Exim

A track record, not a security rating. Every flaw in Exim's products that CISA has confirmed was exploited, since its list began. Bigger vendors have more products and more attackers looking, so compare patterns, not totals.

Exploited flaws: 5in 3 products
Added to CISA's list in 2026: 00 in 2025
Used by ransomware: 1of 5, says CISA
Disclosure to CISA's list: Not yet4 of 4 flaws dated so far; filling in daily

Exploited flaws by the year they were disclosed

The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.

Hover or tab through a year for its count.

Show as a table

Year disclosed	Exploited flaws
2010	2
2011	0
2012	0
2013	0
2014	0
2015	0
2016	0
2017	0
2018	1
2019	2
2020	0
2021	0
2022	0
2023	0
2024	0
2025	0
2026	0

Products exploited more than once

Product	Flaws	First listed	Latest
Exim	3	2021-11-03	2022-03-25

Latest on CISA's list

Exim Privilege Escalation VulnerabilityCVE-2010-4345 · added 2022-03-25
Exim Heap-Based Buffer Overflow VulnerabilityCVE-2010-4344 · added 2022-03-25
Exim Out-of-bounds Write VulnerabilityCVE-2019-16928 · added 2022-03-03
Exim Mail Transfer Agent (MTA) Improper Input ValidationCVE-2019-10149 · added 2022-01-10
Exim Buffer Overflow VulnerabilityCVE-2018-6789 · added 2021-11-03 · used by ransomware

In the news

No security story in the last 14 days named Exim in its headline.

From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.