Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
1,734 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2026-20133 | Cisco | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | Severity: High CVSS 7.5 | Apr 20, 2026 | Not known |
| CVE-2024-27199 | JetBrains | JetBrains TeamCity Relative Path Traversal Vulnerability | Severity: High CVSS 7.3 | Apr 20, 2026 | Known |
| CVE-2025-2749 | Kentico | Kentico Xperience Path Traversal Vulnerability | Severity: High CVSS 7.2 | Apr 20, 2026 | Not known |
| CVE-2025-48700 | Synacor | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | Severity: Elevated CVSS 6.1 | Apr 20, 2026 | Not known |
| CVE-2026-20122 | Cisco | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | Severity: Elevated CVSS 5.4 | Apr 20, 2026 | Not known |
| CVE-2026-34197 | Apache | Apache ActiveMQ Improper Input Validation Vulnerability | Severity: High CVSS 8.8 | Apr 16, 2026 | Not known |
| CVE-2009-0238 | Microsoft | Microsoft Office Remote Code Execution | Severity: High CVSS 8.8 | Apr 14, 2026 | Not known |
| CVE-2026-32201 | Microsoft | Microsoft SharePoint Server Improper Input Validation Vulnerability | Severity: Elevated CVSS 6.5 | Apr 14, 2026 | Not known |
| CVE-2026-21643 | Fortinet | Fortinet FortiClient EMS SQL Injection Vulnerability | Severity: Critical CVSS 9.8 | Apr 13, 2026 | Not known |
| CVE-2023-21529 | Microsoft | Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability | Severity: High CVSS 8.8 | Apr 13, 2026 | Known |
| CVE-2026-34621 | Adobe | Adobe Acrobat and Reader Prototype Pollution Vulnerability | Severity: High CVSS 8.6 | Apr 13, 2026 | Not known |
| CVE-2012-1854 | Microsoft | Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability | Severity: High CVSS 7.8 | Apr 13, 2026 | Not known |
| CVE-2020-9715 | Adobe | Adobe Acrobat Use-After-Free Vulnerability | Severity: High CVSS 7.8 | Apr 13, 2026 | Not known |
| CVE-2023-36424 | Microsoft | Microsoft Windows Out-of-Bounds Read Vulnerability | Severity: High CVSS 7.8 | Apr 13, 2026 | Not known |
| CVE-2025-60710 | Microsoft | Microsoft Windows Link Following Vulnerability | Severity: High CVSS 7.8 | Apr 13, 2026 | Known |
| CVE-2026-1340 | Ivanti | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | Severity: Critical CVSS 9.8 | Apr 8, 2026 | Not known |
| CVE-2026-35616 | Fortinet | Fortinet FortiClient EMS Improper Access Control Vulnerability | Severity: Critical CVSS 9.8 | Apr 6, 2026 | Not known |
| CVE-2026-3502 | TrueConf | TrueConf Client Download of Code Without Integrity Check Vulnerability | Severity: High CVSS 7.8 | Apr 2, 2026 | Not known |
| CVE-2026-5281 | Google Dawn Use-After-Free Vulnerability | Severity: High CVSS 8.8 | Apr 1, 2026 | Not known | |
| CVE-2026-3055 | Citrix | Citrix NetScaler Out-of-Bounds Read Vulnerability | Severity: Critical CVSS 9.3 | Mar 30, 2026 | Not known |
| CVE-2025-53521 | F5 | F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | Severity: Critical CVSS 9.3 | Mar 27, 2026 | Not known |
| CVE-2026-33634 | Aquasecurity | Aquasecurity Trivy Embedded Malicious Code Vulnerability | Severity: Critical CVSS 9.4 | Mar 26, 2026 | Not known |
| CVE-2026-33017 | Langflow | Langflow Code Injection Vulnerability | Severity: Critical CVSS 9.3 | Mar 25, 2026 | Not known |
| CVE-2025-32432 | Craft CMS | Craft CMS Code Injection Vulnerability | Severity: Critical CVSS 10.0 | Mar 20, 2026 | Not known |
| CVE-2025-54068 | Laravel | Laravel Livewire Code Injection Vulnerability | Severity: Critical CVSS 9.2 | Mar 20, 2026 | Not known |
| CVE-2025-31277 | Apple | Apple Multiple Products Buffer Overflow Vulnerability | Severity: High CVSS 8.8 | Mar 20, 2026 | Not known |
| CVE-2025-43510 | Apple | Apple Multiple Products Improper Locking Vulnerability | Severity: High CVSS 7.8 | Mar 20, 2026 | Not known |
| CVE-2025-43520 | Apple | Apple Multiple Products Classic Buffer Overflow Vulnerability | Severity: Elevated CVSS 5.5 | Mar 20, 2026 | Not known |
| CVE-2026-20131 | Cisco | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 10.0 | Mar 19, 2026 | Known |
| CVE-2026-20963 | Microsoft | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Mar 18, 2026 | Not known |
| CVE-2025-66376 | Synacor | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability | Severity: Elevated CVSS 6.1 | Mar 18, 2026 | Not known |
| CVE-2025-47813 | Wing FTP Server | Wing FTP Server Information Disclosure Vulnerability | Severity: Elevated CVSS 4.3 | Mar 16, 2026 | Not known |
| CVE-2026-3909 | Google Skia Out-of-Bounds Write Vulnerability | Severity: High CVSS 8.8 | Mar 13, 2026 | Not known | |
| CVE-2026-3910 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | Severity: High CVSS 8.8 | Mar 13, 2026 | Not known | |
| CVE-2025-68613 | n8n | n8n Improper Control of Dynamically-Managed Code Resources Vulnerability | Severity: High CVSS 8.8 | Mar 11, 2026 | Not known |
| CVE-2025-26399 | SolarWinds | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Mar 9, 2026 | Known |
| CVE-2021-22054 | Omnissa | Omnissa Workspace ONE Server-Side Request Forgery | Severity: High CVSS 7.5 | Mar 9, 2026 | Not known |
| CVE-2026-1603 | Ivanti | Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | Severity: High CVSS 7.5 | Mar 9, 2026 | Not known |
| CVE-2017-7921 | Hikvision | Hikvision Multiple Products Improper Authentication Vulnerability | Severity: Critical CVSS 9.8 | Mar 5, 2026 | Not known |
| CVE-2021-22681 | Rockwell | Rockwell Multiple Products Insufficient Protected Credentials Vulnerability | Severity: Critical CVSS 9.8 | Mar 5, 2026 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.