Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,758exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,758 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 4, 2026 | Authentication Bypass Using an Alternate Path or Channel | N-able N-central | High 8.2 | 7.9% |
| Aug 3, 2026 | Authentication Bypass Using an Alternate Path or Channel | N-able N-central | High 8.2 | 15% |
| Jul 29, 2026 | Secure Firewall Management Center Use of Hard-coded Password | Cisco Secure Firewall Management Center (FMC) | Medium 5.3 | 35% |
| Jul 27, 2026 | On-Prem OS Command Injection | Arista VeloCloud Orchestrator | Critical 10.0 | 1.0% |
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | Fortinet FortiOS | Medium 5.3 | 29% |
| Jul 22, 2026 | Deserialization of Untrusted Data Vulnerability | Microsoft SharePoint | Critical 9.8 | 3.0% |
| Jul 22, 2026 | Improper Authentication | Check Point SmartConsole | Critical 9.3 | 3.5% |
| Jul 21, 2026 | Interpretation Conflict | WordPress Core | Critical 9.8 | 11% |
| Jul 21, 2026 | SQL Injection | WordPress Core | Medium 5.9 | 5.3% |
| Jul 21, 2026 | Inclusion of Functionality from Untrusted Control Sphere | Langflow Langflow | Critical 9.8 | 63% |
| Jul 21, 2026 | Stack-Based Buffer Overflow | DD-WRT DD-WRT | High 8.1 | 4.0% |
| Jul 16, 2026 | Deserialization of Untrusted Data | Microsoft SharePoint | Critical 9.8 | 16% |
| Jul 16, 2026 | OS Command Injection | Fortinet FortiSandbox | Critical 9.1 | 93% |
| Jul 16, 2026 | OS Command Injection | Fortinet FortiSandbox | Critical 9.1 | 76% |
| Jul 15, 2026 | Improper Privilege Management | Oracle E-Business Suite | Critical 9.8 | 12% |
| Jul 15, 2026 | Overly Restrictive Account Lockout Mechanism | KNX Association KNX Protocol Connection Authorization Option 1 | High 7.5 | 1.4% |
| Jul 14, 2026 | Missing Authentication for Critical Function | Microsoft SharePoint Server | Medium 5.3 | 1.0% |
| Jul 14, 2026 | Insufficient Granularity of Access Control Vulnerability | Microsoft Active Directory Federation Services | High 7.8 | 0.3% |
| Jul 14, 2026 | Code Injection | SonicWall SMA1000 Appliances | High 7.2 | 12% |
| Jul 14, 2026 | Server-Side Request Forgery | SonicWall SMA1000 Appliances | Critical 10.0 | 6.8% |
| Jul 13, 2026 | Cross-Site Request Forgery | Cisco IOS | High 8.1 | 34% |
| Jul 10, 2026 | Unrestricted Upload of File with Dangerous Type | Balbooa Forms | Critical 10.0 | 15% |
| Jul 10, 2026 | Unrestricted Upload of File with Dangerous Type | iCagenda iCagenda | Critical 10.0 | 20% |
| Jul 7, 2026 | Improper Access Control | Joomlack Page Builder | Critical 10.0 | 31% |
| Jul 7, 2026 | Authorization Bypass Through User-Controlled Key | Langflow Langflow | High 8.4 | 0.9% |
| Jul 7, 2026 | Unrestricted Upload of File with Dangerous Type | JoomShaper SP Page Builder | Critical 10.0 | 89% |
| Jul 7, 2026 | Path Traversal | Adobe ColdFusion | Critical 10.0 | 42% |
| Jul 1, 2026 | Deserialization of Untrusted Data | Microsoft SharePoint Server | High 8.8 | 80% |
| Jun 29, 2026 | Authentication Bypass | SimpleHelp SimpleHelp | Critical 9.5 | 78% |
| Jun 25, 2026 | Server-Side Request Forgery (SSRF) | Cisco Unified Communications Manager | High 8.6 | 88% |
| Jun 25, 2026 | Improper Input Validation | PTC Windchill and FlexPLM | Critical 9.3 | 46% |
| Jun 23, 2026 | Improper Input Validation | Ubiquiti UniFi OS | Critical 10.0 | 90% |
| Jun 23, 2026 | Path Traversal | Ubiquiti UniFi OS | Critical 10.0 | 68% |
| Jun 23, 2026 | Improper Access Control | Ubiquiti UniFi OS | Critical 10.0 | 88% |
| Jun 23, 2026 | Code Injection | Lantronix EDS5000 | Critical 9.3 | 20% |
| Jun 18, 2026 | Missing Authentication for Critical Function | Splunk Enterprise | Critical 9.8 | 97% |
| Jun 16, 2026 | Joomla Content Editor Improper Access Control | Widget Factory Joomla Content Editor | Critical 10.0 | 85% |
| Jun 15, 2026 | UNIX Symbolic Link (Symlink) Following | LiteSpeed cPanel Plugin | High 8.5 | 1.4% |
| Jun 15, 2026 | Directory or Path Traversal | Cisco Catalyst SD-WAN Manager | Medium 6.5 | 29% |
| Jun 12, 2026 | PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function | Oracle PeopleSoft Enterprise PeopleTools | Critical 9.8 | 97% |
| Jun 11, 2026 | OS Command Injection | Ivanti Sentry | Critical 10.0 | 99.9% |
| Jun 9, 2026 | Incomplete Comparison with Missing Factors | Arista Extensible Operating System | Medium 6.9 | 1.1% |
| Jun 9, 2026 | Improper Encoding or Escaping of Output | Cisco Catalyst SD-WAN Manager | High 7.8 | 25% |
| Jun 9, 2026 | Out-of-Bounds Read and Write | Google Chromium V8 | High 8.8 | 2.4% |
| Jun 8, 2026 | Improper Authentication | Check Point Security Gateway | Critical 9.3 | 85% |
| Jun 8, 2026 | Command Injection | BerriAI LiteLLM | High 8.7 | 91% |
| Jun 5, 2026 | Uncontrolled Resource Consumption | SolarWinds Serv-U | High 7.5 | 44% |
| Jun 3, 2026 | Full Page Cache Warmer Deserialization of Untrusted Data | Mirasvit Mirasvit Full Page Cache Warmer | Critical 9.3 | 26% |
| Jun 2, 2026 | Integer Overflow | Android Framework | High 8.4 | 1.9% |
| Jun 2, 2026 | Improper Authentication | Linux Kernel | High 7.8 | 5.5% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 82
- Google 75
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 31
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.