Exploited now
Every vulnerability CISA confirms is being exploited in the wild: listed in its Known Exploited Vulnerabilities catalog, or assessed as actively exploited in its Vulnrichment data, often days before the catalog. When it was confirmed, how soon after the CVE went public, and the vendors attackers go after first. Refreshed every ten minutes. Sources.
Updated under an hour ago ()
What this means for you
28 vulnerabilities confirmed exploited in the last 30 days; 38% of the last 12 months' were exploited by the day they were disclosed. Add your stack to see which of them you run.
- Confirmed exploited, last 30 days
- 28
- Show in the list
- Exploited by the day of disclosure, last 12 months
- 38%
- of 295 confirmed
- Show in the list
- Median days from disclosure to confirmed exploitation
- 4
- last 12 months; list sorted fastest first
- Show in the list
- Used in ransomware campaigns, last 12 months
- 25
- Show in the list
What this means for a patch cycle
Half of the vulnerabilities CISA confirmed exploited in the last 12 months were confirmed within 4 days of going public, and 38% by the day they were published. A monthly patch cycle leaves those exposed for weeks. Products from the vendors below, especially internet-facing ones, need an emergency patch path measured in days.
Where attackers strike first
Vendors by vulnerabilities confirmed exploited in the last 24 months; the top five account for 67% of the twelve listed. This counts confirmed attacks, not disclosed flaws, so a vendor is not rewarded for publishing fewer CVEs. Mapped health IT products account for 1 of them.
Are any of these in your stack?
Name the products you run and see every CVE that affects them, with exploited ones first. Free for one product; subscribers add their whole inventory and are emailed the moment one is exploited.
Every confirmed exploitation
Showing: confirmed in 2022 to 2026, CWE-843 Type Confusion
Confirmed exploited in 2022 to 2026. Weakness: CWE-843 Type Confusion. Clear these
| CVE | Vendor and vulnerability | Confirmed exploited | After publication | Severity | EPSS |
|---|---|---|---|---|---|
| CVE-2019-0752 CISA KEV Ransomware | Microsoft · Internet Explorer Microsoft Internet Explorer Type Confusion VulnerabilityCISA remediation due for federal agencies: Aug 15, 2022 | Feb 13, 2022 | 1,041 days | High 7.5 | 82% |
| CVE-2012-0507 CISA KEV Ransomware | Oracle · Java SE Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCISA remediation due for federal agencies: Mar 24, 2022 | Mar 2, 2022 | 3,555 days | Critical 9.8 | 98% |
| CVE-2018-8298 CISA KEV | ChakraCore · ChakraCore scripting engine ChakraCore Scripting Engine Type Confusion VulnerabilityCISA remediation due for federal agencies: Mar 17, 2022 | Mar 3, 2022 | 1,332 days | High 7.5 | 75% |
| CVE-2017-11292 CISA KEV | Adobe · Flash Player Adobe Flash Player Type Confusion VulnerabilityCISA remediation due for federal agencies: Mar 24, 2022 | Mar 3, 2022 | 1,594 days | High 8.8 | 12% |
| CVE-2011-0611 CISA KEV | Adobe · Flash Player Adobe Flash Player Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Mar 24, 2022 | Mar 3, 2022 | 3,977 days | High 8.8 | 99% |
| CVE-2022-1096 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Apr 18, 2022 | Mar 28, 2022 | 116 days before publication | High 8.8 | 25% |
| CVE-2017-0037 CISA KEV | Microsoft · Edge and Internet Explorer Microsoft Edge and Internet Explorer Type Confusion VulnerabilityCISA remediation due for federal agencies: Apr 18, 2022 | Mar 28, 2022 | 1,856 days | High 8.1 | 80% |
| CVE-2016-7201 CISA KEV | Microsoft · Edge Microsoft Edge Memory Corruption VulnerabilityCISA remediation due for federal agencies: Apr 18, 2022 | Mar 28, 2022 | 1,964 days | High 8.8 | 80% |
| CVE-2022-1364 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: May 6, 2022 | Apr 15, 2022 | 102 days before publication | High 8.8 | 14% |
| CVE-2021-1789 CISA KEV | Apple · Multiple Products Apple Multiple Products Type Confusion VulnerabilityCISA remediation due for federal agencies: May 25, 2022 | May 4, 2022 | 397 days | High 8.8 | 14% |
| CVE-2019-8506 CISA KEV | Apple · Multiple Products Apple Multiple Products Type Confusion VulnerabilityCISA remediation due for federal agencies: May 25, 2022 | May 4, 2022 | 868 days | High 8.8 | 16% |
| CVE-2019-11707 CISA KEV | Mozilla · Firefox and Thunderbird Mozilla Firefox and Thunderbird Type Confusion VulnerabilityCISA remediation due for federal agencies: Jun 13, 2022 | May 23, 2022 | 1,035 days | High 8.8 | 38% |
| CVE-2017-8291 CISA KEV | Artifex · Ghostscript Artifex Ghostscript Type Confusion VulnerabilityCISA remediation due for federal agencies: Jun 14, 2022 | May 24, 2022 | 1,854 days | High 7.8 | 97% |
| CVE-2017-5070 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Jun 22, 2022 | Jun 8, 2022 | 1,685 days | High 8.8 | 32% |
| CVE-2022-41033 CISA KEV | Microsoft · Windows COM+ Event System Service Microsoft Windows COM+ Event System Service Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Nov 1, 2022 | Oct 11, 2022 | 1 day | High 7.8 | 2% |
| CVE-2022-3723 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Nov 18, 2022 | Oct 28, 2022 | 3 days before publication | High 8.8 | 8% |
| CVE-2022-4262 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Dec 26, 2022 | Dec 5, 2022 | 4 days | High 8.8 | 24% |
| CVE-2022-42856 CISA KEV | Apple · iOS Apple iOS Type Confusion VulnerabilityCISA remediation due for federal agencies: Jan 4, 2023 | Dec 14, 2022 | Same day | High 8.8 | 9% |
| CVE-2023-23529 CISA KEV | Apple · Multiple Products Apple Multiple Products WebKit Type Confusion VulnerabilityCISA remediation due for federal agencies: Mar 7, 2023 | Feb 14, 2023 | 12 days before publication | High 8.8 | 10% |
| CVE-2023-2033 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: May 8, 2023 | Apr 17, 2023 | 3 days | High 8.8 | 41% |
| CVE-2023-3079 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Jun 28, 2023 | Jun 7, 2023 | 2 days | High 8.8 | 38% |
| CVE-2023-32439 CISA KEV | Apple · Multiple Products Apple Multiple Products WebKit Type Confusion VulnerabilityCISA remediation due for federal agencies: Jul 14, 2023 | Jun 23, 2023 | 1 day | High 8.8 | 24% |
| CVE-2024-23222 CISA KEV | Apple · Multiple Products Apple Multiple Products WebKit Type Confusion VulnerabilityCISA remediation due for federal agencies: Feb 13, 2024 | Jan 23, 2024 | 1 day | High 8.8 | 11% |
| CVE-2023-4762 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Feb 27, 2024 | Feb 6, 2024 | 154 days | High 8.8 | 41% |
| CVE-2024-4947 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Jun 10, 2024 | May 20, 2024 | 5 days | Critical 9.6 | 15% |
| CVE-2024-5274 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Jun 18, 2024 | May 28, 2024 | Same day | High 8.3 | 7% |
| CVE-2024-38178 CISA KEV | Microsoft · Windows Microsoft Windows Scripting Engine Memory Corruption VulnerabilityCISA remediation due for federal agencies: Sep 3, 2024 | Aug 13, 2024 | Same day | High 7.5 | 41% |
| CVE-2024-7971 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Sep 16, 2024 | Aug 26, 2024 | 5 days | High 8.8 | 21% |
| CVE-2025-30397 CISA KEV | Microsoft · Windows Microsoft Windows Scripting Engine Type Confusion VulnerabilityCISA remediation due for federal agencies: Jun 3, 2025 | May 13, 2025 | Same day | High 7.5 | 27% |
| CVE-2025-6554 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Jul 23, 2025 | Jul 2, 2025 | 2 days | High 8.1 | 14% |
| CVE-2025-10585 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Oct 14, 2025 | Sep 23, 2025 | 1 day before publication | High 8.8 | 5% |
| CVE-2025-13223 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Dec 10, 2025 | Nov 19, 2025 | 2 days | High 8.8 | 5% |
| CVE-2026-21519 CISA KEV | Microsoft · Windows Microsoft Windows Type Confusion VulnerabilityCISA remediation due for federal agencies: Mar 3, 2026 | Feb 10, 2026 | Same day | High 7.8 | 2% |
| CVE-2026-85046 CISA KEV | Google · Chromium V8 Google Chromium V8 Type Confusion VulnerabilityCISA remediation due for federal agencies: Sep 18, 2026 | Sep 4, 2026 | 1 day | High 8.8 | 49% |
How to read this
"Confirmed exploited" is the date CISA added the CVE to its Known Exploited Vulnerabilities catalog or assessed it as actively exploited, whichever came first. It is when exploitation was confirmed publicly, not when attackers started, so "after publication" is an upper bound: attackers were there at least that soon. "By disclosure day" means confirmed on or before the day the CVE record was published, the closest public measure of a zero-day. Dates are US Eastern, the calendar CISA uses. Vendors are named as CISA's catalog names them, otherwise as the assigning CNA does. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.