Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
31 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2026-59310 | Broadcom | Broadcom VMware vCenter Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Aug 18, 2026 | Known |
| CVE-2026-22719 | Broadcom | Broadcom VMware Aria Operations Command Injection Vulnerability | Severity: High CVSS 8.1 | Mar 3, 2026 | Not known |
| CVE-2024-37079 | Broadcom | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | Severity: Critical CVSS 9.8 | Jan 23, 2026 | Not known |
| CVE-2025-41244 | Broadcom | Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability | Severity: High CVSS 7.8 | Oct 30, 2025 | Not known |
| CVE-2025-1976 | Broadcom | Broadcom Brocade Fabric OS Code Injection Vulnerability | Severity: High CVSS 8.6 | Apr 28, 2025 | Not known |
| CVE-2025-22224 | VMware | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | Severity: High CVSS 8.2 | Mar 4, 2025 | Not known |
| CVE-2025-22225 | VMware | VMware ESXi Arbitrary Write Vulnerability | Severity: High CVSS 8.2 | Mar 4, 2025 | Known |
| CVE-2025-22226 | VMware | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | Severity: Elevated CVSS 6.0 | Mar 4, 2025 | Not known |
| CVE-2024-38812 | VMware | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Nov 20, 2024 | Not known |
| CVE-2024-38813 | VMware | VMware vCenter Server Privilege Escalation Vulnerability | Severity: Critical CVSS 9.8 | Nov 20, 2024 | Not known |
| CVE-2024-37085 | VMware | VMware ESXi Authentication Bypass Vulnerability | Severity: High CVSS 7.2 | Jul 30, 2024 | Known |
| CVE-2022-22948 | VMware | VMware vCenter Server Incorrect Default File Permissions Vulnerability | Severity: Elevated CVSS 6.5 | Jul 17, 2024 | Not known |
| CVE-2023-34048 | VMware | VMware vCenter Server Out-of-Bounds Write Vulnerability | Severity: Critical CVSS 9.8 | Jan 22, 2024 | Not known |
| CVE-2023-20867 | VMware | VMware Tools Authentication Bypass Vulnerability | Severity: Informational CVSS 3.9 | Jun 23, 2023 | Not known |
| CVE-2023-20887 | VMware | Vmware Aria Operations for Networks Command Injection Vulnerability | Severity: Critical CVSS 9.8 | Jun 22, 2023 | Not known |
| CVE-2022-22947 | VMware | VMware Spring Cloud Gateway Code Injection Vulnerability | Severity: Critical CVSS 10.0 | May 16, 2022 | Not known |
| CVE-2022-22960 | VMware | VMware Multiple Products Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Apr 15, 2022 | Not known |
| CVE-2022-22954 | VMware | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | Severity: Critical CVSS 9.8 | Apr 14, 2022 | Known |
| CVE-2022-22965 | VMware | Spring Framework JDK 9+ Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Apr 4, 2022 | Not known |
| CVE-2018-6961 | VMware | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | Severity: High CVSS 8.1 | Mar 25, 2022 | Not known |
| CVE-2021-21973 | VMware | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | Severity: Elevated CVSS 5.3 | Mar 7, 2022 | Not known |
| CVE-2021-21975 | VMware | VMware Server Side Request Forgery in vRealize Operations Manager API | Severity: High CVSS 7.5 | Jan 18, 2022 | Known |
| CVE-2021-22017 | VMware | VMware vCenter Server Improper Access Control | Severity: Elevated CVSS 5.3 | Jan 10, 2022 | Not known |
| CVE-2019-5544 | VMware | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-3952 | VMware | VMware vCenter Server Information Disclosure Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2020-3992 | VMware | VMware ESXi OpenSLP Use-After-Free Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-21972 | VMware | VMware vCenter Server Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-21985 | VMware | VMware vCenter Server Improper Input Validation Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-22005 | VMware | VMware vCenter Server File Upload Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-4006 | VMware | Multiple VMware Products Command Injection Vulnerability | Severity: Critical CVSS 9.1 | Nov 3, 2021 | Not known |
| CVE-2020-3950 | VMware | VMware Multiple Products Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Nov 3, 2021 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.