Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2019-1253 | Microsoft | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Mar 15, 2022 | Known |
| CVE-2019-1315 | Microsoft | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Mar 15, 2022 | Known |
| CVE-2019-1322 | Microsoft | Microsoft Windows Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Mar 15, 2022 | Known |
| CVE-2019-1405 | Microsoft | Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Mar 15, 2022 | Known |
| CVE-2018-8120 | Microsoft | Microsoft Win32k Privilege Escalation Vulnerability | Severity: High CVSS 7.0 | Mar 15, 2022 | Known |
| CVE-2013-0625 | Adobe | Adobe ColdFusion Authentication Bypass Vulnerability | Severity: Critical CVSS 9.8 | Mar 7, 2022 | Not known |
| CVE-2017-6077 | NETGEAR | NETGEAR DGN2200 Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 7, 2022 | Not known |
| CVE-2019-11581 | Atlassian | Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability | Severity: Critical CVSS 9.8 | Mar 7, 2022 | Not known |
| CVE-2022-26486 | Mozilla | Mozilla Firefox Use-After-Free Vulnerability | Severity: Critical CVSS 9.6 | Mar 7, 2022 | Not known |
| CVE-2016-6277 | NETGEAR | NETGEAR Multiple Routers Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Mar 7, 2022 | Not known |
| CVE-2022-26485 | Mozilla | Mozilla Firefox Use-After-Free Vulnerability | Severity: High CVSS 8.8 | Mar 7, 2022 | Not known |
| CVE-2013-0629 | Adobe | Adobe ColdFusion Directory Traversal Vulnerability | Severity: High CVSS 7.5 | Mar 7, 2022 | Not known |
| CVE-2013-0631 | Adobe | Adobe ColdFusion Information Disclosure Vulnerability | Severity: High CVSS 7.5 | Mar 7, 2022 | Not known |
| CVE-2020-8218 | Pulse Secure | Pulse Connect Secure Code Injection Vulnerability | Severity: High CVSS 7.2 | Mar 7, 2022 | Not known |
| CVE-2009-3960 | Adobe | Adobe BlazeDS Information Disclosure Vulnerability | Severity: Elevated CVSS 6.5 | Mar 7, 2022 | Known |
| CVE-2021-21973 | VMware | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | Severity: Elevated CVSS 5.3 | Mar 7, 2022 | Not known |
| CVE-2011-1889 | Microsoft | Microsoft Forefront TMG Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2011-3544 | Oracle | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2012-0507 | Oracle | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Known |
| CVE-2012-1723 | Oracle | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Known |
| CVE-2012-4681 | Oracle | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Known |
| CVE-2013-0632 | Adobe | Adobe ColdFusion Authentication Bypass Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2013-3346 | Adobe | Adobe Reader and Acrobat Memory Corruption Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2015-2590 | Oracle | Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2015-3043 | Adobe | Adobe Flash Player Memory Corruption Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2015-5119 | Adobe | Adobe Flash Player Use-After-Free Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2016-1019 | Adobe | Adobe Flash Player Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Known |
| CVE-2016-4117 | Adobe | Adobe Flash Player Arbitrary Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Known |
| CVE-2017-12240 | Cisco | Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2018-0151 | Cisco | Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2019-16928 | Exim | Exim Out-of-bounds Write Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2020-1938 | Apache | Apache Tomcat Improper Privilege Management Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2022-20699 | Cisco | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2022-20700 | Cisco | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2008-3431 | Oracle | Oracle VirtualBox Insufficient Input Validation Vulnerability | Severity: High CVSS 8.8 | Mar 3, 2022 | Not known |
| CVE-2011-0611 | Adobe | Adobe Flash Player Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Mar 3, 2022 | Not known |
| CVE-2012-1856 | Microsoft | Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Mar 3, 2022 | Not known |
| CVE-2013-1347 | Microsoft | Microsoft Internet Explorer Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Mar 3, 2022 | Not known |
| CVE-2013-3897 | Microsoft | Microsoft Internet Explorer Use-After-Free Vulnerability | Severity: High CVSS 8.8 | Mar 3, 2022 | Not known |
| CVE-2014-0496 | Adobe | Adobe Reader and Acrobat Use-After-Free Vulnerability | Severity: High CVSS 8.8 | Mar 3, 2022 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.