Exploited CVEs / By vendor
Actively exploited vulnerabilities by vendor
Every vendor with 5 or more CVEs on the CISA Known Exploited Vulnerabilities catalog. Refreshed daily; vendors join the list automatically as CISA catalogs their CVEs.
| Vendor | Exploited CVEs | Ransomware-linked | Newest addition |
|---|---|---|---|
| Microsoft | 388 | 117 | CVE-2026-81963 (2026-09-08) |
| Cisco | 99 | 7 | CVE-2026-76460 (2026-09-16) |
| Apple | 94 | - | CVE-2026-65400 (2026-08-18) |
| Adobe | 81 | 11 | CVE-2026-75650 (2026-09-08) |
| 75 | - | CVE-2026-58704 (2026-09-16) | |
| Oracle | 46 | 13 | CVE-2026-21962 (2026-08-24) |
| Apache | 40 | 8 | CVE-2026-34486 (2026-08-04) |
| Ivanti | 35 | 12 | CVE-2026-10520 (2026-06-11) |
| Linux | 31 | 2 | CVE-2025-39682 (2026-09-18) |
| Fortinet | 30 | 14 | CVE-2025-25249 (2026-09-09) |
| D-Link | 26 | 2 | CVE-2025-29635 (2026-04-24) |
| VMware | 26 | 9 | CVE-2025-22224 (2025-03-04) |
| Citrix | 24 | 7 | CVE-2026-19490 (2026-09-09) |
| SonicWall | 19 | 13 | CVE-2026-83548 (2026-09-02) |
| Synacor | 19 | 6 | CVE-2026-73570 (2026-08-21) |
| Android | 17 | - | CVE-2025-48595 (2026-06-02) |
| Palo Alto Networks | 15 | 6 | CVE-2026-0257 (2026-05-29) |
| Samsung | 15 | - | CVE-2024-7399 (2026-04-24) |
| SAP | 14 | 3 | CVE-2025-42999 (2025-05-15) |
| Zyxel | 13 | 2 | CVE-2026-7273 (2026-09-21) |
| Mozilla | 13 | 1 | CVE-2010-3765 (2025-10-06) |
| Atlassian | 13 | 8 | CVE-2021-26086 (2024-11-12) |
| Trend Micro | 12 | - | CVE-2026-34926 (2026-05-21) |
| Qualcomm | 12 | - | CVE-2026-21385 (2026-03-03) |
| SolarWinds | 11 | 2 | CVE-2026-28318 (2026-06-05) |
| Roundcube | 11 | - | CVE-2025-49113 (2026-02-20) |
| QNAP | 11 | 9 | CVE-2023-47565 (2023-12-21) |
| Red Hat | 9 | 4 | CVE-2015-3246 (2026-08-26) |
| Progress | 9 | 4 | CVE-2026-8037 (2026-08-07) |
| Arm | 9 | - | CVE-2024-4610 (2024-06-12) |
| Zoho | 9 | 2 | CVE-2022-28810 (2023-03-07) |
| F5 | 8 | 4 | CVE-2026-94127 (2026-09-22) |
| IBM | 8 | 2 | CVE-2026-9198 (2026-08-04) |
| Juniper | 8 | - | CVE-2015-7755 (2025-10-02) |
| NETGEAR | 8 | - | CVE-2017-5521 (2022-09-08) |
| Mitel | 7 | 5 | CVE-2024-41710 (2025-02-12) |
| Sophos | 7 | 2 | CVE-2020-15069 (2025-02-06) |
| Jenkins | 6 | 1 | CVE-2017-1000353 (2025-10-02) |
| TP-Link | 6 | - | CVE-2023-50224 (2025-09-03) |
| Check Point | 5 | 2 | CVE-2026-85102 (2026-09-22) |
| GitLab | 5 | 1 | CVE-2026-85706 (2026-09-11) |
| N-able | 5 | - | CVE-2026-86218 (2026-09-08) |
| PaperCut | 5 | 2 | CVE-2026-81578 (2026-08-31) |
| Broadcom | 5 | 1 | CVE-2026-59310 (2026-08-18) |
| Langflow | 5 | 1 | CVE-2026-0770 (2026-07-21) |
| WordPress | 5 | - | CVE-2026-60137 (2026-07-21) |
| Drupal | 5 | 2 | CVE-2026-9082 (2026-05-22) |
| GNU | 5 | - | CVE-2026-24061 (2026-01-26) |
| RARLAB | 5 | 4 | CVE-2025-6218 (2025-12-09) |
| DrayTek | 5 | - | CVE-2024-12987 (2025-05-15) |
| Exim | 5 | 1 | CVE-2010-4344 (2022-03-25) |
Vendors below the 5-CVE threshold are in the full exploited-CVE tracker. The newest additions across all vendors: exploited this week.