Exploited vulnerabilities
The vulnerabilities attackers actually use, gathered from public sources and ranked by priority. Updated automatically, every day.
1,786exploited vulnerabilities tracked
5added in 7 days
38added in 30 days
38rising fast
361used by ransomware
667to fix within 24 h
| CVE | Product | EPSS |
|---|---|---|
| CVE-2018-13383 | Fortinet FortiOS and FortiProxy Out-of-bounds Write | 32.5% |
| CVE-2018-13382 | Fortinet FortiOS and FortiProxy Improper Authorization | 81.7% |
| CVE-2017-1000486 | Primetek Primefaces Remote Code Execution Vulnerability | 94.1% |
| CVE-2015-7450 | IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. | 97.8% |
| CVE-2013-3900 | Microsoft WinVerifyTrust function Remote Code Execution | 44.6% |
| CVE-2021-43890 | Microsoft Windows AppX Installer Spoofing Vulnerability | 11.3% |
| CVE-2021-4102 | Google Chromium V8 Use-After-Free Vulnerability | 7.8% |
| CVE-2021-44515 | Zoho Desktop Central Authentication Bypass Vulnerability | 99.9% |
| CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability | 100.00% |
| CVE-2021-44168 | Fortinet FortiOS Arbitrary File Download | 0.91% |
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | 99.9% |
| CVE-2020-17463 | Fuel CMS SQL Injection Vulnerability | 89.7% |
| CVE-2020-8816 | Pi-Hole AdminLTE Remote Code Execution Vulnerability | 78.3% |
| CVE-2019-13272 | Linux Kernel Improper Privilege Management Vulnerability | 52.2% |
| CVE-2019-10758 | MongoDB mongo-express Remote Code Execution Vulnerability | 84.7% |
| CVE-2019-7238 | Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability | 76.6% |
| CVE-2019-0193 | Apache Solr DataImportHandler Code Injection Vulnerability | 83.5% |
| CVE-2017-17562 | Embedthis GoAhead Remote Code Execution Vulnerability | 97.1% |
| CVE-2017-12149 | Red Hat JBoss Application Server Remote Code Execution Vulnerability | 90.7% |
| CVE-2010-1871 | Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability | 83.4% |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | 93.3% |
| CVE-2021-40438 | Apache HTTP Server-Side Request Forgery (SSRF) | 100.00% |
| CVE-2021-37415 | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | 99.8% |
| CVE-2020-11261 | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | 1.5% |
| CVE-2018-14847 | MikroTik Router OS Directory Traversal Vulnerability | 96.0% |
| CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability | 91.7% |
| CVE-2021-42292 | Microsoft Excel Security Feature Bypass | 43.0% |
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | 81.9% |
| CVE-2021-22204 | ExifTool Remote Code Execution VulnerabilityPerl | 99.98% |
| CVE-2021-42258 | BQE BillQuick Web Suite SQL Injection Vulnerability | 75.2% |
How we rank vulnerabilities
A vulnerability joins this list as soon as CISA adds it to its KEV catalog or ENISA flags it as exploited in the EUVD.
The CheckOps priority index, out of 10, combines severity (CVSS), the probability of exploitation within 30 days (EPSS, FIRST) and public exploitation signals.
Above 8, we recommend patching within 24 hours; above 6, or as soon as a vulnerability is exploited, within 7 days.
Sources: CISA KEV · ENISA EUVD · FIRST EPSS · OSV. Public data aggregated by CheckOps, updated automatically. Source texts remain the property of their authors.