Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,764exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,764 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jan 10, 2022 | Primefaces Remote Code Execution | Primetek Primefaces Application | Critical 9.8 | 94% |
| Jan 10, 2022 | Code Injection. | IBM WebSphere Application Server and Server Hypervisor Edition | Critical 9.8 | 98% |
| Jan 10, 2022 | Remote Code Execution | Microsoft WinVerifyTrust function | Medium 5.5 | 45% |
| Dec 15, 2021 | AppX Installer Spoofing | Microsoft Windows | High 7.1 | 11% |
| Dec 15, 2021 | Use-After-Free | Google Chromium V8 | High 8.8 | 7.8% |
| Dec 10, 2021 | Authentication Bypass | Zoho Desktop Central | Critical 9.8 | 99.9% |
| Dec 10, 2021 | Remote Code Execution | Apache Log4j2 | Critical 10.0 | >99.9% |
| Dec 10, 2021 | Arbitrary File Download | Fortinet FortiOS | Low 3.3 | 0.9% |
| Dec 10, 2021 | Jungle SDK Remote Code Execution | Realtek Jungle Software Development Kit (SDK) | Critical 9.8 | 99.9% |
| Dec 10, 2021 | Remote Code Execution | Pi-hole AdminLTE | Critical 9.1 | 78% |
| Dec 10, 2021 | SQL Injection | Fuel CMS Fuel CMS | Critical 9.8 | 90% |
| Dec 10, 2021 | Incorrect Access Control | Sonatype Nexus Repository Manager | Critical 9.8 | 77% |
| Dec 10, 2021 | Improper Privilege Management | Linux Kernel | High 7.8 | 52% |
| Dec 10, 2021 | Remote Code Execution | MongoDB mongo-express | Critical 9.9 | 85% |
| Dec 10, 2021 | DataImportHandler Code Injection | Apache Solr | High 7.2 | 84% |
| Dec 10, 2021 | Remote Code Execution | Embedthis GoAhead | High 8.1 | 97% |
| Dec 10, 2021 | Remote Code Execution | Red Hat JBoss Application Server | Critical 9.8 | 91% |
| Dec 10, 2021 | Linux JBoss Seam 2 Remote Code Execution | Red Hat JBoss Seam 2 | High 8.8 | 83% |
| Dec 1, 2021 | ManageEngine ServiceDesk Plus Remote Code Execution | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Critical 9.8 | 93% |
| Dec 1, 2021 | HTTP Server-Side Request Forgery (SSRF) | Apache Apache | Critical 9.0 | >99.9% |
| Dec 1, 2021 | ManageEngine ServiceDesk Authentication Bypass | Zoho ManageEngine ServiceDesk Plus (SDP) | Critical 9.8 | 99.8% |
| Dec 1, 2021 | Multiple Chipsets Improper Input Validation | Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | High 7.8 | 1.6% |
| Dec 1, 2021 | Router OS Directory Traversal | MikroTik RouterOS | Critical 9.1 | 96% |
| Nov 17, 2021 | Server Remote Code Execution | Microsoft Exchange | High 8.8 | 92% |
| Nov 17, 2021 | Excel Security Feature Bypass | Microsoft Office | High 7.8 | 43% |
| Nov 17, 2021 | Win32k Privilege Escalation | Microsoft Windows | High 7.8 | 82% |
| Nov 17, 2021 | Remote Code Execution | Perl Exiftool | Medium 6.8 | >99.9% |
| Nov 3, 2021 | SQL Injection | BQE BillQuick Web Suite | Critical 9.8 | 75% |
| Nov 3, 2021 | Path Traversal | Apache HTTP Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Path Traversal | Apache HTTP Server | High 7.5 | >99.9% |
| Nov 3, 2021 | ADSelfService Plus Authentication Bypass | Zoho ManageEngine | Critical 9.8 | 99% |
| Nov 3, 2021 | Remote Code Execution | Microsoft MSHTML | High 8.8 | 98% |
| Nov 3, 2021 | Privilege Escalation | Microsoft Open Management Infrastructure (OMI) | High 7.0 | 2.9% |
| Nov 3, 2021 | Privilege Escalation | Microsoft Open Management Infrastructure (OMI) | High 7.8 | 11% |
| Nov 3, 2021 | Remote Code Execution | Microsoft Open Management Infrastructure (OMI) | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Privilege Escalation | Microsoft Open Management Infrastructure (OMI) | High 7.8 | 2.7% |
| Nov 3, 2021 | Memory Corruption | Google Chromium V8 | High 8.8 | 39% |
| Nov 3, 2021 | Improper Input Validation | Google Chromium Intents | Medium 6.1 | 4.9% |
| Nov 3, 2021 | Information Disclosure | Google Chromium | Medium 6.5 | 20% |
| Nov 3, 2021 | Use-After-Free | Google Chromium V8 | High 8.8 | 35% |
| Nov 3, 2021 | Use-After-Free | Google Chromium Portals | Critical 9.6 | 12% |
| Nov 3, 2021 | Common Log File System (CLFS) Driver Privilege Escalation | Microsoft Windows | High 7.8 | 4.1% |
| Nov 3, 2021 | Update Medic Service Privilege Escalation | Microsoft Windows | High 7.8 | 23% |
| Nov 3, 2021 | Local Security Authority (LSA) Spoofing | Microsoft Windows | High 7.5 | 66% |
| Nov 3, 2021 | Multiple Products Improper Input Validation | Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security | High 7.8 | 1.5% |
| Nov 3, 2021 | Multiple Products Improper Input Validation | Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security | High 8.8 | 5.0% |
| Nov 3, 2021 | Core Server Remote Code Execution | ForgeRock Access Management (AM) | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Buffer Overflow | Realtek AP-Router SDK | Critical 9.8 | 98% |
| Nov 3, 2021 | Remote Code Execution | SolarWinds Serv-U | Critical 9.0 | 91% |
| Nov 3, 2021 | Print Spooler Remote Code Execution | Microsoft Windows | High 8.8 | 99.8% |
Most targeted vendors
- Microsoft 390
- Cisco 102
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.