Threat intelligence · updated daily
Vulnerabilities being exploited right now
Every vulnerability CISA has confirmed exploited in the last year, with how likely each is to be used next, the federal deadline to fix it, and what to do. Compiled automatically by SAK T.L.M from the CISA catalogue and FIRST EPSS.
1,779vulnerabilities on CISA's exploited list
40added in the last 30 days
405,484CVEs scored for exploitation probability
324with their own page here: what it is, the deadline and what to do
Most likely to be used next
Recent additions with the highest EPSS
CVE-2026-109619 · EPSS 100%
PHP: remote code execution
Listed 26 October 2026; deadline 29 October 2026.
CVE-2026-109618 · EPSS 100%PHP: remote code execution
Listed 26 October 2026; deadline 29 October 2026.
CVE-2026-21589 · EPSS 100%Atlassian Multiple Products: exploited vulnerability
Listed 15 October 2026; deadline 18 October 2026.
CVE-2015-5477 · EPSS 100%ISC BIND: denial of service
Listed 8 October 2026; deadline 11 October 2026.
CVE-2015-3306 · EPSS 99%ProFTPD: exploited vulnerability
Listed 8 October 2026; deadline 11 October 2026.
CVE-2016-3081 · EPSS 97%Apache Struts: remote code execution
Listed 8 October 2026; deadline 11 October 2026.
The last 365 days
All 324, newest first
| CVE | Vendor and product | Type | Listed | EPSS |
|---|---|---|---|---|
| CVE-2026-20320 | Cisco BroadWorks | exploited vulnerability | 10 November 2026 | 0.8% |
| CVE-2026-125350 | Google Chromium | remote code execution | 10 November 2026 | 1.0% |
| CVE-2026-124194 | Microsoft Office | exploited vulnerability | 10 November 2026 | 1.6% |
| CVE-2026-116606 | Barracuda Email Security Gateway (ESG) | authentication bypass | 10 November 2026 | 8.9% |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder | exploited vulnerability | 10 November 2026 | 0.6% |
| CVE-2026-111560 | Barracuda Networks Multiple Products | command injection | 10 November 2026 | 6.2% |
| CVE-2026-123218 | IBM Aspera Faspex | privilege escalation | 9 November 2026 | 0.5% |
| CVE-2026-123158 | OpenBSD OpenSSH | authentication bypass | 9 November 2026 | 19% |
| CVE-2026-116779 | SignalWire FreeSwitch | exploited vulnerability | 9 November 2026 | 2.5% |
| CVE-2026-102895 | GPUStack | remote code execution | 9 November 2026 | 0.5% |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | exploited vulnerability | 6 November 2026 | 0.5% |
| CVE-2024-27834 | Apple Multiple Products | authentication bypass | 4 November 2026 | 1.5% |
| CVE-2026-119977 | WordPress Core | exploited vulnerability | 3 November 2026 | 1.2% |
| CVE-2026-118527 | Ivanti Connect Secure | exploited vulnerability | 30 October 2026 | 0.8% |
| CVE-2026-111357 | Ivanti Connect Secure | authentication bypass | 30 October 2026 | 0.5% |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition | remote code execution | 29 October 2026 | 69% |
| CVE-2026-76418 | Secure Firewall ASA Software and Cisco Secure FTD Software | denial of service | 29 October 2026 | 0.8% |
| CVE-2026-46300 | Linux Kernel | exploited vulnerability | 28 October 2026 | 16% |
| CVE-2026-41709 | Broadcom VMware ESX | exploited vulnerability | 28 October 2026 | 0.7% |
| CVE-2026-48356 | Adobe Commerce and Magento | remote code execution | 27 October 2026 | 47% |
| CVE-2026-111497 | Google Brotli | remote code execution | 27 October 2026 | 83% |
| CVE-2026-109619 | PHP | remote code execution | 26 October 2026 | 100% |
| CVE-2026-109618 | PHP | remote code execution | 26 October 2026 | 100% |
| CVE-2026-114625 | Arista VeloCloud Orchestrator | SQL injection | 23 October 2026 | 1.0% |
| CVE-2026-110447 | Collabora Online – Built-in CODE Server | remote code execution | 23 October 2026 | 73% |
| CVE-2026-96656 | Plex Media Server | exploited vulnerability | 20 October 2026 | 1.8% |
| CVE-2026-96655 | Plex Media Server | server-side request forgery | 20 October 2026 | 11% |
| CVE-2026-96654 | Plex Media Server | exploited vulnerability | 20 October 2026 | 1.9% |
| CVE-2026-96652 | Plex Media Server | server-side request forgery | 20 October 2026 | 12% |
| CVE-2026-110936 | Siemens Software Center | remote code execution | 20 October 2026 | 1.0% |
| CVE-2026-106931 | SiteGuard Server Edition | command injection | 20 October 2026 | 2.5% |
| CVE-2026-102764 | BeyondTrust Remote Support | authentication bypass | 16 October 2026 | 79% |
| CVE-2025-61624 | Fortinet Multiple Products | path traversal | 16 October 2026 | 1.4% |
| CVE-2026-21589 | Atlassian Multiple Products | exploited vulnerability | 15 October 2026 | 100% |
| CVE-2026-76519 | Cisco Secure Email Gateway | path traversal | 14 October 2026 | 6.2% |
| CVE-2026-105134 | AhsayCBS | command injection | 14 October 2026 | 82% |
| CVE-2026-105133 | AhsayCBS | authentication bypass | 14 October 2026 | 84% |
| CVE-2026-0322 | Palo Alto Networks PAN-OS | remote code execution | 14 October 2026 | 2.1% |
| CVE-2026-96951 | Microsoft Windows | command injection | 13 October 2026 | 9.8% |
| CVE-2026-104935 | Ivanti Connect Secure | authentication bypass | 13 October 2026 | 89% |
| CVE-2023-22894 | Strapi | remote code execution | 8 October 2026 | 4.1% |
| CVE-2021-3199 | ONLYOFFICE Docs | remote code execution | 8 October 2026 | 30% |
| CVE-2016-3081 | Apache Struts | remote code execution | 8 October 2026 | 97% |
| CVE-2015-5477 | ISC BIND | denial of service | 8 October 2026 | 100% |
| CVE-2015-3306 | ProFTPD | exploited vulnerability | 8 October 2026 | 99% |
| CVE-2026-88779 | Citrix NetScaler | denial of service | 4 October 2026 | 11% |
| CVE-2026-102490 | Zammad | privilege escalation | 2 October 2026 | 11% |
| CVE-2026-102489 | Zammad | remote code execution | 2 October 2026 | 50% |
| CVE-2026-104286 | Fortinet FortiMail | path traversal | 1 October 2026 | 4.6% |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | privilege escalation | 30 September 2026 | 39% |
| CVE-2026-86950 | Apple Multiple Products | remote code execution | 29 September 2026 | 26% |
| CVE-2026-88772 | Citrix NetScaler | remote code execution | 27 September 2026 | 77% |
| CVE-2026-88771 | Citrix NetScaler | exploited vulnerability | 27 September 2026 | 82% |
| CVE-2026-87902 | WordPress Core | remote code execution | 25 September 2026 | 96% |
| CVE-2026-67279 | MikroTik RouterOS | exploited vulnerability | 25 September 2026 | 2.3% |
| CVE-2026-65660 | Microsoft SharePoint | exploited vulnerability | 25 September 2026 | 9.9% |
| CVE-2026-71362 | Adobe Commerce and Magento | exploited vulnerability | 24 September 2026 | 92% |
| CVE-2026-5430 | WSO2 Multiple Products | remote code execution | 24 September 2026 | 22% |
| CVE-2026-94127 | F5 BIG-IP APM | remote code execution | 22 September 2026 | 27% |
| CVE-2026-93952 | Arista VeloCloud Orchestrator | privilege escalation | 22 September 2026 | 1.4% |
| CVE-2026-93616 | Check Point Multiple Products | path traversal | 22 September 2026 | 92% |
| CVE-2026-85102 | Check Point Multiple Products | remote code execution | 22 September 2026 | 54% |
| CVE-2026-7273 | Zyxel GS1900 Series Switches | command injection | 21 September 2026 | 2.7% |
| CVE-2026-53266 | Linux Kernel | memory corruption | 18 September 2026 | 0.9% |
| CVE-2025-39964 | Linux Kernel | exploited vulnerability | 18 September 2026 | 1.6% |
| CVE-2025-39682 | Linux Kernel | exploited vulnerability | 18 September 2026 | 3.3% |
| CVE-2026-87886 | Acronis Backup | privilege escalation | 16 September 2026 | 0.2% |
| CVE-2026-76460 | Cisco Identity Services Engine | privilege escalation | 16 September 2026 | 76% |
| CVE-2026-58704 | Google Pixel | privilege escalation | 16 September 2026 | 0.6% |
| CVE-2026-76461 | Cisco Secure Email Gateway | SQL injection | 14 September 2026 | 40% |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition | authentication bypass | 11 September 2026 | 97% |
| CVE-2026-84869 | ConnectWise ScreenConnect | privilege escalation | 11 September 2026 | 0.9% |
| CVE-2026-42018 | JFrog Artifactory | authentication bypass | 11 September 2026 | 10.0% |
| CVE-2026-42016 | JFrog Artifactory | privilege escalation | 11 September 2026 | 8.6% |
| CVE-2026-86060 | MikroTik RouterOS | privilege escalation | 10 September 2026 | 6.4% |
| CVE-2026-67277 | MikroTik RouterOS | authentication bypass | 10 September 2026 | 1.6% |
| CVE-2026-87491 | Google Chromium V8 | remote code execution | 9 September 2026 | 3.5% |
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | authentication bypass | 9 September 2026 | 89% |
| CVE-2026-19490 | Citrix NetScaler | authentication bypass | 9 September 2026 | 33% |
| CVE-2025-25249 | Fortinet Multiple Products | memory corruption | 9 September 2026 | 3.7% |
| CVE-2026-86218 | N-able N-central | remote code execution | 8 September 2026 | 15% |
| CVE-2026-85880 | Microsoft Windows | privilege escalation | 8 September 2026 | 0.4% |
| CVE-2026-81963 | Microsoft Windows | privilege escalation | 8 September 2026 | 7.1% |
| CVE-2026-75650 | Adobe Commerce and Magento | remote code execution | 8 September 2026 | 99% |
| CVE-2026-85046 | Google Chromium V8 | remote code execution | 4 September 2026 | 1.8% |
| CVE-2026-9586 | Sangoma Switchvox | remote code execution | 2 September 2026 | 19% |
| CVE-2026-83549 | SonicWall SMA1000 Appliances | remote code execution | 2 September 2026 | 9.9% |
| CVE-2026-83548 | SonicWall SMA1000 Appliances | server-side request forgery | 2 September 2026 | 8.0% |
| CVE-2026-82329 | JFrog Artifactory | authentication bypass | 2 September 2026 | 14% |
| CVE-2026-59822 | BerriAI LiteLLM | authentication bypass | 2 September 2026 | 0.8% |
| CVE-2026-49869 | Kestra OSS | command injection | 2 September 2026 | 2.1% |
| CVE-2026-48710 | Kludex Starlette | authentication bypass | 2 September 2026 | 70% |
| CVE-2026-82078 | PaperCut NG/MF | exploited vulnerability | 31 August 2026 | 63% |
| CVE-2026-81578 | PaperCut NG/MF | authentication bypass | 31 August 2026 | 85% |
| CVE-2026-66384 | JFrog Artifactory | exploited vulnerability | 27 August 2026 | 0.7% |
| CVE-2026-53362 | Linux Kernel | privilege escalation | 27 August 2026 | 0.7% |
| CVE-2023-49105 | ownCloud | authentication bypass | 27 August 2026 | 43% |
| CVE-2026-8452 | Citrix NetScaler ADC and NetScaler Gateway | denial of service | 26 August 2026 | 1.0% |
| CVE-2022-0995 | Linux Kernel | privilege escalation | 26 August 2026 | 8.9% |
| CVE-2021-23758 | Ajax.NET Professional | remote code execution | 26 August 2026 | 83% |
| CVE-2019-1068 | Microsoft SQL Server | remote code execution | 26 August 2026 | 57% |
| CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool | privilege escalation | 26 August 2026 | 5.0% |
| CVE-2015-3246 | Red Hat Libuser | privilege escalation | 26 August 2026 | 8.5% |
| CVE-2026-60004 | Gitea | exploited vulnerability | 25 August 2026 | 24% |
| CVE-2026-21962 | HTTP Server and Oracle Weblogic Server Proxy Plug-in | exploited vulnerability | 24 August 2026 | 73% |
| CVE-2026-73570 | Synacor Zimbra Collaboration Suite (ZCS) | command injection | 21 August 2026 | 77% |
| CVE-2026-72530 | TrueConf Server | remote code execution | 20 August 2026 | 1.7% |
| CVE-2026-72529 | TrueConf Server | authentication bypass | 20 August 2026 | 1.5% |
| CVE-2026-64849 | MLflow | server-side request forgery | 19 August 2026 | 10% |
| CVE-2026-65400 | Apple macOS | authentication bypass | 18 August 2026 | 18% |
| CVE-2026-59310 | Broadcom VMware vCenter | remote code execution | 18 August 2026 | 62% |
| CVE-2026-55040 | Microsoft SharePoint | exploited vulnerability | 18 August 2026 | 70% |
| CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions | remote code execution | 18 August 2026 | 77% |
| CVE-2025-62593 | Ray-Project Ray | remote code execution | 17 August 2026 | 60% |
| CVE-2026-72898 | Metabase | SQL injection | 11 August 2026 | 98% |
| CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock | privilege escalation | 11 August 2026 | 8.6% |
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | denial of service | 11 August 2026 | 1.0% |
| CVE-2026-8037 | Progress LoadMaster | command injection | 7 August 2026 | 100% |
| CVE-2026-63077 | JetBrains TeamCity | remote code execution | 5 August 2026 | 95% |
| CVE-2026-9198 | IBM Langflow | remote code execution | 4 August 2026 | 29% |
| CVE-2026-34486 | Apache Tomcat | exploited vulnerability | 4 August 2026 | 99% |
| CVE-2026-18556 | N-able N-central | authentication bypass | 4 August 2026 | 44% |
| CVE-2026-18577 | N-able N-central | authentication bypass | 3 August 2026 | 15% |
| CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | privilege escalation | 29 July 2026 | 35% |
| CVE-2026-16812 | Arista VeloCloud Orchestrator | command injection | 27 July 2026 | 1.8% |
| CVE-2025-68686 | Fortinet FortiOS | exploited vulnerability | 27 July 2026 | 29% |
| CVE-2026-50522 | Microsoft SharePoint | insecure deserialization | 22 July 2026 | 3.0% |
| CVE-2026-16232 | Check Point SmartConsole | authentication bypass | 22 July 2026 | 3.5% |
| CVE-2026-63030 | WordPress Core | remote code execution | 21 July 2026 | 11% |
| CVE-2026-60137 | WordPress Core | remote code execution | 21 July 2026 | 5.3% |
| CVE-2026-0770 | Langflow | remote code execution | 21 July 2026 | 63% |
| CVE-2021-27137 | DD-WRT | remote code execution | 21 July 2026 | 4.0% |
| CVE-2026-58644 | Microsoft SharePoint | insecure deserialization | 16 July 2026 | 16% |
| CVE-2026-39808 | Fortinet FortiSandbox | command injection | 16 July 2026 | 93% |
| CVE-2026-25089 | Fortinet FortiSandbox | command injection | 16 July 2026 | 76% |
| CVE-2026-46817 | Oracle E-Business Suite | privilege escalation | 15 July 2026 | 12% |
| CVE-2023-4346 | KNX Protocol Connection Authorization Option 1 | exploited vulnerability | 15 July 2026 | 1.4% |
| CVE-2026-56164 | Microsoft SharePoint Server | authentication bypass | 14 July 2026 | 27% |
| CVE-2026-56155 | Microsoft Active Directory Federation Services | privilege escalation | 14 July 2026 | 0.3% |
| CVE-2026-15410 | SonicWall SMA1000 Appliances | command injection | 14 July 2026 | 12% |
| CVE-2026-15409 | SonicWall SMA1000 Appliances | server-side request forgery | 14 July 2026 | 6.8% |
| CVE-2008-4128 | Cisco IOS | privilege escalation | 13 July 2026 | 34% |
| CVE-2026-56291 | Balbooa Forms | arbitrary file upload | 10 July 2026 | 15% |
| CVE-2026-48939 | iCagenda | exploited vulnerability | 10 July 2026 | 20% |
| CVE-2026-56290 | Joomlack Page Builder | remote code execution | 7 July 2026 | 31% |
| CVE-2026-55255 | Langflow | exploited vulnerability | 7 July 2026 | 0.9% |
| CVE-2026-48908 | JoomShaper SP Page Builder | exploited vulnerability | 7 July 2026 | 89% |
| CVE-2026-48282 | Adobe ColdFusion | remote code execution | 7 July 2026 | 42% |
| CVE-2026-45659 | Microsoft SharePoint Server | insecure deserialization | 1 July 2026 | 80% |
| CVE-2026-48558 | SimpleHelp | authentication bypass | 29 June 2026 | 80% |
| CVE-2026-20230 | Cisco Unified Communications Manager | server-side request forgery | 25 June 2026 | 89% |
| CVE-2026-12569 | PTC Windchill and FlexPLM | remote code execution | 25 June 2026 | 46% |
| CVE-2026-34910 | Ubiquiti UniFi OS | command injection | 23 June 2026 | 90% |
| CVE-2026-34909 | Ubiquiti UniFi OS | path traversal | 23 June 2026 | 69% |
| CVE-2026-34908 | Ubiquiti UniFi OS | exploited vulnerability | 23 June 2026 | 89% |
| CVE-2025-67038 | Lantronix EDS5000 | command injection | 23 June 2026 | 21% |
| CVE-2026-20253 | Splunk Enterprise | authentication bypass | 18 June 2026 | 97% |
| CVE-2026-48907 | Widget Factory Joomla Content Editor | exploited vulnerability | 16 June 2026 | 85% |
| CVE-2026-54420 | LiteSpeed cPanel Plugin | exploited vulnerability | 15 June 2026 | 1.4% |
| CVE-2026-20262 | Cisco Catalyst SD-WAN Manager | path traversal | 15 June 2026 | 29% |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | authentication bypass | 12 June 2026 | 97% |
| CVE-2026-10520 | Ivanti Sentry | remote code execution | 11 June 2026 | 100% |
| CVE-2026-7473 | Arista Extensible Operating System | exploited vulnerability | 9 June 2026 | 1.1% |
| CVE-2026-20245 | Cisco Catalyst SD-WAN Manager | exploited vulnerability | 9 June 2026 | 25% |
| CVE-2026-11645 | Google Chromium V8 | remote code execution | 9 June 2026 | 2.4% |
| CVE-2026-50751 | Check Point Security Gateway | authentication bypass | 8 June 2026 | 85% |
| CVE-2026-42271 | BerriAI LiteLLM | command injection | 8 June 2026 | 91% |
| CVE-2026-28318 | SolarWinds Serv-U | exploited vulnerability | 5 June 2026 | 48% |
| CVE-2026-45247 | Mirasvit Full Page Cache Warmer | remote code execution | 3 June 2026 | 26% |
| CVE-2025-48595 | Android Framework | remote code execution | 2 June 2026 | 1.9% |
| CVE-2022-0492 | Linux Kernel | authentication bypass | 2 June 2026 | 5.5% |
| CVE-2024-21182 | Oracle WebLogic Server | exploited vulnerability | 1 June 2026 | 74% |
| CVE-2026-0257 | Palo Alto Networks PAN-OS | authentication bypass | 29 May 2026 | 96% |
| CVE-2026-8398 | Daemon Tools Lite | exploited vulnerability | 27 May 2026 | 1.5% |
| CVE-2026-48027 | Nx Console | exploited vulnerability | 27 May 2026 | 1.8% |
| CVE-2026-45321 | TanStack | exploited vulnerability | 27 May 2026 | 3.3% |
| CVE-2026-48172 | LiteSpeed cPanel Plugin | privilege escalation | 26 May 2026 | 18% |
| CVE-2026-9082 | Drupal Core | remote code execution | 22 May 2026 | 89% |
| CVE-2026-34926 | Trend Micro Apex One | path traversal | 21 May 2026 | 13% |
| CVE-2025-34291 | Langflow | remote code execution | 21 May 2026 | 93% |
| CVE-2026-45498 | Microsoft Defender | denial of service | 20 May 2026 | 63% |
| CVE-2026-41091 | Microsoft Defender | privilege escalation | 20 May 2026 | 8.2% |
| CVE-2010-0806 | Microsoft Internet Explorer | remote code execution | 20 May 2026 | 82% |
| CVE-2010-0249 | Microsoft Internet Explorer | remote code execution | 20 May 2026 | 92% |
| CVE-2009-3459 | Adobe Acrobat and Reader | remote code execution | 20 May 2026 | 87% |
| CVE-2009-1537 | Microsoft DirectX | remote code execution | 20 May 2026 | 51% |
| CVE-2008-4250 | Microsoft Windows | remote code execution | 20 May 2026 | 99% |
| CVE-2026-42897 | Microsoft | cross-site scripting | 15 May 2026 | 71% |
| CVE-2026-20182 | Cisco Catalyst SD-WAN | authentication bypass | 14 May 2026 | 91% |
| CVE-2026-42208 | BerriAI LiteLLM | SQL injection | 8 May 2026 | 89% |
| CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) | remote code execution | 7 May 2026 | 34% |
| CVE-2026-0300 | Palo Alto Networks PAN-OS | remote code execution | 6 May 2026 | 42% |
| CVE-2026-31431 | Linux Kernel | privilege escalation | 1 May 2026 | 98% |
| CVE-2026-41940 | WebPros cPanel & WHM and WP2 (WordPress Squared) | authentication bypass | 30 April 2026 | 99% |
| CVE-2026-32202 | Microsoft Windows | exploited vulnerability | 28 April 2026 | 71% |
| CVE-2024-1708 | ConnectWise ScreenConnect | path traversal | 28 April 2026 | 95% |
| CVE-2025-29635 | D-Link DIR-823X | command injection | 24 April 2026 | 88% |
| CVE-2024-7399 | Samsung MagicINFO 9 Server | path traversal | 24 April 2026 | 92% |
| CVE-2024-57728 | SimpleHelp | remote code execution | 24 April 2026 | 64% |
| CVE-2024-57726 | SimpleHelp | privilege escalation | 24 April 2026 | 66% |
| CVE-2026-39987 | Marimo | remote code execution | 23 April 2026 | 100% |
| CVE-2026-33825 | Microsoft Defender | privilege escalation | 22 April 2026 | 6.9% |
| CVE-2026-20133 | Cisco Catalyst SD-WAN Manager | exploited vulnerability | 20 April 2026 | 35% |
| CVE-2026-20128 | Cisco Catalyst SD-WAN Manager | privilege escalation | 20 April 2026 | 8.3% |
| CVE-2026-20122 | Cisco Catalyst SD-WAN Manger | privilege escalation | 20 April 2026 | 26% |
| CVE-2025-48700 | Synacor Zimbra Collaboration Suite (ZCS) | cross-site scripting | 20 April 2026 | 1.7% |
| CVE-2025-32975 | Quest KACE Systems Management Appliance (SMA) | authentication bypass | 20 April 2026 | 2.5% |
| CVE-2025-2749 | Kentico Xperience | path traversal | 20 April 2026 | 4.0% |
| CVE-2024-27199 | JetBrains TeamCity | path traversal | 20 April 2026 | 100% |
| CVE-2023-27351 | PaperCut NG/MF | authentication bypass | 20 April 2026 | 78% |
| CVE-2026-34197 | Apache ActiveMQ | exploited vulnerability | 16 April 2026 | 98% |
| CVE-2026-32201 | Microsoft SharePoint Server | exploited vulnerability | 14 April 2026 | 44% |
| CVE-2009-0238 | Microsoft Office | remote code execution | 14 April 2026 | 43% |
| CVE-2026-34621 | Adobe Acrobat and Reader | remote code execution | 13 April 2026 | 7.3% |
| CVE-2026-21643 | Fortinet FortiClient EMS | SQL injection | 13 April 2026 | 98% |
| CVE-2025-60710 | Microsoft Windows | privilege escalation | 13 April 2026 | 4.6% |
| CVE-2023-36424 | Microsoft Windows | privilege escalation | 13 April 2026 | 12% |
| CVE-2023-21529 | Microsoft Exchange Server | remote code execution | 13 April 2026 | 59% |
| CVE-2020-9715 | Adobe Acrobat | remote code execution | 13 April 2026 | 33% |
| CVE-2012-1854 | Microsoft Visual Basic for Applications (VBA) | remote code execution | 13 April 2026 | 21% |
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) | remote code execution | 8 April 2026 | 99% |
| CVE-2026-35616 | Fortinet FortiClient EMS | exploited vulnerability | 6 April 2026 | 94% |
| CVE-2026-3502 | TrueConf Client | remote code execution | 2 April 2026 | 5.8% |
| CVE-2026-5281 | Google Dawn | remote code execution | 1 April 2026 | 14% |
| CVE-2026-3055 | Citrix NetScaler | memory corruption | 30 March 2026 | 91% |
| CVE-2025-53521 | F5 BIG-IP | remote code execution | 27 March 2026 | 2.3% |
| CVE-2026-33634 | Aquasecurity Trivy | exploited vulnerability | 26 March 2026 | 60% |
| CVE-2026-33017 | Langflow | exploited vulnerability | 25 March 2026 | 96% |
| CVE-2025-54068 | Laravel Livewire | exploited vulnerability | 20 March 2026 | 96% |
| CVE-2025-43520 | Apple Multiple Products | memory corruption | 20 March 2026 | 0.4% |
| CVE-2025-43510 | Apple Multiple Products | exploited vulnerability | 20 March 2026 | 0.4% |
| CVE-2025-32432 | Craft CMS | remote code execution | 20 March 2026 | 100% |
| CVE-2025-31277 | Apple Multiple Products | memory corruption | 20 March 2026 | 1.7% |
| CVE-2026-20131 | Cisco Secure Firewall Management Center (FMC) | insecure deserialization | 19 March 2026 | 44% |
| CVE-2026-20963 | Microsoft SharePoint | insecure deserialization | 18 March 2026 | 29% |
| CVE-2025-66376 | Synacor Zimbra Collaboration Suite (ZCS) | cross-site scripting | 18 March 2026 | 20% |
| CVE-2025-47813 | Wing FTP Server | information disclosure | 16 March 2026 | 63% |
| CVE-2026-3910 | Google Chromium V8 | remote code execution | 13 March 2026 | 2.7% |
| CVE-2026-3909 | Google Skia | memory corruption | 13 March 2026 | 2.3% |
| CVE-2025-68613 | n8n | remote code execution | 11 March 2026 | 99% |
| CVE-2026-1603 | Ivanti Endpoint Manager (EPM) | authentication bypass | 9 March 2026 | 88% |
| CVE-2025-26399 | SolarWinds Web Help Desk | insecure deserialization | 9 March 2026 | 91% |
| CVE-2021-22054 | Omnissa Workspace One UEM | server-side request forgery | 9 March 2026 | 100% |
| CVE-2023-43000 | Apple Multiple Products | memory corruption | 5 March 2026 | 4.0% |
| CVE-2023-41974 | Apple iOS and iPadOS | remote code execution | 5 March 2026 | 2.0% |
| CVE-2021-30952 | Apple Multiple Products | remote code execution | 5 March 2026 | 7.0% |
| CVE-2021-22681 | Rockwell Multiple Products | exploited vulnerability | 5 March 2026 | 64% |
| CVE-2017-7921 | Hikvision Multiple Products | authentication bypass | 5 March 2026 | 100% |
| CVE-2026-22719 | Broadcom VMware Aria Operations | remote code execution | 3 March 2026 | 18% |
| CVE-2026-21385 | Qualcomm Multiple Chipsets | exploited vulnerability | 3 March 2026 | 1.3% |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager | authentication bypass | 25 February 2026 | 88% |
| CVE-2022-20775 | Cisco SD-WAN | privilege escalation | 25 February 2026 | 12% |
| CVE-2026-25108 | Soliton Systems K.K FileZen | command injection | 24 February 2026 | 5.2% |
| CVE-2025-68461 | Roundcube Webmail | cross-site scripting | 20 February 2026 | 27% |
| CVE-2025-49113 | Roundcube Webmail | remote code execution | 20 February 2026 | 100% |
| CVE-2026-22769 | Dell RecoverPoint for Virtual Machines (RP4VMs) | exploited vulnerability | 18 February 2026 | 14% |
| CVE-2021-22175 | GitLab | server-side request forgery | 18 February 2026 | 53% |
| CVE-2026-2441 | Google Chromium | memory corruption | 17 February 2026 | 54% |
| CVE-2024-7694 | TeamT5 ThreatSonar Anti-Ransomware | privilege escalation | 17 February 2026 | 1.8% |
| CVE-2020-7796 | Synacor Zimbra Collaboration Suite | server-side request forgery | 17 February 2026 | 94% |
| CVE-2008-0015 | Microsoft Windows | remote code execution | 17 February 2026 | 77% |
| CVE-2026-1731 | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | command injection | 13 February 2026 | 94% |
| CVE-2026-20700 | Apple Multiple Products | remote code execution | 12 February 2026 | 1.7% |
| CVE-2025-40536 | SolarWinds Web Help Desk | exploited vulnerability | 12 February 2026 | 74% |
| CVE-2025-15556 | Notepad++ | remote code execution | 12 February 2026 | 1.7% |
| CVE-2024-43468 | Microsoft Configuration Manager | SQL injection | 12 February 2026 | 81% |
| CVE-2026-21533 | Microsoft Windows | privilege escalation | 10 February 2026 | 4.3% |
| CVE-2026-21525 | Microsoft Windows | exploited vulnerability | 10 February 2026 | 5.0% |
| CVE-2026-21519 | Microsoft Windows | privilege escalation | 10 February 2026 | 2.6% |
| CVE-2026-21514 | Microsoft Office | privilege escalation | 10 February 2026 | 1.6% |
| CVE-2026-21513 | Microsoft Windows | exploited vulnerability | 10 February 2026 | 16% |
| CVE-2026-21510 | Microsoft Windows | exploited vulnerability | 10 February 2026 | 61% |
| CVE-2026-24423 | SmarterTools SmarterMail | command injection | 5 February 2026 | 88% |
| CVE-2025-11953 | React Native Community CLI | command injection | 5 February 2026 | 94% |
| CVE-2025-64328 | Sangoma FreePBX | command injection | 3 February 2026 | 85% |
| CVE-2025-40551 | SolarWinds Web Help Desk | remote code execution | 3 February 2026 | 84% |
| CVE-2021-39935 | GitLab Community and Enterprise Editions | server-side request forgery | 3 February 2026 | 36% |
| CVE-2019-19006 | Sangoma FreePBX | authentication bypass | 3 February 2026 | 55% |
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) | remote code execution | 29 January 2026 | 99% |
| CVE-2026-24858 | Fortinet Multiple Products | authentication bypass | 27 January 2026 | 87% |
| CVE-2026-24061 | GNU InetUtils | authentication bypass | 26 January 2026 | 99% |
| CVE-2026-23760 | SmarterTools SmarterMail | authentication bypass | 26 January 2026 | 96% |
| CVE-2026-21509 | Microsoft Office | exploited vulnerability | 26 January 2026 | 71% |
| CVE-2025-52691 | SmarterTools SmarterMail | remote code execution | 26 January 2026 | 86% |
| CVE-2018-14634 | Linux Kernel | privilege escalation | 26 January 2026 | 15% |
| CVE-2024-37079 | Broadcom VMware vCenter Server | remote code execution | 23 January 2026 | 22% |
| CVE-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) | exploited vulnerability | 22 January 2026 | 51% |
| CVE-2025-54313 | eslint-config-prettier | exploited vulnerability | 22 January 2026 | 5.1% |
| CVE-2025-34026 | Versa Concerto | authentication bypass | 22 January 2026 | 82% |
| CVE-2025-31125 | Vitejs | exploited vulnerability | 22 January 2026 | 75% |
| CVE-2026-20045 | Cisco Unified Communications Manager | privilege escalation | 21 January 2026 | 4.5% |
| CVE-2026-20805 | Microsoft Windows | information disclosure | 13 January 2026 | 7.5% |
| CVE-2025-8110 | Gogs | remote code execution | 12 January 2026 | 80% |
| CVE-2025-37164 | Hewlett Packard Enterprise (HPE) OneView | remote code execution | 7 January 2026 | 90% |
| CVE-2009-0556 | Microsoft Office | remote code execution | 7 January 2026 | 67% |
| CVE-2025-14847 | MongoDB and MongoDB Server | exploited vulnerability | 29 December 2025 | 83% |
| CVE-2023-52163 | Digiever DS-2105 Pro | command injection | 22 December 2025 | 97% |
| CVE-2025-14733 | WatchGuard Firebox | remote code execution | 19 December 2025 | 29% |
| CVE-2025-59374 | ASUS Live Update | exploited vulnerability | 17 December 2025 | 1.2% |
| CVE-2025-40602 | SonicWall SMA1000 appliance | privilege escalation | 17 December 2025 | 2.8% |
| CVE-2025-20393 | Cisco Multiple Products | privilege escalation | 17 December 2025 | 32% |
| CVE-2025-59718 | Fortinet Multiple Products | exploited vulnerability | 16 December 2025 | 68% |
| CVE-2025-43529 | Apple Multiple Products | memory corruption | 15 December 2025 | 26% |
| CVE-2025-14611 | Gladinet CentreStack and Triofox | exploited vulnerability | 15 December 2025 | 55% |
| CVE-2025-14174 | Google Chromium | exploited vulnerability | 12 December 2025 | 43% |
| CVE-2018-4063 | Sierra Wireless AirLink ALEOS | exploited vulnerability | 12 December 2025 | 27% |
| CVE-2025-58360 | OSGeo GeoServer | exploited vulnerability | 11 December 2025 | 61% |
| CVE-2025-62221 | Microsoft Windows | privilege escalation | 9 December 2025 | 2.5% |
| CVE-2025-6218 | RARLAB WinRAR | path traversal | 9 December 2025 | 90% |
| CVE-2025-66644 | ArrayOS AG | command injection | 8 December 2025 | 3.3% |
| CVE-2022-37055 | D-Link Routers | memory corruption | 8 December 2025 | 56% |
| CVE-2025-55182 | Meta React Server Components | remote code execution | 5 December 2025 | 100% |
| CVE-2021-26828 | OpenPLC ScadaBR | exploited vulnerability | 3 December 2025 | 39% |
| CVE-2025-48633 | Android Framework | information disclosure | 2 December 2025 | 0.3% |
| CVE-2025-48572 | Android Framework | privilege escalation | 2 December 2025 | 0.3% |
| CVE-2021-26829 | OpenPLC ScadaBR | cross-site scripting | 28 November 2025 | 48% |
| CVE-2025-61757 | Oracle Fusion Middleware | authentication bypass | 21 November 2025 | 89% |
| CVE-2025-13223 | Google Chromium V8 | memory corruption | 19 November 2025 | 4.9% |
| CVE-2025-58034 | Fortinet FortiWeb | command injection | 18 November 2025 | 55% |
| CVE-2025-64446 | Fortinet FortiWeb | path traversal | 14 November 2025 | 91% |
| CVE-2025-9242 | WatchGuard Firebox | remote code execution | 12 November 2025 | 92% |
| CVE-2025-62215 | Microsoft Windows | privilege escalation | 12 November 2025 | 4.5% |
| CVE-2025-12480 | Gladinet Triofox | exploited vulnerability | 12 November 2025 | 96% |
| CVE-2025-21042 | Samsung Mobile Devices | remote code execution | 10 November 2025 | 36% |
Sources: CISA Known Exploited Vulnerabilities catalogue (released 10 November 2026) and FIRST EPSS, compiled 13 November 2026.