Exploited CVEs / By vendor
Actively exploited vulnerabilities by vendor
Every vendor with 5 or more CVEs on the CISA Known Exploited Vulnerabilities catalog. Refreshed daily; vendors join the list automatically as CISA catalogs their CVEs.
| Vendor | Exploited CVEs | Ransomware-linked | Newest addition |
|---|---|---|---|
| Microsoft | 383 | 105 | CVE-2026-68820 (2026-08-11) |
| Cisco | 96 | 6 | CVE-2026-20349 (2026-08-11) |
| Apple | 93 | - | CVE-2025-31277 (2026-03-20) |
| Adobe | 80 | 10 | CVE-2026-48282 (2026-07-07) |
| 72 | - | CVE-2026-11645 (2026-06-09) | |
| Oracle | 45 | 13 | CVE-2026-46817 (2026-07-15) |
| Apache | 40 | 8 | CVE-2026-34486 (2026-08-04) |
| Ivanti | 35 | 12 | CVE-2026-10520 (2026-06-11) |
| Fortinet | 29 | 13 | CVE-2025-68686 (2026-07-27) |
| Linux | 26 | 2 | CVE-2022-0492 (2026-06-02) |
| D-Link | 26 | 2 | CVE-2025-29635 (2026-04-24) |
| VMware | 26 | 9 | CVE-2025-22224 (2025-03-04) |
| Citrix | 22 | 7 | CVE-2026-3055 (2026-03-30) |
| Synacor | 18 | 5 | CVE-2025-48700 (2026-04-20) |
| SonicWall | 17 | 12 | CVE-2026-15409 (2026-07-14) |
| Android | 17 | - | CVE-2025-48595 (2026-06-02) |
| Palo Alto Networks | 15 | 6 | CVE-2026-0257 (2026-05-29) |
| Samsung | 15 | - | CVE-2024-7399 (2026-04-24) |
| SAP | 14 | 3 | CVE-2025-42999 (2025-05-15) |
| Mozilla | 13 | 1 | CVE-2010-3765 (2025-10-06) |
| Atlassian | 13 | 8 | CVE-2021-26086 (2024-11-12) |
| Trend Micro | 12 | - | CVE-2026-34926 (2026-05-21) |
| Qualcomm | 12 | - | CVE-2026-21385 (2026-03-03) |
| Zyxel | 12 | 2 | CVE-2024-40890 (2025-02-11) |
| SolarWinds | 11 | 2 | CVE-2026-28318 (2026-06-05) |
| Roundcube | 11 | - | CVE-2025-49113 (2026-02-20) |
| QNAP | 11 | 9 | CVE-2023-47565 (2023-12-21) |
| Progress | 9 | 4 | CVE-2026-8037 (2026-08-07) |
| Arm | 9 | - | CVE-2024-4610 (2024-06-12) |
| Zoho | 9 | 2 | CVE-2022-28810 (2023-03-07) |
| IBM | 8 | 2 | CVE-2026-9198 (2026-08-04) |
| Juniper | 8 | - | CVE-2015-7755 (2025-10-02) |
| NETGEAR | 8 | - | CVE-2017-5521 (2022-09-08) |
| F5 | 7 | 4 | CVE-2025-53521 (2026-03-27) |
| Mitel | 7 | 5 | CVE-2024-41710 (2025-02-12) |
| Sophos | 7 | 1 | CVE-2020-15069 (2025-02-06) |
| Red Hat | 7 | 3 | CVE-2018-14667 (2023-09-28) |
| Jenkins | 6 | 1 | CVE-2017-1000353 (2025-10-02) |
| TP-Link | 6 | - | CVE-2023-50224 (2025-09-03) |
| Langflow | 5 | 1 | CVE-2026-0770 (2026-07-21) |
| WordPress | 5 | - | CVE-2026-60137 (2026-07-21) |
| Drupal | 5 | 2 | CVE-2026-9082 (2026-05-22) |
| GNU | 5 | - | CVE-2026-24061 (2026-01-26) |
| RARLAB | 5 | 4 | CVE-2025-6218 (2025-12-09) |
| DrayTek | 5 | - | CVE-2024-12987 (2025-05-15) |
| Exim | 5 | 1 | CVE-2010-4344 (2022-03-25) |
Vendors below the 5-CVE threshold are in the full exploited-CVE tracker. The newest additions across all vendors: exploited this week.