Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,764exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,764 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Use-After-Free | Mozilla Firefox and Thunderbird | High 8.1 | 7.1% |
| Nov 3, 2021 | Use-After-Free | Mozilla Firefox and Thunderbird | High 8.1 | 3.0% |
| Nov 3, 2021 | Type Confusion | Google Chromium V8 | High 8.8 | 79% |
| Nov 3, 2021 | Missing Authentication for Critical Function | SAP NetWeaver | Critical 10.0 | 95% |
| Nov 3, 2021 | Missing Authentication for Critical Function | SAP Solution Manager | Critical 10.0 | 98% |
| Nov 3, 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | F5 BIG-IP | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Authentication Bypass | Unraid Unraid | High 7.5 | 93% |
| Nov 3, 2021 | Remote Code Execution | Unraid Unraid | Critical 9.8 | 96% |
| Nov 3, 2021 | Cameras and NVR Stack-based Buffer Overflow | Amcrest Cameras and Network Video Recorder (NVR) | High 8.8 | 36% |
| Nov 3, 2021 | Directory Traversal | IBM Data Risk Manager | Medium 4.3 | 69% |
| Nov 3, 2021 | Remote Code Execution | IBM Data Risk Manager | Critical 9.1 | 62% |
| Nov 3, 2021 | Security Bypass | IBM Data Risk Manager | Critical 9.0 | 70% |
| Nov 3, 2021 | Multiple VMware Products Command Injection | VMware Multiple Products | Critical 9.1 | 17% |
| Nov 3, 2021 | OpenSLP Use-After-Free | VMware ESXi | Critical 9.8 | 83% |
| Nov 3, 2021 | Information Disclosure | VMware vCenter Server | Critical 9.8 | 90% |
| Nov 3, 2021 | Privilege Escalation | VMware Multiple Products | High 7.8 | 7.3% |
| Nov 3, 2021 | ASA and FTD Cross-Site Scripting (XSS) | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Medium 6.1 | 86% |
| Nov 3, 2021 | Software DVMRP Memory Exhaustion | Cisco IOS XR | High 8.6 | 3.3% |
| Nov 3, 2021 | Software DVMRP Memory Exhaustion | Cisco IOS XR | High 8.6 | 3.7% |
| Nov 3, 2021 | ASA and FTD Read-Only Path Traversal | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | High 7.5 | >99.9% |
| Nov 3, 2021 | IP Phones Web Server Remote Code Execution and Denial-of-Service | Cisco Cisco IP Phones | Critical 9.8 | 84% |
| Nov 3, 2021 | Software Discovery Protocol Format String | Cisco IOS XR | High 8.8 | 12% |
| Nov 3, 2021 | Use of Hard-Coded Credentials | Zyxel Multiple Products | Critical 9.8 | 90% |
| Nov 3, 2021 | Buffer Overflow | D-Link DIR-825 R1 Devices | Critical 9.8 | 56% |
| Nov 3, 2021 | Memory Initialization | Apple Multiple Products | Medium 5.5 | 17% |
| Nov 3, 2021 | Type Confusion | Apple Multiple Products | High 7.8 | 10% |
| Nov 3, 2021 | Memory Corruption | Apple Multiple Products | High 7.8 | 22% |
| Nov 3, 2021 | Missing Function Level Access Control | NETGEAR JGS516PE Devices | Critical 9.8 | 57% |
| Nov 3, 2021 | Remote Code Execution | Oracle Multiple Products | Critical 9.8 | 97% |
| Nov 3, 2021 | Command Injection | D-Link DNS-320 Device | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | WordPress File Manager Plugin | Critical 10.0 | 97% |
| Nov 3, 2021 | Multiple Products Improper Access Control | Trend Micro Apex One, OfficeScan, and Worry-Free Business Security | High 7.8 | 2.7% |
| Nov 3, 2021 | Remote Code Execution | Apache Struts | Critical 9.8 | 96% |
| Nov 3, 2021 | PHP Module Remote Code Execution | vBulletin vBulletin | Critical 9.8 | 87% |
| Nov 3, 2021 | Remote Code Execution | Microsoft Exchange Server | High 8.4 | 37% |
| Nov 3, 2021 | Kernel Privilege Escalation | Microsoft Windows | High 7.8 | 5.4% |
| Nov 3, 2021 | Shell Injection | SaltStack Salt | Critical 9.8 | 99.6% |
| Nov 3, 2021 | Use-After-Free | Google Chrome | Critical 9.6 | 2.7% |
| Nov 3, 2021 | Incorrect Implementation Vulnerabililty | Google Chromium V8 | High 8.8 | 2.8% |
| Nov 3, 2021 | Heap Buffer Overflow | Google Chrome for Android UI | Critical 9.6 | 6.4% |
| Nov 3, 2021 | Type Confusion | Google Chromium V8 | High 8.8 | 48% |
| Nov 3, 2021 | Heap Buffer Overflow | Google Chrome FreeType | Critical 9.6 | 64% |
| Nov 3, 2021 | Remote Code Execution | Ivanti MobileIron Multiple Products | Critical 9.8 | 99.7% |
| Nov 3, 2021 | Unspecified | Oracle WebLogic Server | High 7.2 | 98% |
| Nov 3, 2021 | Remote Code Execution | Oracle WebLogic Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Unspecified | Oracle Solaris and Zettabyte File System (ZFS) | Critical 10.0 | 80% |
| Nov 3, 2021 | Remote Code Execution | Oracle WebLogic Server | Critical 9.8 | 99.2% |
| Nov 3, 2021 | Privilege Escalation | Microsoft Netlogon | Medium 5.5 | 99.4% |
| Nov 3, 2021 | Spoofing | Microsoft Windows | High 7.8 | 39% |
| Nov 3, 2021 | Scripting Engine Memory Corruption | Microsoft Internet Explorer | High 7.8 | 24% |
Most targeted vendors
- Microsoft 390
- Cisco 102
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.