Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,764exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,764 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 10, 2022 | Improper Input Validation | Apache Struts 1 | Critical 9.8 | 99% |
| Feb 10, 2022 | Shell (.lnk) Remote Code Execution | Microsoft Windows | High 8.8 | 90% |
| Feb 10, 2022 | Corporation WebLogic Server Remote Code Execution | Oracle WebLogic Server | High 7.5 | >99.9% |
| Feb 10, 2022 | Privilege Escalation | Microsoft Win32k | High 7.8 | 10% |
| Feb 10, 2022 | Remote Code Execution | Microsoft Office | High 7.8 | 81% |
| Feb 10, 2022 | Remote Code Execution | Microsoft SMBv1 | High 8.8 | 90% |
| Feb 10, 2022 | Remote Code Execution | Microsoft SMBv1 | High 8.8 | 99.2% |
| Feb 10, 2022 | Improper Input Validation | Apache ActiveMQ | Critical 9.8 | 99% |
| Feb 10, 2022 | Remote Code Execution | D-Link DIR-645 Router | High 8.8 | 97% |
| Feb 10, 2022 | Remote Code Execution | Microsoft HTTP.sys | Critical 9.8 | >99.9% |
| Feb 10, 2022 | Authentication Bypass | Apple OS X | High 7.8 | 9.9% |
| Feb 10, 2022 | Heap-Based Buffer Overflow | Apple OS X | High 7.8 | 49% |
| Feb 4, 2022 | Privilege Escalation | Microsoft Win32k | High 7.0 | 59% |
| Jan 28, 2022 | Memory Corruption | Apple iOS and macOS | Critical 9.8 | 12% |
| Jan 28, 2022 | Stack-Based Buffer Overflow | SonicWall SMA 100 Appliances | Critical 9.8 | 99.9% |
| Jan 28, 2022 | Networks UCM6200 Series SQL Injection | Grandstream UCM6200 | Critical 9.8 | 84% |
| Jan 28, 2022 | Background Intelligent Transfer Service (BITS) Improper Privilege Management | Microsoft Windows | High 7.8 | 43% |
| Jan 28, 2022 | Privilege Escalation | Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability | Critical 9.8 | 92% |
| Jan 28, 2022 | Arbitrary Code Execution | GNU Bourne-Again Shell (Bash) | Critical 9.8 | 99.9% |
| Jan 28, 2022 | Arbitrary Code Execution | GNU Bourne-Again Shell (Bash) | Critical 9.8 | >99.9% |
| Jan 28, 2022 | Memory Corruption | Microsoft Internet Explorer | Critical 9.8 | 83% |
| Jan 21, 2022 | Improper Input Validation | SolarWinds Serv-U | Medium 4.3 | 3.5% |
| Jan 21, 2022 | Privilege Escalation | Microsoft Win32k | High 7.8 | 70% |
| Jan 21, 2022 | Improper Input Validation | Apache Struts 2 | Critical 9.8 | 76% |
| Jan 21, 2022 | ActionForm Denial-of-Service | Apache Struts 1 | High 7.5 | 55% |
| Jan 18, 2022 | Controller Unrestricted Upload of File | Aviatrix Aviatrix Controller | Critical 9.8 | 93% |
| Jan 18, 2022 | Information Disclosure | Microsoft Exchange Server | High 7.3 | 98% |
| Jan 18, 2022 | Improper Authentication | October CMS October CMS | High 8.2 | 90% |
| Jan 18, 2022 | XI OS Command Injection | Nagios Nagios XI | High 8.8 | 74% |
| Jan 18, 2022 | XI OS Command Injection | Nagios Nagios XI | High 8.8 | 57% |
| Jan 18, 2022 | XI OS Command Injection | Nagios Nagios XI | High 8.8 | 72% |
| Jan 18, 2022 | Buffer Overflow | F5 BIG-IP Traffic Management Microkernel | Critical 9.8 | 62% |
| Jan 18, 2022 | Server Side Request Forgery in vRealize Operations Manager API | VMware vRealize Operations Manager API | Critical 9.8 | 78% |
| Jan 18, 2022 | Command Injection | Npm package System Information Library for Node.JS | High 7.1 | 91% |
| Jan 18, 2022 | Business Intelligence Enterprise Edition Path Transversal | Oracle Intelligence Enterprise Edition | High 7.5 | 97% |
| Jan 18, 2022 | Authentication Bypass | Apache Airflow's Experimental API | Critical 9.8 | 99.8% |
| Jan 18, 2022 | core Un-restricted Upload of File | Drupal Drupal core | High 8.8 | 36% |
| Jan 18, 2022 | Command Injection | Apache Airflow | High 8.8 | 99.2% |
| Jan 10, 2022 | Improper Input Validation | Hikvision Security cameras web server | Critical 9.8 | 99.9% |
| Jan 10, 2022 | WARP, IPVPN, and MPVPN Configuration Upload exploit | FatPipe WARP, IPVPN, and MPVPN software | Critical 9.8 | 40% |
| Jan 10, 2022 | Improper Access Control | VMware vCenter Server | Medium 5.3 | 49% |
| Jan 10, 2022 | Use-After-Free | Google Chrome Media | High 8.8 | 11% |
| Jan 10, 2022 | Improper Restriction of XML External Entity Reference | Synacor Zimbra Collaboration Suite (ZCS) | Critical 9.8 | >99.9% |
| Jan 10, 2022 | Arbitrary Code Execution | Elastic Kibana | Critical 9.8 | 95% |
| Jan 10, 2022 | WebLogic Server, Injection | Oracle WebLogic Server | High 7.5 | >99.9% |
| Jan 10, 2022 | Remote Code Execution | Palo Alto Networks PAN-OS | High 8.1 | 44% |
| Jan 10, 2022 | Privilege Escalation | Microsoft Win32k | High 7.8 | 74% |
| Jan 10, 2022 | Improper Input Validation | Exim Mail Transfer Agent (MTA) | Critical 9.0 | >99.9% |
| Jan 10, 2022 | Out-of-bounds Write | Fortinet FortiOS and FortiProxy | Medium 4.3 | 32% |
| Jan 10, 2022 | Improper Authorization | Fortinet FortiOS and FortiProxy | Critical 9.1 | 82% |
Most targeted vendors
- Microsoft 390
- Cisco 102
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.