Exploited vulnerabilities tracker
CISA's catalog of vulnerabilities confirmed as exploited in the wild: 1769 entries, 30 added in the last 30 days, latest on Nov 6, 2026.
1769 matching
| Added | CVE | Vendor / product | Vulnerability | Severity | Exploit odds | Due |
|---|---|---|---|---|---|---|
| Feb 15, 2022 | CVE-2013-3906 | Microsoft · Graphics Component | Microsoft Graphics Component Memory Corruption Vulnerability | High 7.8 | 84.9% | Aug 15, 2022 |
| Feb 11, 2022 | CVE-2022-22620 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability | High 8.8 | 16.3% | Feb 25, 2022 |
| Feb 10, 2022 | CVE-2021-36934 | Microsoft · Windows | Microsoft Windows SAM Local Privilege Escalation Vulnerability | High 7.8 | 67.3% | Feb 24, 2022 |
| Feb 10, 2022 | CVE-2020-0796 Ransomware | Microsoft · SMBv3 | Microsoft SMBv3 Remote Code Execution Vulnerability | Critical 10.0 | 99.8% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2018-1000861 | Jenkins · Jenkins Stapler Web Framework | Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability | Critical 9.8 | 98.3% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2017-9791 | Apache · Struts 1 | Apache Struts 1 Improper Input Validation Vulnerability | Critical 9.8 | 98.9% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2017-8464 | Microsoft · Windows | Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability | High 8.8 | 90.0% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2017-10271 Ransomware | Oracle · WebLogic Server | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | High 7.5 | 100.0% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2017-0263 | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | High 7.8 | 10.0% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2017-0262 | Microsoft · Office | Microsoft Office Remote Code Execution Vulnerability | High 7.8 | 81.0% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2017-0145 Ransomware | Microsoft · SMBv1 | Microsoft SMBv1 Remote Code Execution Vulnerability | High 8.8 | 89.8% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2017-0144 Ransomware | Microsoft · SMBv1 | Microsoft SMBv1 Remote Code Execution Vulnerability | High 8.8 | 99.2% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2016-3088 | Apache · ActiveMQ | Apache ActiveMQ Improper Input Validation Vulnerability | Critical 9.8 | 98.4% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2015-2051 | D-Link · DIR-645 Router | D-Link DIR-645 Router Remote Code Execution Vulnerability | High 8.8 | 97.1% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2015-1635 | Microsoft · HTTP.sys | Microsoft HTTP.sys Remote Code Execution Vulnerability | Critical 9.8 | 100.0% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2015-1130 | Apple · OS X | Apple OS X Authentication Bypass Vulnerability | High 7.8 | 9.9% | Aug 10, 2022 |
| Feb 10, 2022 | CVE-2014-4404 | Apple · OS X | Apple OS X Heap-Based Buffer Overflow Vulnerability | High 7.8 | 48.9% | Aug 10, 2022 |
| Feb 4, 2022 | CVE-2022-21882 Ransomware | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | High 7.0 | 59.2% | Feb 18, 2022 |
| Jan 28, 2022 | CVE-2022-22587 | Apple · iOS and macOS | Apple Memory Corruption Vulnerability | Critical 9.8 | 11.6% | Feb 11, 2022 |
| Jan 28, 2022 | CVE-2021-20038 Ransomware | SonicWall · SMA 100 Appliances | SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability | Critical 9.8 | 99.9% | Feb 11, 2022 |
| Jan 28, 2022 | CVE-2020-5722 | Grandstream · UCM6200 | Grandstream Networks UCM6200 Series SQL Injection Vulnerability | Critical 9.8 | 84.3% | Jul 28, 2022 |
| Jan 28, 2022 | CVE-2020-0787 Ransomware | Microsoft · Windows | Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability | High 7.8 | 42.5% | Jul 28, 2022 |
| Jan 28, 2022 | CVE-2017-5689 | Intel · Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability | Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability | Critical 9.8 | 92.2% | Jul 28, 2022 |
| Jan 28, 2022 | CVE-2014-7169 | GNU · Bourne-Again Shell (Bash) | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | Critical 9.8 | 99.9% | Jul 28, 2022 |
| Jan 28, 2022 | CVE-2014-6271 | GNU · Bourne-Again Shell (Bash) | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | Critical 9.8 | 100.0% | Jul 28, 2022 |
| Jan 28, 2022 | CVE-2014-1776 | Microsoft · Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Critical 9.8 | 82.7% | Jul 28, 2022 |
| Jan 21, 2022 | CVE-2021-35247 | SolarWinds · Serv-U | SolarWinds Serv-U Improper Input Validation Vulnerability | Medium 4.3 | 3.6% | Feb 4, 2022 |
| Jan 21, 2022 | CVE-2018-8453 Ransomware | Microsoft · Win32k | Microsoft Win32k Privilege Escalation Vulnerability | High 7.8 | 70.0% | Jul 21, 2022 |
| Jan 21, 2022 | CVE-2012-0391 | Apache · Struts 2 | Apache Struts 2 Improper Input Validation Vulnerability | Critical 9.8 | 75.6% | Jul 21, 2022 |
| Jan 21, 2022 | CVE-2006-1547 | Apache · Struts 1 | Apache Struts 1 ActionForm Denial-of-Service Vulnerability | High 7.5 | 54.6% | Jul 21, 2022 |
| Jan 18, 2022 | CVE-2021-40870 | Aviatrix · Aviatrix Controller | Aviatrix Controller Unrestricted Upload of File | Critical 9.8 | 93.0% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2021-33766 | Microsoft · Exchange Server | Microsoft Exchange Server Information Disclosure | High 7.3 | 98.2% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2021-32648 | October CMS · October CMS | October CMS Improper Authentication | High 8.2 | 91.1% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2021-25298 | Nagios · Nagios XI | Nagios XI OS Command Injection | High 8.8 | 73.6% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2021-25297 | Nagios · Nagios XI | Nagios XI OS Command Injection | High 8.8 | 56.7% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2021-25296 | Nagios · Nagios XI | Nagios XI OS Command Injection | High 8.8 | 71.9% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2021-22991 | F5 · BIG-IP Traffic Management Microkernel | F5 BIG-IP Traffic Management Microkernel Buffer Overflow | Critical 9.8 | 62.4% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2021-21975 Ransomware | VMware · vRealize Operations Manager API | VMware Server Side Request Forgery in vRealize Operations Manager API | Critical 9.8 | 78.0% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2021-21315 | Npm package · System Information Library for Node.JS | System Information Library for Node.JS Command Injection | High 7.1 | 90.7% | Feb 1, 2022 |
| Jan 18, 2022 | CVE-2020-14864 | Oracle · Intelligence Enterprise Edition | Oracle Business Intelligence Enterprise Edition Path Transversal | High 7.5 | 97.2% | Jul 18, 2022 |
| Jan 18, 2022 | CVE-2020-13927 | Apache · Airflow's Experimental API | Apache Airflow's Experimental API Authentication Bypass | Critical 9.8 | 99.8% | Jul 18, 2022 |
| Jan 18, 2022 | CVE-2020-13671 | Drupal · Drupal core | Drupal core Un-restricted Upload of File | High 8.8 | 36.2% | Jul 18, 2022 |
| Jan 18, 2022 | CVE-2020-11978 | Apache · Airflow | Apache Airflow Command Injection | High 8.8 | 99.2% | Jul 18, 2022 |
| Jan 10, 2022 | CVE-2021-36260 | Hikvision · Security cameras web server | Hikvision Improper Input Validation | Critical 9.8 | 99.9% | Jan 24, 2022 |
| Jan 10, 2022 | CVE-2021-27860 | FatPipe · WARP, IPVPN, and MPVPN software | FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit | Critical 9.8 | 39.7% | Jan 24, 2022 |
| Jan 10, 2022 | CVE-2021-22017 | VMware · vCenter Server | VMware vCenter Server Improper Access Control | Medium 5.3 | 49.2% | Jan 24, 2022 |
| Jan 10, 2022 | CVE-2020-6572 | Google · Chrome Media | Google Chrome Media Use-After-Free Vulnerability | High 8.8 | 10.6% | Jul 10, 2022 |
| Jan 10, 2022 | CVE-2019-9670 | Synacor · Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | Critical 9.8 | 100.0% | Jul 10, 2022 |
| Jan 10, 2022 | CVE-2019-7609 | Elastic · Kibana | Kibana Arbitrary Code Execution | Critical 9.8 | 95.3% | Jul 10, 2022 |
| Jan 10, 2022 | CVE-2019-2725 Ransomware | Oracle · WebLogic Server | Oracle WebLogic Server, Injection | High 7.5 | 100.0% | Jul 10, 2022 |