Vendor track record

How often each vendor's flaws have ended up on CISA's exploited list, which products keep coming back, and how fast. Pick a vendor for its full record.

A track record, not a security rating. Vendors with more products and more customers attract more attackers and more scrutiny, so a bigger count isn't a worse grade. Use it to see patterns, like a product that keeps getting exploited.

Vendors by number of flaws on CISA's exploited list
Vendor	Exploited flaws	Added this year	Used by ransomware	Most repeated product
Microsoft	390	40	117	Windows (173)
Cisco	101	19	7	IOS and IOS XE Software (14)
Apple	95	9	0	Multiple Products (54)
Adobe	83	7	11	Flash Player (33)
Google	76	9	0	Chromium V8 (41)
Oracle	46	4	13	WebLogic Server (12)
Apache	41	3	8	Tomcat (6)
Ivanti	36	6	12	Pulse Connect Secure (7)
Fortinet	32	9	14	FortiOS (9)
Linux	32	9	2	Kernel (32)
Citrix	27	6	7	NetScaler (6)
D-Link	26	1	2	Multiple Routers (3)
VMware	26	0	9	vCenter Server (9)
SonicWall	19	4	13	SMA1000 Appliances (5)
Synacor	19	5	6	Zimbra Collaboration Suite (ZCS) (16)
Android	17	1	0	Framework (6)
Palo Alto Networks	16	3	6	PAN-OS (13)
Samsung	15	1	0	Mobile Devices (13)
Atlassian	14	1	8	Confluence Data Center and Server (3)
SAP	14	0	3	NetWeaver (10)
Mozilla	13	0	1	Firefox and Thunderbird (6)
Zyxel	13	1	2	Multiple Firewalls (5)
Qualcomm	12	1	0	Multiple Chipsets (10)
Trend Micro	12	1	0	Apex One, Apex One as a Service, and Worry-Free Business Security (2)
QNAP	11	0	9	Photo Station (4)
Roundcube	11	2	0	Webmail (7)
SolarWinds	11	4	2	Web Help Desk (5)
Arm	9	0	0	Mali Graphics Processing Unit (GPU) (6)
Progress	9	1	4	WhatsUp Gold (2)
Red Hat	9	2	4	Polkit (2)
Zoho	9	0	2	ManageEngine (6)
F5	8	2	4	BIG-IP (3)
IBM	8	1	2	Data Risk Manager (3)
Juniper	8	0	0	Junos OS (7)
NETGEAR	8	0	0	Multiple Devices (2)
Mitel	7	0	5	MiVoice Connect (3)
Sophos	7	0	2	Firewall (2)
Broadcom	6	4	1	None repeated
Jenkins	6	0	1	None repeated
TP-Link	6	0	0	Multiple Routers (2)
WordPress	6	3	0	Core (3)
Check Point	5	4	2	Multiple Products (2)
DrayTek	5	0	0	VigorConnect (2)
Drupal	5	1	2	Core (3)
Exim	5	0	1	Exim (3)
GitLab	5	3	1	Community and Enterprise Editions (2)
GNU	5	1	0	Bourne-Again Shell (Bash) (2)
Langflow	5	4	1	Langflow (5)
MikroTik	5	3	0	RouterOS (5)
N-able	5	3	0	N-central (3)
PaperCut	5	3	2	NG/MF (4)
Plex	5	4	0	Media Server (5)
RARLAB	5	0	4	WinRAR (4)
Accellion	4	0	4	FTA (4)
Arista	4	4	0	VeloCloud Orchestrator (3)
BeyondTrust	4	2	1	None repeated
ConnectWise	4	2	2	ScreenConnect (4)
Craft CMS	4	1	0	Craft CMS (4)
Fortra	4	0	2	GoAnywhere MFT (2)
GIGABYTE	4	0	4	Multiple Products (4)
Gladinet	4	0	0	CentreStack and Triofox (2)
JetBrains	4	2	4	TeamCity (4)
JFrog	4	4	0	Artifactory (4)
Kentico	4	1	0	Xperience CMS (2)
Nagios	4	0	0	Nagios XI (4)
Sangoma	4	3	0	FreePBX (2)
SimpleHelp	4	3	3	SimpleHelp (4)
Sitecore	4	0	1	CMS and Experience Platform (XP) (2)
Ubiquiti	4	3	0	UniFi OS (3)
Veeam	4	0	4	Backup & Replication (4)
WatchGuard	4	0	1	Firebox (2)
ASUS	3	0	0	None repeated
BerriAI	3	3	0	LiteLLM (3)
CrushFTP	3	0	1	CrushFTP (3)
Dassault Systèmes	3	0	0	DELMIA Apriso (3)
DotNetNuke (DNN)	3	0	1	DotNetNuke (DNN) (3)
Elastic	3	0	0	Elasticsearch (2)
ImageMagick	3	0	0	ImageMagick (3)
Kaseya	3	0	3	Virtual System/Server Administrator (VSA) (3)
Laravel	3	1	1	None repeated
Meta Platforms	3	0	0	WhatsApp (3)
OSGeo	3	0	0	GeoServer (2)
PHP	3	0	1	None repeated
PHP Group	3	2	1	PHP (3)
Qlik	3	0	3	Sense (3)
Rails	3	0	0	Ruby on Rails (3)
Realtek	3	0	0	None repeated
SaltStack	3	0	0	Salt (3)
SmarterTools	3	3	3	SmarterMail (3)
SysAid	3	0	1	SysAid On-Prem (2)
TeleMessage	3	0	0	TM SGNL (3)
Tenda	3	0	0	None repeated
TrueConf	3	3	0	Server (2)
Veritas	3	0	3	Backup Exec Agent (3)
VMware Tanzu	3	0	1	None repeated
Acronis	2	1	0	None repeated
Advantive	2	0	0	VeraCore (2)
Ahsay	2	2	0	AhsayCBS (2)
Array Networks	2	0	1	None repeated
Aviatrix	2	0	0	None repeated
Cleo	2	0	2	Multiple Products (2)
Commvault	2	0	0	None repeated
CWP	2	0	0	Control Web Panel (2)
CyberPersons	2	0	2	CyberPanel (2)
Dahua	2	0	0	IP Camera Firmware (2)
Dasan	2	0	1	Gigabit Passive Optical Network (GPON) Routers (2)
Dell	2	1	0	None repeated
EyesOfNetwork	2	0	0	EyesOfNetwork (2)
GeoVision	2	0	0	Multiple Devices (2)
Grafana Labs	2	0	0	Grafana (2)
Hewlett Packard (HP)	2	0	0	None repeated
Hikvision	2	1	0	None repeated
Hitachi Vantara	2	0	0	Pentaho Business Analytics (BA) Server (2)
IETF	2	0	0	None repeated
Intel	2	0	1	None repeated
LiteSpeed	2	2	0	cPanel Plugin (2)
Metabase	2	1	0	Metabase (2)
Micro Focus	2	0	0	None repeated
MinIO	2	0	0	MinIO (2)
MongoDB	2	0	0	None repeated
NUUO	2	0	0	None repeated
OpenPLC	2	0	0	ScadaBR (2)
ownCloud	2	1	0	None repeated
Paessler	2	0	0	PRTG Network Monitor (2)
PEAR	2	0	0	Archive_Tar (2)
PTZOptics	2	0	0	PT30X-SDI/NDI Cameras (2)
Quest	2	1	1	None repeated
Rejetto	2	0	1	None repeated
Reolink	2	0	0	None repeated
ServiceNow	2	0	0	Utah, Vancouver, and Washington DC Now Platform (2)
Siemens	2	1	0	None repeated
Sonatype	2	0	0	None repeated
Sudo	2	0	0	Sudo (2)
Telerik	2	0	1	User Interface (UI) for ASP.NET AJAX (2)
ThinkPHP	2	0	0	None repeated
TIBCO	2	0	0	JasperReports (2)
Unraid	2	0	0	Unraid (2)
vBulletin	2	0	0	vBulletin (2)
Versa	2	1	0	None repeated
Wing FTP Server	2	1	0	Wing FTP Server (2)
WSO2	2	1	1	Multiple Products (2)
Zabbix	2	0	0	Frontend (2)
Zammad GmbH	2	2	0	Zammad (2)
7-Zip	1	0	0	None repeated
Acclaim Systems	1	0	0	None repeated
Adminer	1	0	0	None repeated
Ajax.NET Professional	1	1	0	None repeated
Alcatel	1	0	0	None repeated
Amcrest	1	0	0	None repeated
AMI	1	0	0	None repeated
Aquasecurity	1	1	0	None repeated
Arcadyan	1	0	0	None repeated
Arcserve	1	0	0	None repeated
Artifex	1	0	0	None repeated
Audinate	1	0	0	None repeated
Balbooa	1	1	0	None repeated
Barracuda Networks	1	0	0	None repeated
BQE	1	0	1	None repeated
Cacti	1	0	0	None repeated
ChakraCore	1	0	0	None repeated
Checkbox	1	0	0	None repeated
Code Aurora	1	0	0	None repeated
Collabora	1	1	0	None repeated
Crestron	1	0	0	None repeated
D-Link and TRENDnet	1	0	0	None repeated
Daemon	1	1	0	None repeated
DD-WRT	1	1	0	None repeated
Delta Electronics	1	0	0	None repeated
Digiever	1	0	0	None repeated
Docker	1	0	0	None repeated
dotCMS	1	0	1	None repeated
Edimax	1	0	0	None repeated
EG Secure Solutions	1	1	0	None repeated
Embedthis	1	0	0	None repeated
Erlang	1	0	0	None repeated
FatPipe	1	0	0	None repeated
ForgeRock	1	0	1	None repeated
FreeType	1	0	0	None repeated
Fuel CMS	1	0	0	None repeated
FXC	1	0	0	None repeated
Git	1	0	0	None repeated
Gitea	1	1	0	None repeated
Gogs	1	1	0	None repeated
Grandstream	1	0	0	None repeated
Hewlett Packard Enterprise (HPE)	1	1	0	None repeated
iCagenda	1	1	0	None repeated
IGEL	1	0	0	None repeated
Ignite Realtime	1	0	0	None repeated
InduSoft	1	0	0	None repeated
ISC	1	1	0	None repeated
Joomla!	1	0	0	None repeated
Joomlack	1	1	0	None repeated
JoomShaper	1	1	0	None repeated
JQuery	1	0	0	None repeated
Justice AV Solutions	1	0	0	None repeated
Kestra	1	1	0	None repeated
Kingsoft	1	0	0	None repeated
Kludex	1	1	0	None repeated
KNX Association	1	1	0	None repeated
Lantronix	1	1	0	None repeated
LG	1	0	0	None repeated
Libraesva	1	0	0	None repeated
Liferay	1	0	0	None repeated
Looking Glass	1	0	0	None repeated
Marimo	1	1	0	None repeated
McAfee	1	0	0	None repeated
MDaemon	1	0	0	None repeated
MediaTek	1	0	0	None repeated
Meta	1	0	1	None repeated
Mirasvit	1	1	0	None repeated
MLflow	1	1	0	None repeated
Motex	1	0	0	None repeated
n8n	1	1	0	None repeated
NAKIVO	1	0	0	None repeated
Netis	1	0	0	None repeated
Netwrix	1	0	1	None repeated
NextGen Healthcare	1	0	1	None repeated
Nice	1	0	0	None repeated
North Grid	1	0	0	None repeated
Nostromo	1	0	0	None repeated
Notepad++	1	1	0	None repeated
Novi Survey	1	0	0	None repeated
Npm package	1	0	0	None repeated
Nx	1	1	1	None repeated
October CMS	1	0	0	None repeated
Omnissa	1	1	0	None repeated
ONLYOFFICE	1	1	0	None repeated
OpenBSD	1	0	0	None repeated
OpenSSL	1	0	0	None repeated
Perl	1	0	0	None repeated
phpMyAdmin	1	0	0	None repeated
PHPUnit	1	0	0	None repeated
Pi-hole	1	0	0	None repeated
PlaySMS	1	0	0	None repeated
Prettier	1	1	0	None repeated
Primetek	1	0	0	None repeated
ProFTPD	1	1	0	None repeated
ProjectSend	1	0	0	None repeated
PTC	1	1	1	None repeated
Pulse Secure	1	0	0	None repeated
QNAP Systems	1	0	0	None repeated
Qualitia	1	0	0	None repeated
Ray-Project	1	1	0	None repeated
rConfig	1	0	0	None repeated
React Native Community	1	1	0	None repeated
Redis	1	0	0	None repeated
reviewdog	1	0	0	None repeated
Rockwell	1	1	0	None repeated
Ruckus Wireless	1	0	0	None repeated
Samba	1	0	1	None repeated
Schneider Electric	1	0	0	None repeated
ScienceLogic	1	0	0	None repeated
Sierra Wireless	1	0	0	None repeated
SIMalliance	1	0	0	None repeated
SKYSEA	1	0	0	None repeated
Smartbedded	1	0	0	None repeated
SolarView	1	0	0	None repeated
Soliton Systems K.K	1	1	0	None repeated
Splunk	1	1	0	None repeated
Spreadsheet::ParseExcel	1	0	0	None repeated
Srimax	1	0	0	None repeated
Strapi	1	1	0	None repeated
SugarCRM	1	0	0	None repeated
Sumavision	1	0	0	None repeated
Sunhillo	1	0	0	None repeated
Symantec	1	0	0	None repeated
TanStack	1	1	1	None repeated
TeamT5	1	1	0	None repeated
TeamViewer	1	0	0	None repeated
Teclib	1	0	0	None repeated
TerraMaster	1	0	1	None repeated
tj-actions	1	0	0	None repeated
Treck TCP/IP stack	1	0	0	None repeated
Trihedral	1	0	0	None repeated
Trimble	1	0	0	None repeated
TVT	1	0	0	None repeated
Twilio	1	0	0	None repeated
Unitronics	1	0	0	None repeated
Vite	1	1	0	None repeated
Wazuh	1	0	0	None repeated
WebKitGTK	1	0	0	None repeated
Webmin	1	0	1	None repeated
WebPros	1	1	1	None repeated
WebRTC	1	0	1	None repeated
Widget Factory	1	1	0	None repeated
XStream	1	0	0	None repeated
XWiki	1	0	0	None repeated
Yealink	1	0	0	None repeated
Yiiframework	1	0	0	None repeated
ZK Framework	1	0	1	None repeated
ZKTeco	1	0	0	None repeated

From CISA's Known Exploited Vulnerabilities catalogue, every flaw since it began in November 2021. Vendors are named as CISA names them, so a company it bought (Pulse Secure, now Ivanti) can appear separately.