Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2020-10148 | SolarWinds | SolarWinds Orion Authentication Bypass Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-10181 | Sumavision | Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-10189 | Zoho | Zoho ManageEngine Desktop Central File Upload Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-10987 | Tenda | Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-11651 | SaltStack | SaltStack Salt Authentication Bypass Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-12271 | Sophos | Sophos SFOS SQL Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-12812 | Fortinet | Fortinet FortiOS SSL VPN Improper Authentication Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-14750 | Oracle | Oracle WebLogic Server Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-14882 | Oracle | Oracle WebLogic Server Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-15505 | Ivanti | Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-16846 | SaltStack | SaltStack Salt Shell Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-17496 | vBulletin | vBulletin PHP Module Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-17530 | Apache | Apache Struts Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-25213 | WordPress | WordPress File Manager Plugin Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-25506 | D-Link | D-Link DNS-320 Device Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-2555 | Oracle | Oracle Multiple Products Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-26919 | NETGEAR | Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-29557 | D-Link | D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-29583 | Zyxel | Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-3161 | Cisco | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-3952 | VMware | VMware vCenter Server Information Disclosure Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-3992 | VMware | VMware ESXi OpenSLP Use-After-Free Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-4427 | IBM | IBM Data Risk Manager Security Bypass Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-5847 | Unraid | Unraid Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-5902 | F5 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-6207 | SAP | SAP Solution Manager Missing Authentication for Critical Function Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-7961 | Liferay | Liferay Portal Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-8515 | DrayTek | Multiple DrayTek Vigor Routers Web Management Page Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-8599 | Trend Micro | Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-8644 | PlaySMS | PlaySMS Server-Side Template Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-8657 | EyesOfNetwork | EyesOfNetwork Use of Hard-Coded Credentials Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-1497 | Cisco | Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-1498 | Cisco | Cisco HyperFlex HX Data Platform Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-1870 | Apple | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-1871 | Apple | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-20016 | SonicWall | SonicWall SSLVPN SMA100 SQL Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-20021 | SonicWall | SonicWall Email Security Improper Privilege Management Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-20090 | Arcadyan | Arcadyan Buffalo Firmware Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-21972 | VMware | VMware vCenter Server Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-21985 | VMware | VMware vCenter Server Improper Input Validation Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.