Exploited CVEs / By vendor
Actively exploited vulnerabilities by vendor
Every vendor with 5 or more CVEs on the CISA Known Exploited Vulnerabilities catalog. Refreshed daily; vendors join the list automatically as CISA catalogs their CVEs.
| Vendor | Exploited CVEs | Ransomware-linked | Newest addition |
|---|---|---|---|
| Microsoft | 390 | 117 | CVE-2026-96951 (2026-10-13) |
| Cisco | 102 | 7 | CVE-2026-76418 (2026-10-29) |
| Apple | 95 | - | CVE-2026-86950 (2026-09-29) |
| Adobe | 83 | 11 | CVE-2026-48356 (2026-10-27) |
| 76 | - | CVE-2026-111497 (2026-10-27) | |
| Oracle | 46 | 13 | CVE-2026-21962 (2026-08-24) |
| Apache | 41 | 8 | CVE-2016-3081 (2026-10-08) |
| Ivanti | 38 | 12 | CVE-2026-111357 (2026-10-30) |
| Linux | 32 | 2 | CVE-2026-46300 (2026-10-28) |
| Fortinet | 32 | 14 | CVE-2025-61624 (2026-10-16) |
| Citrix | 27 | 7 | CVE-2026-88779 (2026-10-04) |
| D-Link | 26 | 2 | CVE-2025-29635 (2026-04-24) |
| VMware | 26 | 9 | CVE-2025-22224 (2025-03-04) |
| SonicWall | 19 | 13 | CVE-2026-83548 (2026-09-02) |
| Synacor | 19 | 6 | CVE-2026-73570 (2026-08-21) |
| Android | 17 | - | CVE-2025-48595 (2026-06-02) |
| Palo Alto Networks | 16 | 6 | CVE-2026-0322 (2026-10-14) |
| Samsung | 15 | - | CVE-2024-7399 (2026-04-24) |
| Atlassian | 14 | 8 | CVE-2026-21589 (2026-10-15) |
| SAP | 14 | 3 | CVE-2025-42999 (2025-05-15) |
| Zyxel | 13 | 2 | CVE-2026-7273 (2026-09-21) |
| Mozilla | 13 | 1 | CVE-2010-3765 (2025-10-06) |
| Trend Micro | 12 | - | CVE-2026-34926 (2026-05-21) |
| Qualcomm | 12 | - | CVE-2026-21385 (2026-03-03) |
| SolarWinds | 11 | 2 | CVE-2026-28318 (2026-06-05) |
| Roundcube | 11 | - | CVE-2025-49113 (2026-02-20) |
| QNAP | 11 | 9 | CVE-2023-47565 (2023-12-21) |
| Red Hat | 9 | 4 | CVE-2015-3246 (2026-08-26) |
| Progress | 9 | 4 | CVE-2026-8037 (2026-08-07) |
| Arm | 9 | - | CVE-2024-4610 (2024-06-12) |
| Zoho | 9 | 2 | CVE-2022-28810 (2023-03-07) |
| F5 | 8 | 4 | CVE-2026-94127 (2026-09-22) |
| IBM | 8 | 2 | CVE-2026-9198 (2026-08-04) |
| Juniper | 8 | - | CVE-2015-7755 (2025-10-02) |
| NETGEAR | 8 | - | CVE-2017-5521 (2022-09-08) |
| WordPress | 7 | - | CVE-2026-119977 (2026-11-03) |
| Mitel | 7 | 5 | CVE-2024-41710 (2025-02-12) |
| Sophos | 7 | 2 | CVE-2020-15069 (2025-02-06) |
| GitLab | 6 | 1 | CVE-2026-97229 (2026-10-29) |
| Broadcom | 6 | 1 | CVE-2026-41709 (2026-10-28) |
| Jenkins | 6 | 1 | CVE-2017-1000353 (2025-10-02) |
| TP-Link | 6 | - | CVE-2023-50224 (2025-09-03) |
| Plex | 5 | - | CVE-2026-96652 (2026-10-20) |
| MikroTik | 5 | - | CVE-2026-67279 (2026-09-25) |
| Check Point | 5 | 2 | CVE-2026-85102 (2026-09-22) |
| N-able | 5 | - | CVE-2026-86218 (2026-09-08) |
| PaperCut | 5 | 2 | CVE-2026-81578 (2026-08-31) |
| Langflow | 5 | 1 | CVE-2026-0770 (2026-07-21) |
| Drupal | 5 | 2 | CVE-2026-9082 (2026-05-22) |
| GNU | 5 | - | CVE-2026-24061 (2026-01-26) |
| RARLAB | 5 | 4 | CVE-2025-6218 (2025-12-09) |
| DrayTek | 5 | - | CVE-2024-12987 (2025-05-15) |
| Exim | 5 | 1 | CVE-2010-4344 (2022-03-25) |
Vendors below the 5-CVE threshold are in the full exploited-CVE tracker. The newest additions across all vendors: exploited this week.