Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2021-22005 | VMware | VMware vCenter Server File Upload Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-22502 | Micro Focus | Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-22986 | F5 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-26084 | Atlassian | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-27101 | Accellion | Accellion FTA SQL Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-27103 | Accellion | Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-27104 | Accellion | Accellion FTA OS Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-27561 | Yealink | Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-30116 | Kaseya | Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-31755 | Tenda | Tenda AC11 Router Stack Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-35395 | Realtek | Realtek AP-Router SDK Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-35464 | ForgeRock | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-38647 | Microsoft | Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-40539 | Zoho | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-41773 | Apache | Apache HTTP Server Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-42013 | Apache | Apache HTTP Server Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-42258 | BQE | BQE BillQuick Web Suite SQL Injection Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-15999 | Google Chrome FreeType Heap Buffer Overflow Vulnerability | Severity: Critical CVSS 9.6 | Nov 3, 2021 | Not known | |
| CVE-2020-16010 | Google Chrome for Android UI Heap Buffer Overflow Vulnerability | Severity: Critical CVSS 9.6 | Nov 3, 2021 | Not known | |
| CVE-2020-16017 | Google Chrome Use-After-Free Vulnerability | Severity: Critical CVSS 9.6 | Nov 3, 2021 | Not known | |
| CVE-2021-30633 | Google Chromium Indexed DB API Use-After-Free Vulnerability | Severity: Critical CVSS 9.6 | Nov 3, 2021 | Not known | |
| CVE-2021-37973 | Google Chromium Portals Use-After-Free Vulnerability | Severity: Critical CVSS 9.6 | Nov 3, 2021 | Not known | |
| CVE-2012-3152 | Oracle | Oracle Fusion Middleware Unspecified Vulnerability | Severity: Critical CVSS 9.1 | Nov 3, 2021 | Not known |
| CVE-2020-4006 | VMware | Multiple VMware Products Command Injection Vulnerability | Severity: Critical CVSS 9.1 | Nov 3, 2021 | Not known |
| CVE-2020-4428 | IBM | IBM Data Risk Manager Remote Code Execution Vulnerability | Severity: Critical CVSS 9.1 | Nov 3, 2021 | Not known |
| CVE-2021-26855 | Microsoft | Microsoft Exchange Server Remote Code Execution Vulnerability | Severity: Critical CVSS 9.1 | Nov 3, 2021 | Known |
| CVE-2021-34473 | Microsoft | Microsoft Exchange Server Remote Code Execution Vulnerability | Severity: Critical CVSS 9.1 | Nov 3, 2021 | Known |
| CVE-2020-1040 | Microsoft | Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability | Severity: Critical CVSS 9.0 | Nov 3, 2021 | Not known |
| CVE-2021-34523 | Microsoft | Microsoft Exchange Server Privilege Escalation Vulnerability | Severity: Critical CVSS 9.0 | Nov 3, 2021 | Known |
| CVE-2012-0158 | Microsoft | Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Known |
| CVE-2014-1812 | Microsoft | Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Known |
| CVE-2017-0143 | Microsoft | Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Known |
| CVE-2017-6327 | Symantec | Symantec Messaging Gateway Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Not known |
| CVE-2017-9822 | DotNetNuke (DNN) | DotNetNuke (DNN) Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Known |
| CVE-2018-0798 | Microsoft | Microsoft Office Memory Corruption Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Not known |
| CVE-2019-0541 | Microsoft | Microsoft MSHTML Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Not known |
| CVE-2019-15949 | Nagios | Nagios XI Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Not known |
| CVE-2019-17026 | Mozilla | Mozilla Firefox And Thunderbird Type Confusion Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Not known |
| CVE-2019-3398 | Atlassian | Atlassian Confluence Server and Data Center Path Traversal Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Not known |
| CVE-2019-9082 | ThinkPHP | ThinkPHP Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Nov 3, 2021 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.