Vulnerability intelligence
Zero-Day Vulnerabilities
A zero-day vulnerability is a vulnerability known to have been exploited in real-world attacks before a vendor patch or other official remediation became available. The archive covers known zero-day vulnerabilities dating back to 2006.
Historical activity
Zero-Day Vulnerabilities by Year
Select a year to open the filtered archive.
Affected vendors
Top Vendors
| Vendor | Zero-days | Share |
|---|---|---|
| Microsoft | 338 | 33.2% |
| 87 | 8.5% | |
| Adobe | 78 | 7.7% |
| Apple Inc. | 74 | 7.3% |
| Cisco Systems, Inc | 30 | 2.9% |
| Oracle | 17 | 1.7% |
| Fortinet, Inc | 16 | 1.6% |
| Ivanti | 16 | 1.6% |
| JustSystems Corporation | 16 | 1.6% |
| Mozilla | 11 | 1.1% |
Weakness types
Top CWE Categories
| CWE | Weakness | Zero-days | Share |
|---|---|---|---|
| CWE-119 | Memory corruption | 223 | 21.9% |
| CWE-20 | Improper input validation | 93 | 9.1% |
| CWE-416 | Use After Free | 81 | 7.9% |
| CWE-264 | Permissions, Privileges, and Access Controls | 38 | 3.7% |
| CWE-843 | Type confusion | 34 | 3.3% |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 28 | 2.7% |
| CWE-287 | Improper Authentication | 27 | 2.6% |
| CWE-787 | Out-of-bounds write | 26 | 2.6% |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 25 | 2.5% |
| CWE-122 | Heap-based Buffer Overflow | 24 | 2.4% |
Known exploited catalogs
Zero-Days in Known Exploited Vulnerability Catalogs
Coverage of the zero-day dataset by two independent catalogs. A record can appear in one catalog, both, or neither.
CISA KEV69768.4% of all zero-daysCISA Known Exploited Vulnerabilities CatalogENISA KEV67165.8% of all zero-daysENISA known exploited vulnerability data
Catalog overlap
Recently discovered
Latest Zero-Day Vulnerabilities
| CVE | Vendor / Product | Vulnerability | Discovered | KEV |
|---|---|---|---|---|
| CVE-2026-102764 | BeyondTrustRemote Support | Authentication Bypass by Spoofing in Remote Support | — | |
| CVE-2026-76519 | Cisco Systems, IncSecure Email Gateway | Relative Path Traversal in Secure Email Gateway | CISA KEV | |
| CVE-2026-0322 | Palo Alto Networks, Inc.Palo Alto PAN-OS | Code Injection in Palo Alto PAN-OS | — | |
| CVE-2026-96951 | MicrosoftMicrosoft Windows | Command injection in Microsoft Windows and Windows Server | — | |
| CVE-2026-104935 | IvantiIvanti Connect Secure (formerly Pulse Connect Secure) | Authentication Bypass by Spoofing in Ivanti Connect Secure (formerly Pulse Connect Secure) | — | |
| CVE-2026-105134 | AhsayAhsayCBS | Improper Authentication in AhsayCBS | CISA KEV | |
| CVE-2026-105133 | AhsayAhsayCBS | Improper Authentication in AhsayCBS | CISA KEV | |
| CVE-2026-102490 | ZammadZammad | Incorrect default permissions in Zammad | — | |
| CVE-2026-102489 | ZammadZammad | Session fixation in Zammad | ENISA KEV | |
| CVE-2026-104286 | Fortinet, IncFortiMail | Path traversal in FortiMail | CISA KEV |