Exploited vulnerabilities
The vulnerabilities attackers actually use, gathered from public sources and ranked by priority. Updated automatically, every day.
1,783exploited vulnerabilities tracked
8added in 7 days
35added in 30 days
37rising fast
361used by ransomware
665to fix within 24 h
| CVE | Product | EPSS |
|---|---|---|
| CVE-2026-9198 | IBM Langflow Code Injection Vulnerability | 28.7% |
| CVE-2026-18577 | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | 14.6% |
| CVE-2026-20316 | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | 35.1% |
| CVE-2026-16812 | Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability | 1.8% |
| CVE-2025-68686 | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 29.5% |
| CVE-2026-50522 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 3.0% |
| CVE-2026-16232 | Check Point SmartConsole Improper Authentication Vulnerability | 3.5% |
| CVE-2026-63030 | WordPress Core Interpretation Conflict Vulnerability | 10.6% |
| CVE-2026-60137 | WordPress Core SQL Injection Vulnerability | 5.3% |
| CVE-2026-0770 | Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability | 62.6% |
| CVE-2021-27137 | DD-WRT Stack-Based Buffer Overflow Vulnerability | 4.0% |
| CVE-2026-58644 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 15.9% |
| CVE-2026-39808 | Fortinet FortiSandbox OS Command Injection Vulnerability | 93.2% |
| CVE-2026-25089 | Fortinet FortiSandbox OS Command Injection Vulnerability | 76.1% |
| CVE-2026-46817 | Oracle E-Business Suite Improper Privilege Management Vulnerability | 12.3% |
| CVE-2023-4346 | KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability | 1.4% |
| CVE-2026-56164 | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | 1.0% |
| CVE-2026-56155 | Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | 0.35% |
| CVE-2026-15410 | SonicWall SMA1000 Appliances Code Injection Vulnerability | 11.8% |
| CVE-2026-15409 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | 6.8% |
| CVE-2008-4128 | Cisco IOS Cross-Site Request Forgery Vulnerability | 33.9% |
| CVE-2026-56291 | Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | 14.9% |
| CVE-2026-49049 | joomshaper.com Helix3 extension for Joomla | 0.99% |
| CVE-2026-48939 | iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability | 20.1% |
| CVE-2026-56290 | Joomlack Page Builder Improper Access Control Vulnerability | 30.9% |
| CVE-2026-55255 | Langflow Authorization Bypass Through User-Controlled Key Vulnerability | 0.89% |
| CVE-2026-48282 | Adobe ColdFusion Path Traversal Vulnerability | 42.4% |
| CVE-2026-48908 | JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability | 88.5% |
| CVE-2026-45659 | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability | 80.2% |
| CVE-2026-48558 | SimpleHelp Authentication Bypass Vulnerability | 77.7% |
How we rank vulnerabilities
A vulnerability joins this list as soon as CISA adds it to its KEV catalog or ENISA flags it as exploited in the EUVD.
The CheckOps priority index, out of 10, combines severity (CVSS), the probability of exploitation within 30 days (EPSS, FIRST) and public exploitation signals.
Above 8, we recommend patching within 24 hours; above 6, or as soon as a vulnerability is exploited, within 7 days.
Sources: CISA KEV · ENISA EUVD · FIRST EPSS · OSV. Public data aggregated by CheckOps, updated automatically. Source texts remain the property of their authors.