Exploited vulnerabilities
The vulnerabilities attackers actually use, gathered from public sources and ranked by priority. Updated automatically, every day.
1,784exploited vulnerabilities tracked
7added in 7 days
36added in 30 days
38rising fast
361used by ransomware
665to fix within 24 h
| CVE | Product | EPSS |
|---|---|---|
| CVE-2023-41992 | Apple Multiple Products Kernel Privilege Escalation Vulnerability | 9.5% |
| CVE-2023-41991 | Apple Multiple Products Improper Certificate Validation Vulnerability | 13.4% |
| CVE-2023-41179 | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability | 4.2% |
| CVE-2023-28434 | MinIO Security Feature Bypass Vulnerability | 7.9% |
| CVE-2022-22265 | Samsung Mobile Devices Use-After-Free Vulnerability | 0.42% |
| CVE-2021-3129 | Laravel Ignition File Upload Vulnerability | 99.9% |
| CVE-2017-6884 | Zyxel EMG2926 Routers Command Injection Vulnerability | 33.0% |
| CVE-2014-8361 | Realtek SDK Improper Input Validation Vulnerability | 99.97% |
| CVE-2023-26369 | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | 6.7% |
| CVE-2023-35674 | Android Framework Privilege Escalation Vulnerability | 2.6% |
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | 26.6% |
| CVE-2023-4863 | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | 99.98% |
| CVE-2023-36802 | Microsoft Streaming Service Proxy Privilege Escalation Vulnerability | 27.9% |
| CVE-2023-36761 | Microsoft Word Information Disclosure Vulnerability | 19.6% |
| CVE-2023-41064 | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability | 53.4% |
| CVE-2023-41061 | Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability | 4.4% |
| CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability | 96.6% |
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | 99.8% |
| CVE-2023-32315 | Ignite Realtime Openfire Path Traversal Vulnerability | 100.00% |
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | 99.9% |
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | 80.6% |
| CVE-2023-26359 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 17.0% |
| CVE-2023-24489 | Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | 97.3% |
| CVE-2023-38180 | Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability | 14.1% |
| CVE-2017-18368 | Zyxel P660HN-T1A Routers Command Injection Vulnerability | 94.5% |
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | 63.6% |
| CVE-2023-37580 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 49.1% |
| CVE-2023-38606 | Apple Multiple Products Kernel Unspecified Vulnerability | 2.9% |
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability | 100.00% |
| CVE-2023-38205 | Adobe ColdFusion Improper Access Control Vulnerability | 99.8% |
How we rank vulnerabilities
A vulnerability joins this list as soon as CISA adds it to its KEV catalog or ENISA flags it as exploited in the EUVD.
The CheckOps priority index, out of 10, combines severity (CVSS), the probability of exploitation within 30 days (EPSS, FIRST) and public exploitation signals.
Above 8, we recommend patching within 24 hours; above 6, or as soon as a vulnerability is exploited, within 7 days.
Sources: CISA KEV · ENISA EUVD · FIRST EPSS · OSV. Public data aggregated by CheckOps, updated automatically. Source texts remain the property of their authors.