Vendor scorecards
How many of each vendor's flaws are on CISA's list of vulnerabilities attackers have used. 94 vendors with 3 or more.
| Vendor | All time | 2026 | Zero-days | Ransomware | Latest |
|---|---|---|---|---|---|
| Microsoft | 390 | 40 | 102 | 117 | Oct 13, 2026 |
| Cisco | 101 | 19 | 23 | 7 | Oct 14, 2026 |
| Apple | 95 | 9 | 43 | 0 | Sep 29, 2026 |
| Adobe | 83 | 7 | 7 | 11 | Oct 27, 2026 |
| 76 | 9 | 40 | 0 | Oct 27, 2026 | |
| Oracle | 46 | 4 | 3 | 13 | Aug 24, 2026 |
| Apache | 41 | 3 | 2 | 8 | Oct 8, 2026 |
| Ivanti | 36 | 6 | 18 | 12 | Oct 13, 2026 |
| Fortinet | 32 | 9 | 16 | 14 | Oct 16, 2026 |
| Linux | 32 | 9 | 0 | 2 | Oct 28, 2026 |
| VMware | 31 | 4 | 7 | 10 | Oct 28, 2026 |
| Citrix | 27 | 6 | 10 | 7 | Oct 4, 2026 |
| D-Link | 26 | 1 | 2 | 2 | Apr 24, 2026 |
| SonicWall | 19 | 4 | 6 | 13 | Sep 2, 2026 |
| Synacor | 19 | 5 | 3 | 6 | Aug 21, 2026 |
| Android | 17 | 1 | 9 | 0 | Jun 2, 2026 |
| Palo Alto Networks | 16 | 3 | 7 | 6 | Oct 14, 2026 |
| Samsung | 15 | 1 | 0 | 0 | Apr 24, 2026 |
| Atlassian | 14 | 1 | 3 | 8 | Oct 15, 2026 |
| SAP | 14 | 0 | 2 | 3 | May 15, 2025 |
| Mozilla | 13 | 0 | 3 | 1 | Oct 6, 2025 |
| Zyxel | 13 | 1 | 5 | 2 | Sep 21, 2026 |
| Qualcomm | 12 | 1 | 8 | 0 | Mar 3, 2026 |
| Trend Micro | 12 | 1 | 4 | 0 | May 21, 2026 |
| QNAP | 11 | 0 | 1 | 9 | Dec 21, 2023 |
| Roundcube | 11 | 2 | 0 | 0 | Feb 20, 2026 |
| SolarWinds | 11 | 4 | 3 | 2 | Jun 5, 2026 |
| Arm | 9 | 0 | 3 | 0 | Jun 12, 2024 |
| Progress | 9 | 1 | 1 | 4 | Aug 7, 2026 |
| Red Hat | 9 | 2 | 0 | 4 | Aug 26, 2026 |
| Zoho | 9 | 0 | 3 | 2 | Mar 7, 2023 |
| F5 | 8 | 2 | 4 | 4 | Sep 22, 2026 |
| IBM | 8 | 1 | 1 | 2 | Aug 4, 2026 |
| Juniper | 8 | 0 | 1 | 0 | Oct 2, 2025 |
| NETGEAR | 8 | 0 | 0 | 0 | Sep 8, 2022 |
| Mitel | 7 | 0 | 0 | 5 | Feb 12, 2025 |
| Sophos | 7 | 0 | 2 | 2 | Feb 6, 2025 |
| Jenkins | 6 | 0 | 0 | 1 | Oct 2, 2025 |
| TP-Link | 6 | 0 | 1 | 0 | Sep 3, 2025 |
| WordPress | 6 | 3 | 3 | 0 | Sep 25, 2026 |
| Check Point | 5 | 4 | 4 | 2 | Sep 22, 2026 |
| DrayTek | 5 | 0 | 0 | 0 | May 15, 2025 |
| Drupal | 5 | 1 | 1 | 2 | May 22, 2026 |
| Exim | 5 | 0 | 0 | 1 | Mar 25, 2022 |
| GitLab | 5 | 3 | 1 | 1 | Sep 11, 2026 |
| GNU | 5 | 1 | 1 | 0 | Jan 26, 2026 |
| Langflow | 5 | 4 | 1 | 1 | Jul 21, 2026 |
| MikroTik | 5 | 3 | 2 | 0 | Sep 25, 2026 |
| N-able | 5 | 3 | 5 | 0 | Sep 8, 2026 |
| PaperCut | 5 | 3 | 3 | 2 | Aug 31, 2026 |
| Plex | 5 | 4 | 0 | 0 | Oct 20, 2026 |
| RARLAB | 5 | 0 | 2 | 4 | Dec 9, 2025 |
| Accellion | 4 | 0 | 0 | 4 | Nov 3, 2021 |
| Arista | 4 | 4 | 4 | 0 | Oct 23, 2026 |
| BeyondTrust | 4 | 2 | 3 | 1 | Oct 16, 2026 |
| ConnectWise | 4 | 2 | 2 | 2 | Sep 11, 2026 |
| Craft CMS | 4 | 1 | 0 | 0 | Mar 20, 2026 |
| Fortra | 4 | 0 | 2 | 2 | Sep 29, 2025 |
| GIGABYTE | 4 | 0 | 0 | 4 | Oct 24, 2022 |
| Gladinet | 4 | 0 | 3 | 0 | Dec 15, 2025 |
| JetBrains | 4 | 2 | 1 | 4 | Aug 5, 2026 |
| JFrog | 4 | 4 | 1 | 0 | Sep 11, 2026 |
| Kentico | 4 | 1 | 0 | 0 | Apr 20, 2026 |
| Nagios | 4 | 0 | 0 | 0 | Jan 18, 2022 |
| Sangoma | 4 | 3 | 1 | 0 | Sep 2, 2026 |
| SimpleHelp | 4 | 3 | 0 | 3 | Jun 29, 2026 |
| Sitecore | 4 | 0 | 1 | 1 | Sep 4, 2025 |
| Ubiquiti | 4 | 3 | 0 | 0 | Jun 23, 2026 |
| Veeam | 4 | 0 | 0 | 4 | Oct 17, 2024 |
| WatchGuard | 4 | 0 | 1 | 1 | Dec 19, 2025 |
| ASUS | 3 | 0 | 1 | 0 | Dec 17, 2025 |
| BerriAI | 3 | 3 | 1 | 0 | Sep 2, 2026 |
| CrushFTP | 3 | 0 | 3 | 1 | Jul 22, 2025 |
| Dassault Systèmes | 3 | 0 | 0 | 0 | Oct 28, 2025 |
| DotNetNuke (DNN) | 3 | 0 | 0 | 1 | Nov 3, 2021 |
| Elastic | 3 | 0 | 0 | 0 | Mar 25, 2022 |
| ImageMagick | 3 | 0 | 0 | 0 | Sep 9, 2024 |
| Kaseya | 3 | 0 | 0 | 3 | May 24, 2022 |
| Laravel | 3 | 1 | 0 | 1 | Mar 20, 2026 |
| Meta Platforms | 3 | 0 | 1 | 0 | Sep 2, 2025 |
| OSGeo | 3 | 0 | 0 | 0 | Dec 11, 2025 |
| PHP | 3 | 0 | 0 | 1 | Jul 7, 2025 |
| PHP Group | 3 | 2 | 3 | 1 | Oct 26, 2026 |
| Qlik | 3 | 0 | 0 | 3 | Jan 13, 2025 |
| Rails | 3 | 0 | 0 | 0 | Jul 7, 2025 |
| Realtek | 3 | 0 | 0 | 0 | Sep 18, 2023 |
| SaltStack | 3 | 0 | 0 | 0 | Nov 3, 2021 |
| SmarterTools | 3 | 3 | 1 | 3 | Feb 5, 2026 |
| SysAid | 3 | 0 | 1 | 1 | Jul 22, 2025 |
| TeleMessage | 3 | 0 | 1 | 0 | Jul 1, 2025 |
| Tenda | 3 | 0 | 0 | 0 | Nov 3, 2021 |
| TrueConf | 3 | 3 | 3 | 0 | Aug 20, 2026 |
| Veritas | 3 | 0 | 0 | 3 | Apr 7, 2023 |
| VMware Tanzu | 3 | 0 | 0 | 1 | Aug 25, 2022 |
A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.