The Signal Edition
Tracker · Cybersecurity

Exploited vulnerabilities

Every flaw the U.S. Cybersecurity and Infrastructure Security Agency has confirmed attackers are using, with the deadline federal agencies have to patch it.

Updated Nov 3, 2026, 3:38 p.m. ET from CISA catalog version 2026.11.03
In the catalog
1,767
Added in 2026
283
245 in all of 2025
Added in Nov so far
1
7 in the last 7 days
2026 entries tied to ransomware
27
Added per month, 2026
*Nov through Nov 3, 2026. Source: CISA Known Exploited Vulnerabilities catalog.
Most-listed vendors, 2026
  1. Microsoft40
  2. Cisco20
  3. Apple9
  4. Fortinet9
  5. Google9
  6. Linux9
  7. Ivanti8
  8. Adobe7

Entries matching “Adobe”

Download CSV

86 entries match. Page 2 of 2.

AddedCVEVendorProductPatch deadlineRansomware use
Mar 28, 2022CVE-2015-2426MicrosoftWindowsApr 18, 2022Unknown
Mar 28, 2022CVE-2013-2729AdobeReader and AcrobatApr 18, 2022Unknown
Mar 28, 2022CVE-2012-2034AdobeFlash PlayerApr 18, 2022Unknown
Mar 25, 2022CVE-2016-7892AdobeFlash PlayerApr 15, 2022Unknown
Mar 25, 2022CVE-2016-4171AdobeFlash PlayerApr 15, 2022Unknown
Mar 25, 2022CVE-2010-2861AdobeColdFusionApr 15, 2022Known
Mar 25, 2022CVE-2009-0927AdobeReader and AcrobatApr 15, 2022Unknown
Mar 7, 2022CVE-2013-0631AdobeColdFusionSep 7, 2022Unknown
Mar 7, 2022CVE-2013-0629AdobeColdFusionSep 7, 2022Unknown
Mar 7, 2022CVE-2013-0625AdobeColdFusionSep 7, 2022Unknown
Mar 7, 2022CVE-2009-3960AdobeBlazeDSSep 7, 2022Known
Mar 3, 2022CVE-2017-11292AdobeFlash PlayerMar 24, 2022Unknown
Mar 3, 2022CVE-2016-7855AdobeFlash PlayerMar 24, 2022Unknown
Mar 3, 2022CVE-2016-4117AdobeFlash PlayerMar 24, 2022Known
Mar 3, 2022CVE-2016-1019AdobeFlash PlayerMar 24, 2022Known
Mar 3, 2022CVE-2015-7645AdobeFlash PlayerMar 24, 2022Known
Mar 3, 2022CVE-2015-5119AdobeFlash PlayerMar 24, 2022Unknown
Mar 3, 2022CVE-2015-3043AdobeFlash PlayerMar 24, 2022Unknown
Mar 3, 2022CVE-2014-0496AdobeReader and AcrobatMar 24, 2022Unknown
Mar 3, 2022CVE-2013-3346AdobeReader and AcrobatMar 24, 2022Unknown
Mar 3, 2022CVE-2013-0641AdobeReaderMar 24, 2022Unknown
Mar 3, 2022CVE-2013-0640AdobeReader and AcrobatMar 24, 2022Unknown
Mar 3, 2022CVE-2013-0632AdobeColdFusionMar 24, 2022Unknown
Mar 3, 2022CVE-2012-1535AdobeFlash PlayerMar 24, 2022Unknown
Mar 3, 2022CVE-2011-0611AdobeFlash PlayerMar 24, 2022Unknown
Mar 3, 2022CVE-2010-0188AdobeReader and AcrobatMar 24, 2022Known
Mar 3, 2022CVE-2008-2992AdobeAcrobat and ReaderMar 24, 2022Known
Feb 15, 2022CVE-2022-24086AdobeCommerce and Magento Open SourceMar 1, 2022Unknown
Feb 15, 2022CVE-2018-15982AdobeFlash PlayerAug 15, 2022Known
Nov 3, 2021CVE-2021-28550AdobeAcrobat and ReaderNov 17, 2021Unknown
Nov 3, 2021CVE-2021-21017AdobeAcrobat and ReaderNov 17, 2021Unknown
Nov 3, 2021CVE-2020-1020MicrosoftWindowsMay 3, 2022Unknown
Nov 3, 2021CVE-2020-0938MicrosoftWindowsMay 3, 2022Unknown
Nov 3, 2021CVE-2018-4939AdobeColdFusionMay 3, 2022Unknown
Nov 3, 2021CVE-2018-4878AdobeFlash PlayerMay 3, 2022Known
Nov 3, 2021CVE-2018-15961AdobeColdFusionMay 3, 2022Unknown

How this tracker works

We read CISA’s Known Exploited Vulnerabilities catalog several times a day and count entries by the date CISA added them. The catalog lists flaws with reliable evidence of active exploitation. The patch deadline is the date CISA sets for U.S. federal civilian agencies; CISA urges every organization to treat listed flaws as a priority.

“Known” ransomware use means CISA has confirmed a ransomware campaign used the flaw. “Unknown” means not confirmed, not ruled out. Catalog published November 3, 2026. CISA’s catalog

Tool
Is my software on the list?
Look up any vendor or product in the full catalog.