Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2018-14847 | MikroTik | MikroTik Router OS Directory Traversal Vulnerability | Severity: Critical CVSS 9.1 | Dec 1, 2021 | Not known |
| CVE-2021-40438 | Apache | Apache HTTP Server-Side Request Forgery (SSRF) | Severity: Critical CVSS 9.0 | Dec 1, 2021 | Known |
| CVE-2020-11261 | Qualcomm | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | Severity: High CVSS 7.8 | Dec 1, 2021 | Not known |
| CVE-2021-42321 | Microsoft | Microsoft Exchange Server Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Nov 17, 2021 | Known |
| CVE-2021-22204 | Perl | ExifTool Remote Code Execution Vulnerability | Severity: High CVSS 7.8 | Nov 17, 2021 | Not known |
| CVE-2021-40449 | Microsoft | Microsoft Windows Win32k Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Nov 17, 2021 | Known |
| CVE-2021-42292 | Microsoft | Microsoft Excel Security Feature Bypass | Severity: High CVSS 7.8 | Nov 17, 2021 | Not known |
| CVE-2010-5326 | SAP | SAP NetWeaver Remote Code Execution Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Not known |
| CVE-2019-11510 | Ivanti | Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Known |
| CVE-2020-1350 | Microsoft | Microsoft Windows DNS Server Remote Code Execution Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Not known |
| CVE-2020-14871 | Oracle | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Not known |
| CVE-2020-6287 | SAP | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Not known |
| CVE-2021-22205 | GitLab | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Known |
| CVE-2021-22893 | Ivanti | Ivanti Pulse Connect Secure Use-After-Free Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Known |
| CVE-2021-35211 | SolarWinds | SolarWinds Serv-U Remote Code Execution Vulnerability | Severity: Critical CVSS 10.0 | Nov 3, 2021 | Known |
| CVE-2015-4852 | Oracle | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2016-4437 | Apache | Apache Shiro Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2017-5638 | Apache | Apache Struts Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2017-7269 | Microsoft | Microsoft Windows Server Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2017-9248 | Progress | Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2018-0171 | Cisco | Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2018-13379 | Fortinet | Fortinet FortiOS SSL VPN Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2018-14558 | Tenda | Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2018-15961 | Adobe | Adobe ColdFusion Unrestricted File Upload Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2018-20062 | ThinkPHP | ThinkPHP "noneCms" Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2018-4939 | Adobe | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2018-6789 | Exim | Exim Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2018-7600 | Drupal | Drupal Core Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2019-0604 | Microsoft | Microsoft SharePoint Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2019-0708 | Microsoft | Microsoft Remote Desktop Services Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2019-11580 | Atlassian | Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2019-11634 | Citrix | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2019-16256 | SIMalliance | SIMalliance Toolbox Browser Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2019-16759 | vBulletin | vBulletin PHP Module Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2019-18935 | Progress | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2019-19781 | Citrix | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2019-3396 | Atlassian | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2019-4716 | IBM | IBM Planning Analytics Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2019-5544 | VMware | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-0646 | Microsoft | Microsoft .NET Framework Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.