end-of-life.org

The riskiest EOL versions still in the wild

Versions that went end of life within the last 5 years, ranked by CVEs missed — vulnerabilities published after that version's EOL and fixed only in newer branches. Older branches are excluded: they have missed more, but almost nobody still runs them. Ranked across the 13 products with CVE analysis.

VersionEOL sinceEOL forCVEs missed
MySQL 5.7 2023-10 3.0 y 127
Go 1.16 2022-03-15 4.5 y 117
Go 1.17 2022-08-02 4.1 y 112
MySQL 8.1 2023-10-25 2.9 y 103
Go 1.18 2023-02-01 3.6 y 91
MySQL 8.2 2024-01-16 2.7 y 91
MySQL 8.3 2024-04-30 2.4 y 78
Apache Tomcat 10.0 2022-10-31 3.9 y 77

Browse

13 products carry the post-EOL CVE layer — they show the vulnerabilities each dead version has missed. The full directory covers all 475.

Django 23 branches · 157 CVEs VMware ESXi 12 branches · 121 CVEs Go 28 branches · 180 CVEs Keycloak 25 branches · 99 CVEs MySQL 18 branches · 1328 CVEs Node.js 27 branches · 188 CVEs PHP 23 branches · 747 CVEs PostgreSQL 29 branches · 209 CVEs Python 19 branches · 157 CVEs Ruby on Rails 16 branches · 122 CVEs Ruby 15 branches · 113 CVEs Spring Boot 18 branches · 21 CVEs Apache Tomcat 11 branches · 276 CVEs

All 475 products