Exploited vulnerabilities
The vulnerabilities attackers actually use, gathered from public sources and ranked by priority. Updated automatically, every day.
1,783exploited vulnerabilities tracked
8added in 7 days
35added in 30 days
37rising fast
361used by ransomware
665to fix within 24 h
| CVE | Product | EPSS |
|---|---|---|
| CVE-2026-20230 | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | 88.5% |
| CVE-2026-12569 | PTC Windchill and FlexPLM Improper Input Validation Vulnerability | 46.0% |
| CVE-2026-34910 | Ubiquiti UniFi OS Improper Input Validation Vulnerability | 90.0% |
| CVE-2026-34909 | Ubiquiti UniFi OS Path Traversal Vulnerability | 68.0% |
| CVE-2026-34908 | Ubiquiti UniFi OS Improper Access Control Vulnerability | 88.3% |
| CVE-2025-67038 | Lantronix EDS5000 Code Injection Vulnerability | 20.3% |
| CVE-2026-20253 | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | 96.9% |
| CVE-2026-48907 | Widget Factory Joomla Content Editor Improper Access Control Vulnerability | 85.4% |
| CVE-2026-54420 | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | 1.4% |
| CVE-2026-20262 | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | 29.1% |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | 96.7% |
| CVE-2026-10520 | Ivanti Sentry OS Command Injection Vulnerability | 99.9% |
| CVE-2026-20245 | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | 25.3% |
| CVE-2026-11645 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 2.4% |
| CVE-2026-7473 | Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability | 1.1% |
| CVE-2026-50751 | Check Point Security Gateway Improper Authentication Vulnerability | 85.3% |
| CVE-2026-42271 | BerriAI LiteLLM Command Injection Vulnerability | 91.4% |
| CVE-2026-28318 | SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | 43.7% |
| CVE-2026-45247 | Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability | 26.2% |
| CVE-2025-48595 | Android Framework Integer Overflow Vulnerability | 1.9% |
| CVE-2022-0492 | Linux Kernel Improper Authentication Vulnerability | 5.5% |
| CVE-2024-21182 | Oracle WebLogic Server Unspecified Vulnerability | 74.2% |
| CVE-2026-0257 | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | 95.6% |
| CVE-2026-48027 | Nx Console Embedded Malicious Code Vulnerability | 1.9% |
| CVE-2026-45321 | TanStack Unspecified Vulnerability | 3.3% |
| CVE-2026-8398 | Daemon Tools Lite Embedded Malicious Code Vulnerability | 1.5% |
| CVE-2026-48172 | LiteSpeed cPanel Plugin Privilege Escalation Vulnerability | 17.9% |
| CVE-2026-9082 | Drupal Core SQL Injection Vulnerability | 89.4% |
| CVE-2026-34926 | Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability | 13.4% |
| CVE-2025-34291 | Langflow Origin Validation Error Vulnerability | 92.8% |
How we rank vulnerabilities
A vulnerability joins this list as soon as CISA adds it to its KEV catalog or ENISA flags it as exploited in the EUVD.
The CheckOps priority index, out of 10, combines severity (CVSS), the probability of exploitation within 30 days (EPSS, FIRST) and public exploitation signals.
Above 8, we recommend patching within 24 hours; above 6, or as soon as a vulnerability is exploited, within 7 days.
Sources: CISA KEV · ENISA EUVD · FIRST EPSS · OSV. Public data aggregated by CheckOps, updated automatically. Source texts remain the property of their authors.