPN Routers | Critical 9.8 | 55% |
| Mar 25, 2022 | OS Command Injection | NETGEAR DGN2200 Devices | High 8.8 | 73% |
| Mar 25, 2022 | Multiple Products Remote Code Execution | Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | Critical 9.8 | 73% |
| Mar 25, 2022 | Remote Code Execution | Cisco IOS and IOS XE | Critical 9.8 | 99% |
| Mar 25, 2022 | Remote Code Execution | Apache Tomcat | High 8.1 | >99.9% |
| Mar 25, 2022 | on Windows Remote Code Execution | Apache Tomcat | High 8.1 | 99.7% |
| Mar 25, 2022 | SMB Remote Code Execution | Microsoft Windows | High 8.8 | 90% |
| Mar 25, 2022 | Use-After-Free | Adobe Flash Player | High 8.8 | 19% |
| Mar 25, 2022 | Remote Code Execution | Adobe Flash Player | High 7.8 | 20% |
| Mar 25, 2022 | Multiple WAP Devices Command Injection | NETGEAR Wireless Access Point (WAP) Devices | Critical 9.8 | 98% |
| Mar 25, 2022 | OS Command Injection | D-Link DCS-930L Devices | High 7.2 | 70% |
| Mar 25, 2022 | Buffer Overflow | NETGEAR WNR2000v5 Router | Critical 9.8 | 83% |
| Mar 25, 2022 | Directory Traversal | Rails Ruby on Rails | High 7.5 | 96% |
| Mar 25, 2022 | Directory Traversal | Arcserve Unified Data Protection (UDP) | Critical 9.1 | 64% |
| Mar 25, 2022 | Directory Traversal | TP-Link Multiple Archer Devices | High 7.5 | 84% |
| Mar 25, 2022 | Groovy Scripting Engine Remote Code Execution | Elastic Elasticsearch | Critical 9.8 | 99.9% |
| Mar 25, 2022 | Remote Code Execution | D-Link and TRENDnet Multiple Devices | Critical 9.8 | 83% |
| Mar 25, 2022 | Directory Traversal | Cisco Prime Data Center Network Manager (DCNM) | High 7.5 | 40% |
| Mar 25, 2022 | Object Linking & Embedding (OLE) Automation Array Remote Code Execution | Microsoft Windows | High 8.8 | 95% |
| Mar 25, 2022 | Privilege Escalation | Microsoft Kerberos Key Distribution Center (KDC) | High 8.8 | 87% |
| Mar 25, 2022 | Remote Code Execution | Rejetto HTTP File Server (HFS) | Critical 9.8 | 99.3% |
| Mar 25, 2022 | Remote Code Execution | Elastic Elasticsearch | High 8.1 | 89% |
| Mar 25, 2022 | Directory Traversal | Rails Ruby on Rails | High 7.5 | 54% |
| Mar 25, 2022 | Gateway Cross-Site Scripting | D-Link DSL-2760U | Medium 5.4 | 51% |
| Mar 25, 2022 | HP Multiple Products Remote Code Execution | Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management | Critical 9.8 | 79% |
| Mar 25, 2022 | Improper Input Validation | Apache Struts | Critical 9.8 | >99.9% |
| Mar 25, 2022 | PHP-CGI Query String Parameter | PHP PHP | Critical 9.8 | >99.9% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.