Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,760exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,760 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 10, 2026 | Word Reliance on Untrusted Inputs in a Security Decision | Microsoft Office | High 7.8 | 1.6% |
| Feb 10, 2026 | MSHTML Framework Protection Mechanism Failure | Microsoft Windows | High 8.8 | 16% |
| Feb 10, 2026 | Shell Protection Mechanism Failure | Microsoft Windows | High 8.8 | 61% |
| Feb 5, 2026 | Missing Authentication for Critical Function | SmarterTools SmarterMail | Critical 9.3 | 88% |
| Feb 5, 2026 | OS Command Injection | React Native Community CLI | Critical 9.8 | 94% |
| Feb 3, 2026 | FreePBX OS Command Injection | Sangoma FreePBX | High 8.6 | 85% |
| Feb 3, 2026 | Deserialization of Untrusted Data | SolarWinds Web Help Desk | Critical 9.8 | 84% |
| Feb 3, 2026 | Server-Side Request Forgery (SSRF) | GitLab Community and Enterprise Editions | Medium 6.8 | 36% |
| Feb 3, 2026 | Sangoma FreePBX Improper Authentication | Sangoma FreePBX | Critical 9.8 | 56% |
| Jan 29, 2026 | Code Injection | Ivanti Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
| Jan 27, 2026 | Authentication Bypass Using an Alternate Path or Channel | Fortinet Multiple Products | Critical 9.4 | 87% |
| Jan 26, 2026 | Argument Injection | GNU InetUtils | Critical 9.8 | 99% |
| Jan 26, 2026 | Authentication Bypass Using an Alternate Path or Channel | SmarterTools SmarterMail | Critical 9.3 | 96% |
| Jan 26, 2026 | Security Feature Bypass | Microsoft Office | High 7.8 | 71% |
| Jan 26, 2026 | Unrestricted Upload of File with Dangerous Type | SmarterTools SmarterMail | Critical 10.0 | 86% |
| Jan 26, 2026 | Integer Overflow | Linux Kernel | High 7.8 | 15% |
| Jan 23, 2026 | Out-of-bounds Write | Broadcom VMware vCenter Server | Critical 9.8 | 22% |
| Jan 22, 2026 | Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion | Synacor Zimbra Collaboration Suite (ZCS) | High 8.8 | 49% |
| Jan 22, 2026 | Embedded Malicious Code | Prettier eslint-config-prettier | High 7.5 | 5.1% |
| Jan 22, 2026 | Improper Authentication | Versa Concerto | Critical 9.2 | 82% |
| Jan 22, 2026 | Improper Access Control | Vite Vitejs | Medium 5.3 | 66% |
| Jan 21, 2026 | Unified Communications Products Code Injection | Cisco Unified Communications Manager | High 8.2 | 4.5% |
| Jan 13, 2026 | Information Disclosure | Microsoft Windows | Medium 5.5 | 7.5% |
| Jan 12, 2026 | Path Traversal | Gogs Gogs | High 8.7 | 85% |
| Jan 7, 2026 | Code Injection | Hewlett Packard Enterprise (HPE) OneView | Critical 10.0 | 90% |
| Jan 7, 2026 | PowerPoint Code Injection | Microsoft Office | High 8.8 | 67% |
| Dec 29, 2025 | and MongoDB Server Improper Handling of Length Parameter Inconsistency | MongoDB MongoDB and MongoDB Server | High 8.7 | 83% |
| Dec 22, 2025 | Missing Authorization | Digiever DS-2105 Pro | High 8.8 | 97% |
| Dec 19, 2025 | Out of Bounds Write | WatchGuard Firebox | Critical 9.3 | 29% |
| Dec 17, 2025 | Embedded Malicious Code | ASUS Live Update | Critical 9.3 | 1.2% |
| Dec 17, 2025 | SMA1000 Missing Authorization | SonicWall SMA1000 appliance | Medium 6.6 | 2.8% |
| Dec 17, 2025 | Improper Input Validation | Cisco Multiple Products | Critical 10.0 | 32% |
| Dec 16, 2025 | Improper Verification of Cryptographic Signature | Fortinet Multiple Products | Critical 9.1 | 68% |
| Dec 15, 2025 | Use-After-Free WebKit | Apple Multiple Products | High 8.8 | 26% |
| Dec 15, 2025 | Hard Coded Cryptographic | Gladinet CentreStack and Triofox | High 7.1 | 53% |
| Dec 12, 2025 | Out of Bounds Memory Access | Google Chromium | High 8.8 | 55% |
| Dec 12, 2025 | Unrestricted Upload of File with Dangerous Type | Sierra Wireless AirLink ALEOS | High 8.8 | 27% |
| Dec 11, 2025 | Improper Restriction of XML External Entity Reference | OSGeo GeoServer | High 8.2 | 61% |
| Dec 9, 2025 | Use After Free | Microsoft Windows | High 7.8 | 2.5% |
| Dec 9, 2025 | Path Traversal | RARLAB WinRAR | High 7.8 | 90% |
| Dec 8, 2025 | Array Networks ArrayOS AG OS Command Injection | Array Networks ArrayOS AG | High 7.2 | 3.4% |
| Dec 8, 2025 | Buffer Overflow | D-Link Routers | Critical 9.8 | 56% |
| Dec 5, 2025 | Remote Code Execution | Meta React Server Components | Critical 10.0 | 99.8% |
| Dec 3, 2025 | Unrestricted Upload of File with Dangerous Type | OpenPLC ScadaBR | High 8.8 | 39% |
| Dec 2, 2025 | Information Disclosure | Android Framework | Medium 5.5 | 0.3% |
| Dec 2, 2025 | Privilege Escalation | Android Framework | High 7.8 | 0.3% |
| Nov 28, 2025 | Cross-site Scripting | OpenPLC ScadaBR | Medium 5.4 | 48% |
| Nov 21, 2025 | Missing Authentication for Critical Function | Oracle Fusion Middleware | Critical 9.8 | 89% |
| Nov 19, 2025 | Type Confusion | Google Chromium V8 | High 8.8 | 4.9% |
| Nov 18, 2025 | OS Command Injection | Fortinet FortiWeb | Medium 6.7 | 55% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 31
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.