Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2017-0213 | Microsoft | Microsoft Windows Privilege Escalation Vulnerability | Severity: High CVSS 7.3 | Mar 28, 2022 | Known |
| CVE-2021-26085 | Atlassian | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | Severity: Elevated CVSS 5.3 | Mar 28, 2022 | Known |
| CVE-2012-0518 | Oracle | Oracle Fusion Middleware Unspecified Vulnerability | Severity: Elevated CVSS 4.7 | Mar 28, 2022 | Not known |
| CVE-2017-0059 | Microsoft | Microsoft Internet Explorer Information Disclosure Vulnerability | Severity: Elevated CVSS 4.3 | Mar 28, 2022 | Not known |
| CVE-2020-2021 | Palo Alto Networks | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | Severity: Critical CVSS 10.0 | Mar 25, 2022 | Known |
| CVE-2019-1003030 | Jenkins | Jenkins Matrix Project Plugin Remote Code Execution Vulnerability | Severity: Critical CVSS 9.9 | Mar 25, 2022 | Not known |
| CVE-2005-2773 | Hewlett Packard (HP) | HP OpenView Network Node Manager Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2009-1151 | phpMyAdmin | phpMyAdmin Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2010-2861 | Adobe | Adobe ColdFusion Directory Traversal Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Known |
| CVE-2010-4344 | Exim | Exim Heap-Based Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2012-1823 | PHP | PHP-CGI Query String Parameter Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2013-2251 | Apache | Apache Struts Improper Input Validation Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2013-4810 | Hewlett Packard (HP) | HP Multiple Products Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2014-6287 | Rejetto | Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2015-1187 | D-Link and TRENDnet | D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2015-1427 | Elastic | Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2016-10174 | NETGEAR | NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2016-1555 | NETGEAR | NETGEAR Multiple WAP Devices Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2016-4171 | Adobe | Adobe Flash Player Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2017-3881 | Cisco | Cisco IOS and IOS XE Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2017-6316 | Citrix | Citrix Multiple Products Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2018-0125 | Cisco | Cisco VPN Routers Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2018-0147 | Cisco | Cisco Secure Access Control System Java Deserialization Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2018-11138 | Quest | Quest KACE System Management Appliance Remote Command Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Known |
| CVE-2018-1273 | VMware Tanzu | VMware Tanzu Spring Data Commons Property Binder Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Known |
| CVE-2018-14839 | LG | LG N1A1 NAS Remote Command Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2019-10068 | Kentico | Kentico Xperience Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2019-11043 | PHP | PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Known |
| CVE-2019-12989 | Citrix | Citrix SD-WAN and NetScaler SQL Injection Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2019-15107 | Webmin | Webmin Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Known |
| CVE-2019-16920 | D-Link | D-Link Multiple Routers Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2020-1631 | Juniper | Juniper Junos OS Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2020-2506 | QNAP Systems | QNAP Helpdesk Improper Access Control Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2020-25223 | Sophos | Sophos SG UTM Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2020-7247 | OpenBSD | OpenSMTPD Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2020-9054 | Zyxel | Zyxel Multiple NAS Devices OS Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2021-22941 | Citrix | Citrix ShareFile Improper Access Control Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Known |
| CVE-2021-42237 | Sitecore | Sitecore XP Remote Command Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Known |
| CVE-2022-26143 | Mitel | MiCollab, MiVoice Business Express Access Control Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2022-26318 | WatchGuard | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.