Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2016-6415 | Cisco | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability | Severity: High CVSS 7.5 | May 19, 2023 | Not known |
| CVE-2004-1464 | Cisco | Cisco IOS Denial-of-Service Vulnerability | Severity: Elevated CVSS 5.9 | May 19, 2023 | Not known |
| CVE-2023-21492 | Samsung | Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability | Severity: Elevated CVSS 4.4 | May 19, 2023 | Not known |
| CVE-2016-3427 | Oracle | Oracle Java SE and JRockit Unspecified Vulnerability | Severity: Critical CVSS 9.8 | May 12, 2023 | Not known |
| CVE-2016-8735 | Apache | Apache Tomcat Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | May 12, 2023 | Not known |
| CVE-2023-25717 | Ruckus Wireless | Multiple Ruckus Wireless Products CSRF and RCE Vulnerability | Severity: Critical CVSS 9.8 | May 12, 2023 | Not known |
| CVE-2010-3904 | Linux | Linux Kernel Improper Input Validation Vulnerability | Severity: High CVSS 7.8 | May 12, 2023 | Not known |
| CVE-2021-3560 | Red Hat | Red Hat Polkit Incorrect Authorization Vulnerability | Severity: High CVSS 7.8 | May 12, 2023 | Not known |
| CVE-2015-5317 | Jenkins | Jenkins User Interface (UI) Information Disclosure Vulnerability | Severity: High CVSS 7.5 | May 12, 2023 | Not known |
| CVE-2014-0196 | Linux | Linux Kernel Race Condition Vulnerability | Severity: Elevated CVSS 5.5 | May 12, 2023 | Not known |
| CVE-2023-29336 | Microsoft | Microsoft Win32K Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | May 9, 2023 | Not known |
| CVE-2021-45046 | Apache | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.0 | May 1, 2023 | Known |
| CVE-2023-1389 | TP-Link | TP-Link Archer AX-21 Command Injection Vulnerability | Severity: High CVSS 8.8 | May 1, 2023 | Not known |
| CVE-2023-21839 | Oracle | Oracle WebLogic Server Unspecified Vulnerability | Severity: High CVSS 7.5 | May 1, 2023 | Not known |
| CVE-2023-27350 | PaperCut | PaperCut MF/NG Improper Access Control Vulnerability | Severity: Critical CVSS 9.8 | Apr 21, 2023 | Known |
| CVE-2023-2136 | Google Chrome Skia Integer Overflow Vulnerability | Severity: Critical CVSS 9.6 | Apr 21, 2023 | Not known | |
| CVE-2023-28432 | MinIO | MinIO Information Disclosure Vulnerability | Severity: High CVSS 7.5 | Apr 21, 2023 | Not known |
| CVE-2017-6742 | Cisco | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Apr 19, 2023 | Not known |
| CVE-2023-2033 | Google Chromium V8 Type Confusion Vulnerability | Severity: High CVSS 8.8 | Apr 17, 2023 | Not known | |
| CVE-2019-8526 | Apple | Apple macOS Use-After-Free Vulnerability | Severity: High CVSS 7.8 | Apr 17, 2023 | Not known |
| CVE-2023-29492 | Novi Survey | Novi Survey Insecure Deserialization Vulnerability | Severity: Critical CVSS 9.8 | Apr 13, 2023 | Not known |
| CVE-2023-20963 | Android | Android Framework Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Apr 13, 2023 | Not known |
| CVE-2023-28252 | Microsoft | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Apr 11, 2023 | Known |
| CVE-2023-28205 | Apple | Apple Multiple Products WebKit Use-After-Free Vulnerability | Severity: High CVSS 8.8 | Apr 10, 2023 | Not known |
| CVE-2023-28206 | Apple | Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability | Severity: High CVSS 8.6 | Apr 10, 2023 | Not known |
| CVE-2021-27877 | Veritas | Veritas Backup Exec Agent Improper Authentication Vulnerability | Severity: Critical CVSS 9.8 | Apr 7, 2023 | Known |
| CVE-2021-27878 | Veritas | Veritas Backup Exec Agent Command Execution Vulnerability | Severity: High CVSS 8.8 | Apr 7, 2023 | Known |
| CVE-2021-27876 | Veritas | Veritas Backup Exec Agent File Access Vulnerability | Severity: High CVSS 8.1 | Apr 7, 2023 | Known |
| CVE-2019-1388 | Microsoft | Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Apr 7, 2023 | Known |
| CVE-2023-26083 | Arm | Arm Mali GPU Kernel Driver Information Disclosure Vulnerability | Severity: Informational CVSS 3.3 | Apr 7, 2023 | Not known |
| CVE-2022-27926 | Synacor | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Severity: Elevated CVSS 6.1 | Apr 3, 2023 | Not known |
| CVE-2017-7494 | Samba | Samba Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 30, 2023 | Known |
| CVE-2022-42948 | Fortra | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 30, 2023 | Not known |
| CVE-2013-3163 | Microsoft | Microsoft Internet Explorer Memory Corruption Vulnerability | Severity: High CVSS 8.8 | Mar 30, 2023 | Not known |
| CVE-2022-3038 | Google Chromium Network Service Use-After-Free Vulnerability | Severity: High CVSS 8.8 | Mar 30, 2023 | Not known | |
| CVE-2022-38181 | Arm | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | Severity: High CVSS 8.8 | Mar 30, 2023 | Not known |
| CVE-2021-30900 | Apple | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | Severity: High CVSS 7.8 | Mar 30, 2023 | Not known |
| CVE-2022-22706 | Arm | Arm Mali GPU Kernel Driver Unspecified Vulnerability | Severity: High CVSS 7.8 | Mar 30, 2023 | Not known |
| CVE-2023-0266 | Linux | Linux Kernel Use-After-Free Vulnerability | Severity: High CVSS 7.0 | Mar 30, 2023 | Not known |
| CVE-2022-39197 | Fortra | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | Severity: Elevated CVSS 6.1 | Mar 30, 2023 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.