Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2019-1653 | Cisco | Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2019-17558 | Apache | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2019-18187 | Trend Micro | Trend Micro OfficeScan Directory Traversal Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2019-19356 | Netis | Netis WF2419 Devices Remote Code Execution Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2019-20085 | TVT | TVT NVMS-1000 Directory Traversal Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2019-6223 | Apple | Apple iOS and macOS Group Facetime Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2019-7481 | SonicWall | SonicWall SMA100 SQL Injection Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Known |
| CVE-2020-0674 | Microsoft | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2020-0968 | Microsoft | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Known |
| CVE-2020-11738 | WordPress | WordPress Snap Creek Duplicator Plugin File Download Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2020-3452 | Cisco | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2020-5849 | Unraid | Unraid Authentication Bypass Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2021-22506 | Micro Focus | Micro Focus Access Manager Information Leakage Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2021-33742 | Microsoft | Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
| CVE-2021-36942 | Microsoft | Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Known |
| CVE-2019-11539 | Ivanti | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability | Severity: High CVSS 7.2 | Nov 3, 2021 | Known |
| CVE-2020-14883 | Oracle | Oracle WebLogic Server Unspecified Vulnerability | Severity: High CVSS 7.2 | Nov 3, 2021 | Not known |
| CVE-2020-8243 | Ivanti | Ivanti Pulse Connect Secure Code Execution Vulnerability | Severity: High CVSS 7.2 | Nov 3, 2021 | Not known |
| CVE-2020-8260 | Ivanti | Ivanti Pulse Connect Secure Code Execution Vulnerability | Severity: High CVSS 7.2 | Nov 3, 2021 | Not known |
| CVE-2021-20022 | SonicWall | SonicWall Email Security Unrestricted Upload of File Vulnerability | Severity: High CVSS 7.2 | Nov 3, 2021 | Known |
| CVE-2021-22900 | Ivanti | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | Severity: High CVSS 7.2 | Nov 3, 2021 | Not known |
| CVE-2019-18988 | TeamViewer | TeamViewer Desktop Bypass Remote Login Vulnerability | Severity: High CVSS 7.0 | Nov 3, 2021 | Not known |
| CVE-2020-1054 | Microsoft | Microsoft Win32k Privilege Escalation Vulnerability | Severity: High CVSS 7.0 | Nov 3, 2021 | Not known |
| CVE-2021-1782 | Apple | Apple Multiple Products Race Condition Vulnerability | Severity: High CVSS 7.0 | Nov 3, 2021 | Not known |
| CVE-2021-38649 | Microsoft | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Severity: High CVSS 7.0 | Nov 3, 2021 | Not known |
| CVE-2021-34448 | Microsoft | Microsoft Windows Scripting Engine Memory Corruption Vulnerability | Severity: Elevated CVSS 6.8 | Nov 3, 2021 | Not known |
| CVE-2018-2380 | SAP | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | Severity: Elevated CVSS 6.6 | Nov 3, 2021 | Known |
| CVE-2021-31207 | Microsoft | Microsoft Exchange Server Security Feature Bypass Vulnerability | Severity: Elevated CVSS 6.6 | Nov 3, 2021 | Known |
| CVE-2016-9563 | SAP | SAP NetWeaver XML External Entity (XXE) Vulnerability | Severity: Elevated CVSS 6.5 | Nov 3, 2021 | Not known |
| CVE-2019-5591 | Fortinet | Fortinet FortiOS Default Configuration Vulnerability | Severity: Elevated CVSS 6.5 | Nov 3, 2021 | Known |
| CVE-2019-8394 | Zoho | Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability | Severity: Elevated CVSS 6.5 | Nov 3, 2021 | Not known |
| CVE-2020-11652 | SaltStack | SaltStack Salt Path Traversal Vulnerability | Severity: Elevated CVSS 6.5 | Nov 3, 2021 | Not known |
| CVE-2020-8193 | Citrix | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | Severity: Elevated CVSS 6.5 | Nov 3, 2021 | Not known |
| CVE-2020-8195 | Citrix | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | Severity: Elevated CVSS 6.5 | Nov 3, 2021 | Not known |
| CVE-2021-37976 | Google Chromium Information Disclosure Vulnerability | Severity: Elevated CVSS 6.5 | Nov 3, 2021 | Not known | |
| CVE-2019-9978 | WordPress | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability | Severity: Elevated CVSS 6.1 | Nov 3, 2021 | Not known |
| CVE-2020-3580 | Cisco | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | Severity: Elevated CVSS 6.1 | Nov 3, 2021 | Known |
| CVE-2021-1879 | Apple | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability | Severity: Elevated CVSS 6.1 | Nov 3, 2021 | Not known |
| CVE-2021-38000 | Google Chromium Intents Improper Input Validation Vulnerability | Severity: Elevated CVSS 6.1 | Nov 3, 2021 | Not known | |
| CVE-2016-3715 | ImageMagick | ImageMagick Arbitrary File Deletion Vulnerability | Severity: Elevated CVSS 5.5 | Nov 3, 2021 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.