Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,760exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,760 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 13, 2026 | Visual Basic for Applications Insecure Library Loading | Microsoft Visual Basic for Applications (VBA) | High 7.8 | 21% |
| Apr 8, 2026 | Code Injection | Ivanti Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
| Apr 6, 2026 | Improper Access Control | Fortinet FortiClient EMS | Critical 9.1 | 94% |
| Apr 2, 2026 | Download of Code Without Integrity Check | TrueConf Client | High 7.8 | 5.6% |
| Apr 1, 2026 | Use-After-Free | Google Dawn | High 8.8 | 14% |
| Mar 30, 2026 | Out-of-Bounds Read | Citrix NetScaler | Critical 9.3 | 91% |
| Mar 27, 2026 | Stack-Based Buffer Overflow | F5 BIG-IP | Critical 9.3 | 2.3% |
| Mar 26, 2026 | Embedded Malicious Code | Aquasecurity Trivy | Critical 9.4 | 60% |
| Mar 25, 2026 | Code Injection | Langflow Langflow | Critical 9.3 | 96% |
| Mar 20, 2026 | Code Injection | Laravel Livewire | Critical 9.2 | 96% |
| Mar 20, 2026 | Classic Buffer Overflow | Apple Multiple Products | Medium 5.5 | 0.4% |
| Mar 20, 2026 | Improper Locking | Apple Multiple Products | High 7.8 | 0.4% |
| Mar 20, 2026 | Code Injection | Craft CMS Craft CMS | Critical 10.0 | 99.8% |
| Mar 20, 2026 | Buffer Overflow | Apple Multiple Products | High 8.8 | 1.7% |
| Mar 19, 2026 | Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data | Cisco Secure Firewall Management Center (FMC) | Critical 10.0 | 43% |
| Mar 18, 2026 | Deserialization of Untrusted Data | Microsoft SharePoint | Critical 9.8 | 29% |
| Mar 18, 2026 | Cross-Site Scripting | Synacor Zimbra Collaboration Suite (ZCS) | High 7.2 | 20% |
| Mar 16, 2026 | Information Disclosure | Wing FTP Server Wing FTP Server | Medium 4.3 | 63% |
| Mar 13, 2026 | Improper Restriction of Operations Within the Bounds of a Memory Buffer | Google Chromium V8 | High 8.8 | 2.7% |
| Mar 13, 2026 | Out-of-Bounds Write | Google Skia | High 8.8 | 2.3% |
| Mar 11, 2026 | Improper Control of Dynamically-Managed Code Resources | n8n n8n | Critical 10.0 | 99% |
| Mar 9, 2026 | Endpoint Manager (EPM) Authentication Bypass | Ivanti Endpoint Manager (EPM) | High 8.6 | 88% |
| Mar 9, 2026 | Deserialization of Untrusted Data | SolarWinds Web Help Desk | Critical 9.8 | 90% |
| Mar 9, 2026 | Workspace ONE Server-Side Request Forgery | Omnissa Workspace One UEM | High 7.5 | 99.7% |
| Mar 5, 2026 | Use-After-Free | Apple Multiple Products | High 8.8 | 4.0% |
| Mar 5, 2026 | Use-After-Free | Apple iOS and iPadOS | High 7.8 | 2.0% |
| Mar 5, 2026 | Integer Overflow or Wraparound | Apple Multiple Products | High 8.8 | 7.0% |
| Mar 5, 2026 | Insufficient Protected Credentials | Rockwell Multiple Products | Critical 9.8 | 64% |
| Mar 5, 2026 | Improper Authentication | Hikvision Multiple Products | Critical 9.8 | >99.9% |
| Mar 3, 2026 | Command Injection | Broadcom VMware Aria Operations | High 8.1 | 18% |
| Mar 3, 2026 | Memory Corruption | Qualcomm Multiple Chipsets | High 7.8 | 1.3% |
| Feb 25, 2026 | Authentication Bypass | Cisco Catalyst SD-WAN Controller and Manager | Critical 10.0 | 89% |
| Feb 25, 2026 | Path Traversal | Cisco SD-WAN | High 7.8 | 12% |
| Feb 24, 2026 | OS Command Injection | Soliton Systems K.K FileZen | High 8.7 | 5.2% |
| Feb 20, 2026 | Cross-site Scripting | Roundcube Webmail | High 7.2 | 27% |
| Feb 20, 2026 | Deserialization of Untrusted Data | Roundcube Webmail | Critical 9.9 | 99.7% |
| Feb 18, 2026 | Use of Hard-coded Credentials | Dell RecoverPoint for Virtual Machines (RP4VMs) | Critical 10.0 | 14% |
| Feb 18, 2026 | Server-Side Request Forgery (SSRF) | GitLab GitLab | Medium 6.8 | 53% |
| Feb 17, 2026 | CSS Use-After-Free | Google Chromium | High 8.8 | 55% |
| Feb 17, 2026 | Unrestricted Upload of File with Dangerous Type | TeamT5 ThreatSonar Anti-Ransomware | High 7.2 | 1.8% |
| Feb 17, 2026 | (ZCS) Server-Side Request Forgery | Synacor Zimbra Collaboration Suite | Critical 9.8 | 94% |
| Feb 17, 2026 | Microsoft Windows Video ActiveX Control Remote Code Execution | Microsoft Windows | High 8.8 | 77% |
| Feb 13, 2026 | OS Command Injection | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | Critical 9.9 | 93% |
| Feb 12, 2026 | Multiple Buffer Overflow | Apple Multiple Products | High 7.8 | 1.7% |
| Feb 12, 2026 | Security Control Bypass | SolarWinds Web Help Desk | High 8.1 | 74% |
| Feb 12, 2026 | Download of Code Without Integrity Check | Notepad++ Notepad++ | High 7.7 | 1.8% |
| Feb 12, 2026 | SQL Injection | Microsoft Configuration Manager | Critical 9.8 | 81% |
| Feb 10, 2026 | Improper Privilege Management | Microsoft Windows | High 7.8 | 4.1% |
| Feb 10, 2026 | NULL Pointer Dereference | Microsoft Windows | Medium 6.2 | 4.9% |
| Feb 10, 2026 | Type Confusion | Microsoft Windows | High 7.8 | 2.5% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 31
- Citrix 27
- VMware 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.