Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,764exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,764 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | DNS Server Remote Code Execution | Microsoft Windows | Critical 10.0 | 97% |
| Nov 3, 2021 | SSL VPN Improper Authentication | Fortinet FortiOS | High 7.5 | 45% |
| Nov 3, 2021 | SQL Injection | Sophos SFOS | Critical 10.0 | 42% |
| Nov 3, 2021 | File Download | WordPress Snap Creek Duplicator Plugin | High 7.5 | 98% |
| Nov 3, 2021 | Path Traversal | SaltStack Salt | Medium 6.5 | 86% |
| Nov 3, 2021 | Authentication Bypass | SaltStack Salt | Critical 9.8 | 97% |
| Nov 3, 2021 | .NET Framework, SharePoint, and Visual Studio Remote Code Execution | Microsoft .NET Framework, SharePoint, Visual Studio | High 7.8 | 96% |
| Nov 3, 2021 | Remote Code Execution | Tenda AC1900 Router AC15 Model | Critical 9.8 | 80% |
| Nov 3, 2021 | Privilege Escalation | Microsoft Win32k | High 7.0 | 54% |
| Nov 3, 2021 | vGPU Remote Code Execution | Microsoft Hyper-V RemoteFX | Critical 9.0 | 7.4% |
| Nov 3, 2021 | OS Command Injection | rConfig rConfig | High 8.8 | 77% |
| Nov 3, 2021 | Adobe Font Manager Library Remote Code Execution | Microsoft Windows | High 8.8 | 65% |
| Nov 3, 2021 | Remote Code Execution | Sonatype Nexus Repository | High 8.8 | 99.1% |
| Nov 3, 2021 | Desktop Central File Upload | Zoho ManageEngine | Critical 9.8 | 99.9% |
| Nov 3, 2021 | EMR Cross-Site Request Forgery (CSRF) | Sumavision Enhanced Multimedia Router (EMR) | Critical 9.8 | 15% |
| Nov 3, 2021 | Authentication Bypass | SolarWinds Orion | Critical 9.8 | 92% |
| Nov 3, 2021 | Kernel Privilege Escalation | Microsoft Windows | High 7.8 | 16% |
| Nov 3, 2021 | Scripting Engine Memory Corruption | Microsoft Internet Explorer | High 7.5 | 31% |
| Nov 3, 2021 | Adobe Font Manager Library Remote Code Execution | Microsoft Windows | High 7.8 | 69% |
| Nov 3, 2021 | Memory Corruption | Microsoft Edge and Internet Explorer | Medium 4.2 | 2.7% |
| Nov 3, 2021 | Validation Key Remote Code Execution | Microsoft Exchange Server | High 8.8 | >99.9% |
| Nov 3, 2021 | Installer Privilege Escalation | Microsoft Windows | High 7.8 | 7.6% |
| Nov 3, 2021 | Scripting Engine Memory Corruption | Microsoft Internet Explorer | High 7.5 | 87% |
| Nov 3, 2021 | Remote Code Execution | Microsoft .NET Framework | Critical 9.8 | 99.2% |
| Nov 3, 2021 | CryptoAPI Spoofing | Microsoft Windows | High 8.1 | 89% |
| Nov 3, 2021 | Insufficient Input Validation | MediaTek Multiple Chipsets | High 7.8 | 1.4% |
| Nov 3, 2021 | Kernel Out-of-Bounds Write | Android Android Kernel | High 7.8 | 3.2% |
| Nov 3, 2021 | Cross-Site Scripting (XSS) | WordPress Social Warfare Plugin | Medium 6.1 | 73% |
| Nov 3, 2021 | Remote Code Execution | ThinkPHP ThinkPHP | High 8.8 | 97% |
| Nov 3, 2021 | ServiceDesk Plus (SDP) File Upload | Zoho ManageEngine | High 7.5 | 63% |
| Nov 3, 2021 | SQL Injection | SonicWall SMA100 | High 7.5 | 99.9% |
| Nov 3, 2021 | Group Facetime | Apple iOS and macOS | High 7.5 | 2.6% |
| Nov 3, 2021 | Default Configuration | Fortinet FortiOS | Medium 6.5 | 19% |
| Nov 3, 2021 | ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow | VMware VMware ESXi and Horizon DaaS | Critical 9.8 | 98% |
| Nov 3, 2021 | Remote Code Execution | IBM Planning Analytics | Critical 10.0 | 86% |
| Nov 3, 2021 | Path Traversal | Atlassian Confluence Server and Data Center | High 8.8 | 97% |
| Nov 3, 2021 | Confluence Server and Data Center Server-Side Template Injection | Atlassian Confluence Server and Data Server | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Kernel Use-After-Free | Android Android Kernel | High 7.8 | 72% |
| Nov 3, 2021 | Directory Traversal | TVT NVMS-1000 | High 7.5 | 96% |
| Nov 3, 2021 | ADC, Gateway, and SD-WAN WANOP Appliance Code Execution | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | Netis WF2419 Devices | High 7.5 | 28% |
| Nov 3, 2021 | Bypass Remote Login | TeamViewer Desktop | High 7.0 | 4.7% |
| Nov 3, 2021 | Deserialization of Untrusted Data | Progress Telerik UI for ASP.NET AJAX | Critical 9.8 | 99.7% |
| Nov 3, 2021 | Directory Traversal | Trend Micro OfficeScan | High 8.8 | 25% |
| Nov 3, 2021 | VelocityResponseWriter Plug-In Remote Code Execution | Apache Solr | High 7.5 | 99% |
| Nov 3, 2021 | Type Confusion | Mozilla Firefox and Thunderbird | High 8.8 | 46% |
| Nov 3, 2021 | PHP Module Remote Code Execution | vBulletin vBulletin | Critical 9.8 | 99.7% |
| Nov 3, 2021 | Information Disclosure | Cisco Small Business RV320 and RV325 Routers | High 7.5 | 99.9% |
| Nov 3, 2021 | Command Injection | SIMalliance Toolbox Browser | Critical 9.8 | 4.9% |
| Nov 3, 2021 | XI Remote Code Execution | Nagios Nagios XI | High 8.8 | 77% |
Most targeted vendors
- Microsoft 390
- Cisco 102
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Linux 32
- Fortinet 32
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.