Vulnerability intelligence
Zero-Day Vulnerabilities
A zero-day vulnerability is a vulnerability known to have been exploited in real-world attacks before a vendor patch or other official remediation became available. The archive covers known zero-day vulnerabilities dating back to 2006.
Historical activity
Zero-Day Vulnerabilities by Year
Select a year to open the filtered archive.
Affected vendors
Top Vendors
| Vendor | Zero-days | Share |
|---|---|---|
| Microsoft | 337 | 33.4% |
| 87 | 8.6% | |
| Adobe | 78 | 7.7% |
| Apple Inc. | 74 | 7.3% |
| Cisco Systems, Inc | 29 | 2.9% |
| Oracle | 17 | 1.7% |
| Fortinet, Inc | 16 | 1.6% |
| JustSystems Corporation | 16 | 1.6% |
| Ivanti | 15 | 1.5% |
| Mozilla | 11 | 1.1% |
Weakness types
Top CWE Categories
| CWE | Weakness | Zero-days | Share |
|---|---|---|---|
| CWE-119 | Memory corruption | 223 | 22.1% |
| CWE-20 | Improper input validation | 93 | 9.2% |
| CWE-416 | Use After Free | 81 | 8% |
| CWE-264 | Permissions, Privileges, and Access Controls | 38 | 3.8% |
| CWE-843 | Type confusion | 34 | 3.4% |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 26 | 2.6% |
| CWE-787 | Out-of-bounds write | 26 | 2.6% |
| CWE-287 | Improper Authentication | 25 | 2.5% |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 25 | 2.5% |
| CWE-122 | Heap-based Buffer Overflow | 24 | 2.4% |
Known exploited catalogs
Zero-Days in Known Exploited Vulnerability Catalogs
Coverage of the zero-day dataset by two independent catalogs. A record can appear in one catalog, both, or neither.
CISA KEV69468.7% of all zero-daysCISA Known Exploited Vulnerabilities CatalogENISA KEV67166.4% of all zero-daysENISA known exploited vulnerability data
Catalog overlap
Recently discovered
Latest Zero-Day Vulnerabilities
| CVE | Vendor / Product | Vulnerability | Discovered | KEV |
|---|---|---|---|---|
| CVE-2026-102490 | ZammadZammad | Incorrect default permissions in Zammad | — | |
| CVE-2026-102489 | ZammadZammad | Session fixation in Zammad | ENISA KEV | |
| CVE-2026-104286 | Fortinet, IncFortiMail | Path traversal in FortiMail | CISA KEV | |
| CVE-2026-76504 | Cisco Systems, IncCatalyst SD-WAN Manager (formerly SD-WAN vManage) | Improper Handling of URL Encoding (Hex Encoding) in Catalyst SD-WAN Manager (formerly SD-WAN vManage) | — | |
| CVE-2026-86950 | Apple Inc.Apple iOS | Out-of-bounds write in Apple iOS and iPadOS | — | |
| CVE-2026-88772 | CitrixCitrix Netscaler ADC | Buffer overflow in Citrix Netscaler ADC and Citrix NetScaler Gateway | CISA KEV | |
| CVE-2026-88771 | CitrixCitrix Netscaler ADC | Input validation error in Citrix Netscaler ADC and Citrix NetScaler Gateway | CISA KEV | |
| CVE-2026-93952 | Arista NetworksVeloCloud Orchestrator (VCO) | Input validation error in VeloCloud Orchestrator (VCO) | CISA KEV | |
| CVE-2026-94127 | F5 NetworksBIG-IP APM | Heap-based buffer overflow in BIG-IP and BIG-IP APM | CISA KEV | |
| CVE-2026-93616 | Check Point Software TechnologiesGaia | Arbitrary file upload in Gaia | CISA KEV |