Exploited vulnerabilities
The vulnerabilities attackers actually use, gathered from public sources and ranked by priority. Updated automatically, every day.
1,786exploited vulnerabilities tracked
5added in 7 days
38added in 30 days
39rising fast
361used by ransomware
667to fix within 24 h
| CVE | Product | EPSS |
|---|---|---|
| CVE-2020-8467 | Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability | 10.9% |
| CVE-2020-8260 | Ivanti Pulse Connect Secure Code Execution Vulnerability | 96.5% |
| CVE-2020-8243 | Ivanti Pulse Connect Secure Code Execution Vulnerability | 90.8% |
| CVE-2020-8196 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | 26.3% |
| CVE-2020-8195 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | 33.0% |
| CVE-2020-8193 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | 88.3% |
| CVE-2020-7961 | Liferay Portal Deserialization of Untrusted Data Vulnerability | 99.9% |
| CVE-2020-6820 | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | 7.1% |
| CVE-2020-6819 | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | 3.0% |
| CVE-2020-6418 | Google Chromium V8 Type Confusion Vulnerability | 78.8% |
| CVE-2020-6287 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | 94.7% |
| CVE-2020-6207 | SAP Solution Manager Missing Authentication for Critical Function Vulnerability | 98.1% |
| CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | 100.00% |
| CVE-2020-5849 | Unraid Authentication Bypass Vulnerability | 93.2% |
| CVE-2020-5847 | Unraid Remote Code Execution Vulnerability | 95.8% |
| CVE-2020-5735 | Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability | 36.2% |
| CVE-2020-4430 | IBM Data Risk Manager Directory Traversal Vulnerability | 68.5% |
| CVE-2020-4428 | IBM Data Risk Manager Remote Code Execution Vulnerability | 61.7% |
| CVE-2020-4427 | IBM Data Risk Manager Security Bypass Vulnerability | 70.0% |
| CVE-2020-4006 | Multiple VMware Products Command Injection Vulnerability | 17.3% |
| CVE-2020-3992 | VMware ESXi OpenSLP Use-After-Free Vulnerability | 83.0% |
| CVE-2020-3952 | VMware vCenter Server Information Disclosure Vulnerability | 90.4% |
| CVE-2020-3950 | VMware Multiple Products Privilege Escalation Vulnerability | 7.3% |
| CVE-2020-3580 | Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability | 85.6% |
| CVE-2020-3569 | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 3.3% |
| CVE-2020-3566 | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | 3.7% |
| CVE-2020-3452 | Cisco ASA and FTD Read-Only Path Traversal Vulnerability | 99.99% |
| CVE-2020-3161 | Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability | 83.9% |
| CVE-2020-3118 | Cisco IOS XR Software Discovery Protocol Format String Vulnerability | 11.7% |
| CVE-2020-2555 | Oracle Multiple Products Remote Code Execution Vulnerability | 97.1% |
How we rank vulnerabilities
A vulnerability joins this list as soon as CISA adds it to its KEV catalog or ENISA flags it as exploited in the EUVD.
The CheckOps priority index, out of 10, combines severity (CVSS), the probability of exploitation within 30 days (EPSS, FIRST) and public exploitation signals.
Above 8, we recommend patching within 24 hours; above 6, or as soon as a vulnerability is exploited, within 7 days.
Sources: CISA KEV · ENISA EUVD · FIRST EPSS · OSV. Public data aggregated by CheckOps, updated automatically. Source texts remain the property of their authors.