Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2023-26360 | Adobe | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Severity: High CVSS 8.6 | Mar 15, 2023 | Not known |
| CVE-2023-23397 | Microsoft | Microsoft Office Outlook Privilege Escalation Vulnerability | Severity: Critical CVSS 9.8 | Mar 14, 2023 | Not known |
| CVE-2022-41328 | Fortinet | Fortinet FortiOS Path Traversal Vulnerability | Severity: High CVSS 7.1 | Mar 14, 2023 | Not known |
| CVE-2023-24880 | Microsoft | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Severity: Elevated CVSS 4.4 | Mar 14, 2023 | Known |
| CVE-2021-39144 | XStream | XStream Remote Code Execution Vulnerability | Severity: High CVSS 8.5 | Mar 10, 2023 | Not known |
| CVE-2020-5741 | Plex | Plex Media Server Remote Code Execution Vulnerability | Severity: High CVSS 7.2 | Mar 10, 2023 | Not known |
| CVE-2022-35914 | Teclib | Teclib GLPI Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 7, 2023 | Not known |
| CVE-2022-33891 | Apache | Apache Spark Command Injection Vulnerability | Severity: High CVSS 8.8 | Mar 7, 2023 | Not known |
| CVE-2022-28810 | Zoho | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | Severity: Elevated CVSS 6.8 | Mar 7, 2023 | Not known |
| CVE-2022-36537 | ZK Framework | ZK Framework AuUploader Unspecified Vulnerability | Severity: High CVSS 7.5 | Feb 27, 2023 | Known |
| CVE-2022-47986 | IBM | IBM Aspera Faspex Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Feb 21, 2023 | Known |
| CVE-2022-40765 | Mitel | Mitel MiVoice Connect Command Injection Vulnerability | Severity: Elevated CVSS 6.8 | Feb 21, 2023 | Known |
| CVE-2022-41223 | Mitel | Mitel MiVoice Connect Code Injection Vulnerability | Severity: Elevated CVSS 6.8 | Feb 21, 2023 | Known |
| CVE-2022-46169 | Cacti | Cacti Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Feb 16, 2023 | Not known |
| CVE-2023-23529 | Apple | Apple Multiple Products WebKit Type Confusion Vulnerability | Severity: High CVSS 8.8 | Feb 14, 2023 | Not known |
| CVE-2023-21823 | Microsoft | Microsoft Windows Graphic Component Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Feb 14, 2023 | Not known |
| CVE-2023-23376 | Microsoft | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Feb 14, 2023 | Known |
| CVE-2023-21715 | Microsoft | Microsoft Office Publisher Security Feature Bypass Vulnerability | Severity: High CVSS 7.3 | Feb 14, 2023 | Not known |
| CVE-2015-2291 | Intel | Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability | Severity: High CVSS 7.8 | Feb 10, 2023 | Known |
| CVE-2022-24990 | TerraMaster | TerraMaster OS Remote Command Execution Vulnerability | Severity: High CVSS 7.5 | Feb 10, 2023 | Known |
| CVE-2023-0669 | Fortra | Fortra GoAnywhere MFT Remote Code Execution Vulnerability | Severity: High CVSS 7.2 | Feb 10, 2023 | Known |
| CVE-2022-21587 | Oracle | Oracle E-Business Suite Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Feb 2, 2023 | Known |
| CVE-2023-22952 | SugarCRM | Multiple SugarCRM Products Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Feb 2, 2023 | Not known |
| CVE-2017-11357 | Telerik | Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability | Severity: Critical CVSS 9.8 | Jan 26, 2023 | Known |
| CVE-2022-47966 | Zoho | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Jan 23, 2023 | Known |
| CVE-2022-44877 | CWP | CWP Control Web Panel OS Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Jan 17, 2023 | Not known |
| CVE-2022-41080 | Microsoft | Microsoft Exchange Server Privilege Escalation Vulnerability | Severity: High CVSS 8.8 | Jan 10, 2023 | Known |
| CVE-2023-21674 | Microsoft | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability | Severity: High CVSS 8.8 | Jan 10, 2023 | Not known |
| CVE-2018-5430 | TIBCO | TIBCO JasperReports Server Information Disclosure Vulnerability | Severity: High CVSS 8.8 | Dec 29, 2022 | Not known |
| CVE-2018-18809 | TIBCO | TIBCO JasperReports Library Directory Traversal Vulnerability | Severity: Elevated CVSS 6.5 | Dec 29, 2022 | Not known |
| CVE-2022-42856 | Apple | Apple iOS Type Confusion Vulnerability | Severity: High CVSS 8.8 | Dec 14, 2022 | Not known |
| CVE-2022-26501 | Veeam | Veeam Backup & Replication Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Dec 13, 2022 | Known |
| CVE-2022-27518 | Citrix | Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability | Severity: Critical CVSS 9.8 | Dec 13, 2022 | Not known |
| CVE-2022-42475 | Fortinet | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Dec 13, 2022 | Known |
| CVE-2022-26500 | Veeam | Veeam Backup & Replication Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Dec 13, 2022 | Known |
| CVE-2022-44698 | Microsoft | Microsoft Defender SmartScreen Security Feature Bypass Vulnerability | Severity: Elevated CVSS 5.4 | Dec 13, 2022 | Known |
| CVE-2022-4262 | Google Chromium V8 Type Confusion Vulnerability | Severity: High CVSS 8.8 | Dec 5, 2022 | Not known | |
| CVE-2021-35587 | Oracle | Oracle Fusion Middleware Unspecified Vulnerability | Severity: Critical CVSS 9.8 | Nov 28, 2022 | Not known |
| CVE-2022-4135 | Google Chromium GPU Heap Buffer Overflow Vulnerability | Severity: Critical CVSS 9.6 | Nov 28, 2022 | Not known | |
| CVE-2022-41049 | Microsoft | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | Severity: Elevated CVSS 5.4 | Nov 14, 2022 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.