Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,764exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,764 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | iControl REST Remote Code Execution | F5 BIG-IP and BIG-IQ Centralized Management | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Unrestricted File Upload | Ivanti Pulse Connect Secure | High 7.2 | 14% |
| Nov 3, 2021 | Command Injection | Ivanti Pulse Connect Secure | High 8.8 | 23% |
| Nov 3, 2021 | Collaboration Suite Buffer Overflow | Ivanti Pulse Connect Secure | High 8.8 | 41% |
| Nov 3, 2021 | Use-After-Free | Ivanti Pulse Connect Secure | Critical 10.0 | 47% |
| Nov 3, 2021 | Access Manager Information Leakage | Micro Focus Micro Focus Access Manager | High 7.5 | 26% |
| Nov 3, 2021 | Operation Bridge Report (OBR) Remote Code Execution | Micro Focus Operation Bridge Reporter (OBR) | Critical 9.8 | 97% |
| Nov 3, 2021 | Remote Code Execution | GitLab Community and Enterprise Editions | Critical 10.0 | 99.7% |
| Nov 3, 2021 | File Upload | VMware vCenter Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Improper Input Validation | VMware vCenter Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | VMware vCenter Server | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Type Confusion | Google Chromium V8 | High 8.8 | 84% |
| Nov 3, 2021 | Improper Input Validation | Google Chromium V8 | High 8.8 | 70% |
| Nov 3, 2021 | Use-After-Free | Google Chromium Blink | High 8.8 | 9.3% |
| Nov 3, 2021 | Use-After-Free | Google Chromium Blink | High 8.8 | 10.0% |
| Nov 3, 2021 | Race Condition | Google Chromium | High 8.8 | 24% |
| Nov 3, 2021 | Heap Buffer Overflow | Google Chromium V8 | High 8.8 | 20% |
| Nov 3, 2021 | Heap-based Buffer Overflow | Adobe Acrobat and Reader | High 8.8 | 86% |
| Nov 3, 2021 | Path Traversal | Arcadyan Buffalo Firmware | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Email Security Path Traversal | SonicWall SonicWall Email Security | Medium 4.9 | 52% |
| Nov 3, 2021 | Email Security Unrestricted Upload of File | SonicWall SonicWall Email Security | High 7.2 | 17% |
| Nov 3, 2021 | Email Security Improper Privilege Management | SonicWall SonicWall Email Security | Critical 9.8 | 89% |
| Nov 3, 2021 | SQL Injection | SonicWall SSLVPN SMA100 | Critical 9.8 | 40% |
| Nov 3, 2021 | Detection of Error Condition Without Action | Qualcomm Multiple Chipsets | Medium 6.2 | 0.5% |
| Nov 3, 2021 | Use-After-Free | Qualcomm Multiple Chipsets | High 8.4 | 1.5% |
| Nov 3, 2021 | WebKit Cross-Site Scripting (XSS) | Apple iOS, iPadOS, and watchOS | Medium 6.1 | 7.1% |
| Nov 3, 2021 | WebKit Remote Code Execution | Apple iOS, iPadOS, and macOS | Critical 9.8 | 7.0% |
| Nov 3, 2021 | WebKit Remote Code Execution | Apple iOS, iPadOS, and macOS | Critical 9.8 | 7.7% |
| Nov 3, 2021 | Race Condition | Apple Multiple Products | High 7.0 | 2.2% |
| Nov 3, 2021 | Privilege Escalation | Microsoft Win32k | High 7.8 | 78% |
| Nov 3, 2021 | Print Spooler Remote Code Execution | Microsoft Windows | High 7.8 | 85% |
| Nov 3, 2021 | Remote Code Execution | Microsoft Defender | High 7.8 | 40% |
| Nov 3, 2021 | Data Platform Command Injection | Cisco HyperFlex HX | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Installer Virtual Machine Command Injection | Cisco HyperFlex HX | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Code Execution | Apple Multiple Products | High 7.8 | 0.8% |
| Nov 3, 2021 | Memory Corruption | Apple iOS, iPadOS, and watchOS | Medium 4.3 | 2.2% |
| Nov 3, 2021 | Out-of-Bounds Write | Apple iOS, iPadOS, and watchOS | High 8.8 | 2.3% |
| Nov 3, 2021 | Use of Hard-Coded Credentials | EyesOfNetwork EyesOfNetwork | Critical 9.8 | 92% |
| Nov 3, 2021 | Improper Privilege Management | EyesOfNetwork EyesOfNetwork | High 7.8 | 60% |
| Nov 3, 2021 | Server-Side Template Injection | PlaySMS PlaySMS | Critical 9.8 | 87% |
| Nov 3, 2021 | Authentication Bypass | Trend Micro Apex One and OfficeScan | Critical 9.8 | 12% |
| Nov 3, 2021 | Multiple DrayTek Vigor Routers Web Management Page | DrayTek Multiple Vigor Routers | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Multiple Products Content Validation Escape | Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents | High 8.8 | 6.2% |
| Nov 3, 2021 | Remote Code Execution | Trend Micro Apex One and OfficeScan | High 8.8 | 11% |
| Nov 3, 2021 | Code Execution | Ivanti Pulse Connect Secure | High 7.2 | 96% |
| Nov 3, 2021 | Code Execution | Ivanti Pulse Connect Secure | High 7.2 | 91% |
| Nov 3, 2021 | ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Medium 4.3 | 26% |
| Nov 3, 2021 | ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Medium 6.5 | 33% |
| Nov 3, 2021 | ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Medium 6.5 | 88% |
| Nov 3, 2021 | Portal Deserialization of Untrusted Data | Liferay Liferay Portal | Critical 9.8 | 99.9% |
Most targeted vendors
- Microsoft 390
- Cisco 102
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Linux 32
- Fortinet 32
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.