Tracker · Cybersecurity
Exploited vulnerabilities
Every flaw the U.S. Cybersecurity and Infrastructure Security Agency has confirmed attackers are using, with the deadline federal agencies have to patch it.
Updated Nov 4, 2026, 3:39 p.m. ET from CISA catalog version 2026.11.04
In the catalog
1,768
Added in 2026
284
245 in all of 2025
Added in Nov so far
2
6 in the last 7 days
2026 entries tied to ransomware
27
*Nov through Nov 4, 2026. Source: CISA Known Exploited Vulnerabilities catalog.
Entries matching “Cisco”
102 entries match. Page 3 of 3.
| Added | CVE | Vendor | Product | Patch deadline | Ransomware use |
|---|---|---|---|---|---|
| Nov 3, 2021 | CVE-2018-0296 | Cisco | Adaptive Security Appliance (ASA) | May 3, 2022 | Unknown |
| Nov 3, 2021 | CVE-2018-0171 | Cisco | IOS and IOS XE | May 3, 2022 | Unknown |
How this tracker works
We read CISA’s Known Exploited Vulnerabilities catalog several times a day and count entries by the date CISA added them. The catalog lists flaws with reliable evidence of active exploitation. The patch deadline is the date CISA sets for U.S. federal civilian agencies; CISA urges every organization to treat listed flaws as a priority.
“Known” ransomware use means CISA has confirmed a ransomware campaign used the flaw. “Unknown” means not confirmed, not ruled out. Catalog published November 4, 2026. CISA’s catalog
Tool
Is my software on the list?
Look up any vendor or product in the full catalog.