Library of exploited vulnerabilities
Every software flaw that attackers are known to have used, from the catalogue the US Cybersecurity and Infrastructure Security Agency (CISA) keeps since November 2021. Updated every hour.
- 1,762exploited vulnerabilities
- 361used by ransomware
- 291vendors
1,762 vulnerabilities
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 19, 2025 | Type Confusion | Google Chromium V8 | High 8.8 | 4.9% |
| Nov 18, 2025 | OS Command Injection | Fortinet FortiWeb | Medium 6.7 | 55% |
| Nov 14, 2025 | Path Traversal | Fortinet FortiWeb | Critical 9.4 | 91% |
| Nov 12, 2025 | Out-of-Bounds Write | WatchGuard Firebox | Critical 9.3 | 92% |
| Nov 12, 2025 | Race Condition | Microsoft Windows | High 7.0 | 4.5% |
| Nov 12, 2025 | Improper Access Control | Gladinet Triofox | Critical 9.1 | 96% |
| Nov 10, 2025 | Out-of-Bounds Write | Samsung Mobile Devices | High 8.8 | 36% |
| Nov 4, 2025 | OS Command Injection | CWP Control Web Panel | Critical 9.0 | 99.7% |
| Nov 4, 2025 | Files or Directories Accessible to External Parties | Gladinet CentreStack and Triofox | High 7.5 | 92% |
| Oct 30, 2025 | Privilege Defined with Unsafe Actions | Broadcom VMware Aria Operations and VMware Tools | High 7.8 | 8.6% |
| Oct 30, 2025 | Eval Injection | XWiki Platform | Critical 9.8 | >99.9% |
| Oct 28, 2025 | Missing Authorization | Dassault Systèmes DELMIA Apriso | Critical 9.1 | 74% |
| Oct 28, 2025 | Code Injection | Dassault Systèmes DELMIA Apriso | High 8.0 | 80% |
| Oct 24, 2025 | Server Update Service (WSUS) Deserialization of Untrusted Data | Microsoft Windows | Critical 9.8 | >99.9% |
| Oct 24, 2025 | Improper Input Validation | Adobe Commerce and Magento | Critical 9.1 | 95% |
| Oct 22, 2025 | Improper Verification of Source of a Communication Channel | Motex LANSCOPE Endpoint Manager | Critical 9.3 | 2.8% |
| Oct 20, 2025 | Server-Side Request Forgery (SSRF) | Oracle E-Business Suite | High 7.5 | 96% |
| Oct 20, 2025 | SMB Client Improper Access Control | Microsoft Windows | High 8.8 | 83% |
| Oct 20, 2025 | Authentication Bypass Using an Alternate Path or Channel | Kentico Xperience CMS | Critical 9.8 | 97% |
| Oct 20, 2025 | Authentication Bypass Using an Alternate Path or Channel | Kentico Xperience CMS | Critical 9.8 | 74% |
| Oct 20, 2025 | Unspecified | Apple Multiple Products | High 8.8 | 3.2% |
| Oct 15, 2025 | Experience Manager Forms Code Execution | Adobe Experience Manager (AEM) Forms | Critical 10.0 | 89% |
| Oct 14, 2025 | Improper Access Control | Microsoft Windows | High 7.8 | 2.7% |
| Oct 14, 2025 | OS Use of a Key Past its Expiration Date | IGEL IGEL OS | Medium 4.6 | 4.9% |
| Oct 14, 2025 | Untrusted Pointer Dereference | Microsoft Windows | High 7.8 | 6.4% |
| Oct 14, 2025 | Improper Authentication | SKYSEA Client View | Critical 9.8 | 19% |
| Oct 9, 2025 | Path Traversal | Grafana Labs Grafana | High 7.5 | 89% |
| Oct 7, 2025 | Cross-site Scripting | Synacor Zimbra Collaboration Suite (ZCS) | Medium 5.4 | 4.1% |
| Oct 6, 2025 | Unspecified | Oracle E-Business Suite | Critical 9.8 | 99.7% |
| Oct 6, 2025 | Privilege Escalation | Microsoft Windows | High 7.8 | 3.3% |
| Oct 6, 2025 | Heap Out-of-Bounds Write | Linux Kernel | High 8.3 | 79% |
| Oct 6, 2025 | Out-of-Bounds Write | Microsoft Windows | High 8.8 | 74% |
| Oct 6, 2025 | Remote Code Execution | Microsoft Windows | High 8.8 | 78% |
| Oct 6, 2025 | Uninitialized Memory Corruption | Microsoft Internet Explorer | High 8.1 | 97% |
| Oct 6, 2025 | Remote Code Execution | Mozilla Multiple Products | Critical 9.8 | 83% |
| Oct 2, 2025 | Command Injection | Smartbedded Meteobridge | High 8.7 | 93% |
| Oct 2, 2025 | Out-of-Bounds Write | Samsung Mobile Devices | High 8.8 | 2.2% |
| Oct 2, 2025 | Remote Code Execution | Jenkins Jenkins | Critical 9.8 | 99.7% |
| Oct 2, 2025 | Improper Authentication | Juniper ScreenOS | Critical 9.8 | 61% |
| Oct 2, 2025 | Bash OS Command Injection | GNU GNU Bash | High 8.8 | 99.7% |
| Sep 29, 2025 | Command Injection | Libraesva Email Security Gateway | Medium 6.1 | 1.9% |
| Sep 29, 2025 | Inclusion of Functionality from Untrusted Control Sphere | Sudo Sudo | Critical 9.3 | 55% |
| Sep 29, 2025 | Software SNMP Denial of Service and Remote Code Execution | Cisco IOS and IOS XE | High 7.7 | 42% |
| Sep 29, 2025 | Deserialization of Untrusted Data | Fortra GoAnywhere MFT | Critical 10.0 | 99.8% |
| Sep 29, 2025 | Server-Side Request Forgery | Adminer Adminer | High 7.2 | 98% |
| Sep 25, 2025 | Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Medium 6.5 | 87% |
| Sep 25, 2025 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | Critical 9.9 | 71% |
| Sep 23, 2025 | Type Confusion | Google Chromium V8 | High 8.8 | 9.0% |
| Sep 11, 2025 | Deserialization of Untrusted Data | Dassault Systèmes DELMIA Apriso | Critical 9.0 | 97% |
| Sep 4, 2025 | Deserialization of Untrusted Data | Sitecore Multiple Products | Critical 9.0 | 61% |
Most targeted vendors
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 32
- Citrix 27
- D-Link 26
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.