Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,758exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,758 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 1, 2026 | Unspecified | Oracle WebLogic Server | High 7.5 | 74% |
| May 29, 2026 | Authentication Bypass | Palo Alto Networks PAN-OS | High 7.8 | 95% |
| May 27, 2026 | Tools Lite Embedded Malicious Code | Daemon Daemon Tools Lite | Critical 9.3 | 1.5% |
| May 27, 2026 | Console Embedded Malicious Code | Nx Nx Console | Critical 9.3 | 1.8% |
| May 27, 2026 | Unspecified | TanStack TanStack | Critical 9.6 | 3.3% |
| May 26, 2026 | Privilege Escalation | LiteSpeed cPanel Plugin | Critical 10.0 | 18% |
| May 22, 2026 | SQL Injection | Drupal Core | Critical 9.8 | 89% |
| May 21, 2026 | (On-Premise) Directory Traversal | Trend Micro Apex One | Medium 6.7 | 13% |
| May 21, 2026 | Origin Validation Error | Langflow Langflow | Critical 9.4 | 93% |
| May 20, 2026 | Denial of Service | Microsoft Defender | Medium 4.0 | 63% |
| May 20, 2026 | Link Following | Microsoft Defender | High 7.8 | 8.2% |
| May 20, 2026 | Use-After-Free | Microsoft Internet Explorer | High 8.8 | 82% |
| May 20, 2026 | Use-After-Free | Microsoft Internet Explorer | High 8.8 | 92% |
| May 20, 2026 | Heap-Based Buffer Overflow | Adobe Acrobat and Reader | High 8.8 | 87% |
| May 20, 2026 | NULL Byte Overwrite | Microsoft DirectX | High 8.8 | 51% |
| May 20, 2026 | Buffer Overflow | Microsoft Windows | Critical 9.8 | 99% |
| May 15, 2026 | Exchange Server Cross-Site Scripting | Microsoft Microsoft | High 8.1 | 71% |
| May 14, 2026 | Controller Authentication Bypass | Cisco Catalyst SD-WAN | Critical 10.0 | 92% |
| May 8, 2026 | SQL Injection | BerriAI LiteLLM | Critical 9.3 | 89% |
| May 7, 2026 | Improper Input Validation | Ivanti Endpoint Manager Mobile (EPMM) | High 7.2 | 34% |
| May 6, 2026 | Out-of-bounds Write | Palo Alto Networks PAN-OS | Critical 9.3 | 42% |
| May 1, 2026 | Incorrect Resource Transfer Between Spheres | Linux Kernel | High 7.8 | 98% |
| Apr 30, 2026 | Missing Authentication for Critical Function | WebPros cPanel & WHM and WP2 (WordPress Squared) | Critical 9.3 | 99% |
| Apr 28, 2026 | Protection Mechanism Failure | Microsoft Windows | Medium 4.3 | 71% |
| Apr 28, 2026 | Path Traversal | ConnectWise ScreenConnect | High 8.4 | 95% |
| Apr 24, 2026 | Command Injection | D-Link DIR-823X | High 7.2 | 88% |
| Apr 24, 2026 | Path Traversal | Samsung MagicINFO 9 Server | High 8.8 | 92% |
| Apr 24, 2026 | Path Traversal | SimpleHelp SimpleHelp | High 7.2 | 64% |
| Apr 24, 2026 | Missing Authorization | SimpleHelp SimpleHelp | Critical 9.9 | 66% |
| Apr 23, 2026 | Remote Code Execution | Marimo Marimo | Critical 9.3 | 99.6% |
| Apr 22, 2026 | Insufficient Granularity of Access Control | Microsoft Defender | High 7.8 | 6.7% |
| Apr 20, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | Cisco Catalyst SD-WAN Manager | Medium 6.5 | 31% |
| Apr 20, 2026 | Storing Passwords in a Recoverable Format | Cisco Catalyst SD-WAN Manager | High 7.5 | 7.3% |
| Apr 20, 2026 | Catalyst SD-WAN Manager Incorrect Use of Privileged APIs | Cisco Catalyst SD-WAN Manger | Medium 5.4 | 26% |
| Apr 20, 2026 | Cross-site Scripting | Synacor Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 1.7% |
| Apr 20, 2026 | Improper Authentication | Quest KACE Systems Management Appliance (SMA) | Critical 10.0 | 2.5% |
| Apr 20, 2026 | Xperience Path Traversal | Kentico Kentico Xperience | High 7.2 | 4.0% |
| Apr 20, 2026 | Relative Path Traversal | JetBrains TeamCity | High 7.3 | >99.9% |
| Apr 20, 2026 | Improper Authentication | PaperCut NG/MF | High 8.2 | 78% |
| Apr 16, 2026 | Improper Input Validation | Apache ActiveMQ | High 8.8 | 98% |
| Apr 14, 2026 | Improper Input Validation | Microsoft SharePoint Server | Medium 6.5 | 43% |
| Apr 14, 2026 | Remote Code Execution | Microsoft Office | High 8.8 | 43% |
| Apr 13, 2026 | Prototype Pollution | Adobe Acrobat and Reader | High 8.6 | 7.2% |
| Apr 13, 2026 | SQL Injection | Fortinet FortiClient EMS | Critical 9.1 | 98% |
| Apr 13, 2026 | Link Following | Microsoft Windows | High 7.8 | 4.6% |
| Apr 13, 2026 | Out-of-Bounds Read | Microsoft Windows | High 7.8 | 12% |
| Apr 13, 2026 | Deserialization of Untrusted Data | Microsoft Exchange Server | High 8.8 | 59% |
| Apr 13, 2026 | Use-After-Free | Adobe Acrobat | High 7.8 | 33% |
| Apr 13, 2026 | Visual Basic for Applications Insecure Library Loading | Microsoft Visual Basic for Applications (VBA) | High 7.8 | 21% |
| Apr 8, 2026 | Code Injection | Ivanti Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 82
- Google 75
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 31
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.