Exploited Vulnerabilities DailyTop 100 KEV entries by EPSS
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2024-27199 | JetBrains TeamCity | 2026-04-20 | 99.9% | Known |
| CVE-2017-7921 | Hikvision Multiple Products | 2026-03-05 | 99.9% | Unknown |
| CVE-2025-59287 | Microsoft Windows | 2025-10-24 | 99.9% | Unknown |
| CVE-2025-49704 | Microsoft SharePoint | 2025-07-22 | 99.9% | Known |
| CVE-2025-53770 | Microsoft SharePoint | 2025-07-20 | 99.9% | Known |
| CVE-2025-5777 | Citrix NetScaler ADC and Gateway | 2025-07-10 | 99.9% | Known |
| CVE-2025-3248 | Langflow Langflow | 2025-05-05 | 99.9% | Known |
| CVE-2024-38475 | Apache HTTP Server | 2025-05-01 | 99.9% | Unknown |
| CVE-2025-31161 | CrushFTP CrushFTP | 2025-04-07 | 99.9% | Known |
| CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 2025-04-04 | 99.9% | Known |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) | 2025-03-10 | 99.9% | Unknown |
| CVE-2024-45195 | Apache OFBiz | 2025-02-04 | 99.9% | Unknown |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 2025-01-08 | 99.9% | Known |
| CVE-2021-26086 | Atlassian Jira Server and Data Center | 2024-11-12 | 99.9% | Unknown |
| CVE-2024-7593 | Ivanti Virtual Traffic Manager | 2024-09-24 | 99.9% | Unknown |
| CVE-2021-33044 | Dahua IP Camera Firmware | 2024-08-21 | 99.9% | Unknown |
| CVE-2024-23897 | Jenkins Jenkins Command Line Interface (CLI) | 2024-08-19 | 99.9% | Known |
| CVE-2024-4879 | ServiceNow Utah, Vancouver, and Washington DC Now Platform | 2024-07-29 | 99.9% | Unknown |
| CVE-2024-34102 | Adobe Commerce and Magento Open Source | 2024-07-17 | 99.9% | Unknown |
| CVE-2024-4577 | PHP Group PHP | 2024-06-12 | 99.9% | Known |
| CVE-2024-24919 | Check Point Quantum Security Gateways | 2024-05-30 | 99.9% | Known |
| CVE-2024-3400 | Palo Alto Networks PAN-OS | 2024-04-12 | 99.9% | Known |
| CVE-2024-3273 | D-Link Multiple NAS Devices | 2024-04-11 | 99.9% | Unknown |
| CVE-2024-1709 | ConnectWise ScreenConnect | 2024-02-22 | 99.9% | Known |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons | 2024-01-31 | 99.9% | Known |
| CVE-2023-22527 | Atlassian Confluence Data Center and Server | 2024-01-24 | 99.9% | Known |
| CVE-2023-35082 | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core | 2024-01-18 | 99.9% | Known |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure | 2024-01-10 | 99.9% | Known |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure | 2024-01-10 | 99.9% | Known |
| CVE-2023-29357 | Microsoft SharePoint Server | 2024-01-10 | 99.9% | Known |
| CVE-2023-29300 | Adobe ColdFusion | 2024-01-08 | 99.9% | Known |
| CVE-2023-1671 | Sophos Web Appliance | 2023-11-16 | 99.9% | Unknown |
| CVE-2023-22518 | Atlassian Confluence Data Center and Server | 2023-11-07 | 99.9% | Known |
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway | 2023-10-18 | 99.9% | Known |
| CVE-2023-44487 | IETF HTTP/2 | 2023-10-10 | 99.9% | Unknown |
| CVE-2023-42793 | JetBrains TeamCity | 2023-10-04 | 99.9% | Known |
| CVE-2014-8361 | Realtek SDK | 2023-09-18 | 99.9% | Unknown |
| CVE-2023-4863 | Google Chromium WebP | 2023-09-13 | 99.9% | Unknown |
| CVE-2023-32315 | Ignite Realtime Openfire | 2023-08-24 | 99.9% | Unknown |
| CVE-2023-38035 | Ivanti Sentry | 2023-08-22 | 99.9% | Known |
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile (EPMM) | 2023-07-25 | 99.9% | Known |
| CVE-2023-1389 | TP-Link Archer AX21 | 2023-05-01 | 99.9% | Unknown |
| CVE-2021-45046 | Apache Log4j2 | 2023-05-01 | 99.9% | Known |
| CVE-2023-27350 | PaperCut MF/NG | 2023-04-21 | 99.9% | Known |
| CVE-2022-47986 | IBM Aspera Faspex | 2023-02-21 | 99.9% | Known |
| CVE-2023-0669 | Fortra GoAnywhere MFT | 2023-02-10 | 99.9% | Known |
| CVE-2022-44877 | CWP Control Web Panel | 2023-01-17 | 99.9% | Unknown |
| CVE-2022-40684 | Fortinet Multiple Products | 2022-10-11 | 99.9% | Known |
| CVE-2022-41082 | Microsoft Exchange Server | 2022-09-30 | 99.9% | Known |
| CVE-2022-41040 | Microsoft Exchange Server | 2022-09-30 | 99.9% | Known |
| CVE-2018-2628 | Oracle WebLogic Server | 2022-09-08 | 99.9% | Unknown |
| CVE-2022-26134 | Atlassian Confluence Server/Data Center | 2022-06-02 | 99.9% | Known |
| CVE-2022-1388 | F5 BIG-IP | 2022-05-10 | 99.9% | Known |
| CVE-2014-0160 | OpenSSL OpenSSL | 2022-05-04 | 99.9% | Unknown |
| CVE-2022-29464 | WSO2 Multiple Products | 2022-04-25 | 99.9% | Known |
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager | 2022-04-14 | 99.9% | Known |
| CVE-2021-3156 | Sudo Sudo | 2022-04-06 | 99.9% | Unknown |
| CVE-2018-10562 | Dasan Gigabit Passive Optical Network (GPON) Routers | 2022-03-31 | 99.9% | Known |
| CVE-2020-9054 | Zyxel Multiple Network-Attached Storage (NAS) Devices | 2022-03-25 | 99.9% | Unknown |
| CVE-2019-16920 | D-Link Multiple Routers | 2022-03-25 | 99.9% | Unknown |
| CVE-2017-12617 | Apache Tomcat | 2022-03-25 | 99.9% | Unknown |
| CVE-2013-2251 | Apache Struts | 2022-03-25 | 99.9% | Unknown |
| CVE-2012-1823 | PHP PHP | 2022-03-25 | 99.9% | Unknown |
| CVE-2017-9841 | PHPUnit PHPUnit | 2022-02-15 | 99.9% | Unknown |
| CVE-2017-10271 | Oracle WebLogic Server | 2022-02-10 | 99.9% | Known |
| CVE-2015-1635 | Microsoft HTTP.sys | 2022-02-10 | 99.9% | Unknown |
| CVE-2014-6271 | GNU Bourne-Again Shell (Bash) | 2022-01-28 | 99.9% | Unknown |
| CVE-2019-9670 | Synacor Zimbra Collaboration Suite (ZCS) | 2022-01-10 | 99.9% | Unknown |
| CVE-2019-2725 | Oracle WebLogic Server | 2022-01-10 | 99.9% | Known |
| CVE-2019-10149 | Exim Mail Transfer Agent (MTA) | 2022-01-10 | 99.9% | Unknown |
| CVE-2021-44228 | Apache Log4j2 | 2021-12-10 | 99.9% | Known |
| CVE-2021-40438 | Apache Apache | 2021-12-01 | 99.9% | Known |
| CVE-2021-22204 | Perl Exiftool | 2021-11-17 | 99.9% | Unknown |
| CVE-2021-42013 | Apache HTTP Server | 2021-11-03 | 99.9% | Known |
| CVE-2021-41773 | Apache HTTP Server | 2021-11-03 | 99.9% | Known |
| CVE-2021-35464 | ForgeRock Access Management (AM) | 2021-11-03 | 99.9% | Known |
| CVE-2021-34523 | Microsoft Exchange Server | 2021-11-03 | 99.9% | Known |
| CVE-2021-34473 | Microsoft Exchange Server | 2021-11-03 | 99.9% | Known |
| CVE-2021-26855 | Microsoft Exchange Server | 2021-11-03 | 99.9% | Known |
| CVE-2021-26084 | Atlassian Confluence Server and Data Center | 2021-11-03 | 99.9% | Known |
| CVE-2021-22005 | VMware vCenter Server | 2021-11-03 | 99.9% | Known |
| CVE-2021-21985 | VMware vCenter Server | 2021-11-03 | 99.9% | Known |
| CVE-2021-20090 | Arcadyan Buffalo Firmware | 2021-11-03 | 99.9% | Unknown |
| CVE-2021-1498 | Cisco HyperFlex HX | 2021-11-03 | 99.9% | Unknown |
| CVE-2020-8515 | DrayTek Multiple Vigor Routers | 2021-11-03 | 99.9% | Unknown |
| CVE-2020-5902 | F5 BIG-IP | 2021-11-03 | 99.9% | Known |
| CVE-2020-3452 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | 2021-11-03 | 99.9% | Unknown |
| CVE-2020-25506 | D-Link DNS-320 Device | 2021-11-03 | 99.9% | Unknown |
| CVE-2020-14882 | Oracle WebLogic Server | 2021-11-03 | 99.9% | Unknown |
| CVE-2020-0688 | Microsoft Exchange Server | 2021-11-03 | 99.9% | Known |
| CVE-2019-19781 | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 2021-11-03 | 99.9% | Known |
| CVE-2019-11510 | Ivanti Pulse Connect Secure | 2021-11-03 | 99.9% | Known |
| CVE-2019-0708 | Microsoft Remote Desktop Services | 2021-11-03 | 99.9% | Known |
| CVE-2018-7600 | Drupal Drupal Core | 2021-11-03 | 99.9% | Known |
| CVE-2018-15961 | Adobe ColdFusion | 2021-11-03 | 99.9% | Unknown |
| CVE-2018-13379 | Fortinet FortiOS | 2021-11-03 | 99.9% | Known |
| CVE-2018-11776 | Apache Struts | 2021-11-03 | 99.9% | Unknown |
| CVE-2017-5638 | Apache Struts | 2021-11-03 | 99.9% | Known |
| CVE-2017-11882 | Microsoft Office | 2021-11-03 | 99.9% | Known |
| CVE-2012-0158 | Microsoft MSCOMCTL.OCX | 2021-11-03 | 99.9% | Known |
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.