end-of-life.org

The riskiest EOL versions still in the wild

Versions that went end of life within the last 5 years, ranked by CVEs missed — vulnerabilities published after that version's EOL and fixed only in newer branches. Older branches are excluded: they have missed more, but almost nobody still runs them. Ranked across the 13 products with CVE analysis.

VersionEOL sinceEOL forCVEs missed
MySQL 5.7 2023-10 3.1 y 127
Go 1.16 2022-03-15 4.6 y 111
Go 1.17 2022-08-02 4.3 y 106
MySQL 8.1 2023-10-25 3.0 y 103
MySQL 8.2 2024-01-16 2.8 y 91
Go 1.18 2023-02-01 3.8 y 85
MySQL 8.3 2024-04-30 2.5 y 78
Apache Tomcat 10.0 2022-10-31 4.0 y 77

Browse

13 products carry the post-EOL CVE layer — they show the vulnerabilities each dead version has missed. The full directory covers all 489.

Django 23 branches · 157 CVEs VMware ESXi 12 branches · 117 CVEs Go 28 branches · 174 CVEs Keycloak 26 branches · 99 CVEs MySQL 18 branches · 1328 CVEs Node.js 27 branches · 189 CVEs PHP 23 branches · 760 CVEs PostgreSQL 29 branches · 209 CVEs Python 19 branches · 145 CVEs Ruby on Rails 16 branches · 122 CVEs Ruby 15 branches · 113 CVEs Spring Boot 18 branches · 21 CVEs Apache Tomcat 11 branches · 276 CVEs

All 489 products