Exploited vulnerabilities
The vulnerabilities attackers actually use, gathered from public sources and ranked by priority. Updated automatically, every day.
1,784exploited vulnerabilities tracked
7added in 7 days
36added in 30 days
38rising fast
361used by ransomware
665to fix within 24 h
| CVE | Product | EPSS |
|---|---|---|
| CVE-2023-36025 | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 88.2% |
| CVE-2023-47246 | SysAid Server Path Traversal Vulnerability | 98.9% |
| CVE-2023-36851 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | 1.1% |
| CVE-2023-36847 | Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability | 83.5% |
| CVE-2023-36846 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | 93.5% |
| CVE-2023-36845 | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability | 95.1% |
| CVE-2023-36844 | Juniper Junos OS EX Series PHP External Variable Modification Vulnerability | 90.0% |
| CVE-2023-29552 | Service Location Protocol (SLP) Denial-of-Service VulnerabilityIETF | 64.0% |
| CVE-2023-22518 | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability | 100.00% |
| CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | 99.99% |
| CVE-2023-46748 | F5 BIG-IP Configuration Utility SQL Injection Vulnerability | 4.3% |
| CVE-2023-46747 | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | 96.7% |
| CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 76.3% |
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability | 92.9% |
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | 100.00% |
| CVE-2023-20198 | Cisco IOS XE Web UI Privilege Escalation Vulnerability | 99.6% |
| CVE-2023-44487 | HTTP/2 Rapid Reset Attack VulnerabilityIETF | 100.00% |
| CVE-2023-41763 | Microsoft Skype for Business Privilege Escalation Vulnerability | 90.3% |
| CVE-2023-36563 | Microsoft WordPad Information Disclosure Vulnerability | 20.3% |
| CVE-2023-21608 | Adobe Acrobat and Reader Use-After-Free Vulnerability | 59.4% |
| CVE-2023-20109 | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | 2.5% |
| CVE-2023-42824 | Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability | 0.97% |
| CVE-2023-40044 | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | 90.4% |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | 99.2% |
| CVE-2023-42793 | JetBrains TeamCity Authentication Bypass Vulnerability | 99.99% |
| CVE-2023-28229 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | 1.7% |
| CVE-2023-4211 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | 0.97% |
| CVE-2023-5217 | Google Chromium libvpx Heap Buffer Overflow Vulnerability | 49.0% |
| CVE-2018-14667 | Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability | 74.2% |
| CVE-2023-41993 | Apple Multiple Products WebKit Code Execution Vulnerability | 24.3% |
How we rank vulnerabilities
A vulnerability joins this list as soon as CISA adds it to its KEV catalog or ENISA flags it as exploited in the EUVD.
The CheckOps priority index, out of 10, combines severity (CVSS), the probability of exploitation within 30 days (EPSS, FIRST) and public exploitation signals.
Above 8, we recommend patching within 24 hours; above 6, or as soon as a vulnerability is exploited, within 7 days.
Sources: CISA KEV · ENISA EUVD · FIRST EPSS · OSV. Public data aggregated by CheckOps, updated automatically. Source texts remain the property of their authors.