Tracker · Cybersecurity
Exploited vulnerabilities
Every flaw the U.S. Cybersecurity and Infrastructure Security Agency has confirmed attackers are using, with the deadline federal agencies have to patch it.
Updated Nov 2, 2026, 3:37 a.m. ET from CISA catalog version 2026.10.30
In the catalog
1,766
Added in 2026
282
245 in all of 2025
Added in Nov so far
0
8 in the last 7 days
2026 entries tied to ransomware
27
*Nov through Nov 2, 2026. Source: CISA Known Exploited Vulnerabilities catalog.
Entries matching “Adobe”
86 entries match. Page 1 of 2.
| Added | CVE | Vendor | Product | Patch deadline | Ransomware use |
|---|---|---|---|---|---|
| Oct 27 | CVE-2026-48356 | Adobe | Commerce and Magento | Nov 10 | Unknown |
| Sep 24 | CVE-2026-71362 | Adobe | Commerce and Magento | Sep 27 | Unknown |
| Sep 8 | CVE-2026-75650 | Adobe | Commerce and Magento | Sep 11 | Unknown |
| Jul 7 | CVE-2026-48282 | Adobe | ColdFusion | Jul 10 | Unknown |
| May 20 | CVE-2009-3459 | Adobe | Acrobat and Reader | Jun 3 | Unknown |
| Apr 13 | CVE-2026-34621 | Adobe | Acrobat and Reader | Apr 27 | Unknown |
| Apr 13 | CVE-2020-9715 | Adobe | Acrobat | Apr 27 | Unknown |
| Oct 24, 2025 | CVE-2025-54236 | Adobe | Commerce and Magento | Nov 14, 2025 | Unknown |
| Oct 15, 2025 | CVE-2025-54253 | Adobe | Experience Manager (AEM) Forms | Nov 5, 2025 | Unknown |
| Feb 24, 2025 | CVE-2017-3066 | Adobe | ColdFusion | Mar 17, 2025 | Unknown |
| Dec 16, 2024 | CVE-2024-20767 | Adobe | ColdFusion | Jan 6, 2025 | Unknown |
| Sep 17, 2024 | CVE-2014-0502 | Adobe | Flash Player | Oct 8, 2024 | Unknown |
| Sep 17, 2024 | CVE-2014-0497 | Adobe | Flash Player | Oct 8, 2024 | Unknown |
| Sep 17, 2024 | CVE-2013-0648 | Adobe | Flash Player | Oct 8, 2024 | Unknown |
| Sep 17, 2024 | CVE-2013-0643 | Adobe | Flash Player | Oct 8, 2024 | Unknown |
| Jul 17, 2024 | CVE-2024-34102 | Adobe | Commerce and Magento Open Source | Aug 7, 2024 | Unknown |
| Jan 8, 2024 | CVE-2023-38203 | Adobe | ColdFusion | Jan 29, 2024 | Known |
| Jan 8, 2024 | CVE-2023-29300 | Adobe | ColdFusion | Jan 29, 2024 | Known |
| Oct 10, 2023 | CVE-2023-21608 | Adobe | Acrobat and Reader | Oct 31, 2023 | Unknown |
| Sep 14, 2023 | CVE-2023-26369 | Adobe | Acrobat and Reader | Oct 5, 2023 | Unknown |
| Aug 21, 2023 | CVE-2023-26359 | Adobe | ColdFusion | Sep 11, 2023 | Unknown |
| Jul 20, 2023 | CVE-2023-38205 | Adobe | ColdFusion | Aug 10, 2023 | Unknown |
| Jul 20, 2023 | CVE-2023-29298 | Adobe | ColdFusion | Aug 10, 2023 | Unknown |
| Mar 15, 2023 | CVE-2023-26360 | Adobe | ColdFusion | Apr 5, 2023 | Unknown |
| Jun 8, 2022 | CVE-2018-4990 | Adobe | Acrobat and Reader | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2012-5054 | Adobe | Flash Player | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2012-0767 | Adobe | Flash Player | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2012-0754 | Adobe | Flash Player | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2011-2462 | Adobe | Reader and Acrobat | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2011-0609 | Adobe | Flash Player | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2010-2883 | Adobe | Acrobat and Reader | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2010-1297 | Adobe | Flash Player | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2009-4324 | Adobe | Acrobat and Reader | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2009-3953 | Adobe | Acrobat and Reader | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2009-1862 | Adobe | Acrobat and Reader, Flash Player | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2008-0655 | Adobe | Acrobat and Reader | Jun 22, 2022 | Unknown |
| Jun 8, 2022 | CVE-2007-5659 | Adobe | Acrobat and Reader | Jun 22, 2022 | Unknown |
| May 25, 2022 | CVE-2016-1010 | Adobe | Flash Player and AIR | Jun 15, 2022 | Unknown |
| May 25, 2022 | CVE-2016-0984 | Adobe | Flash Player and AIR | Jun 15, 2022 | Unknown |
| May 25, 2022 | CVE-2015-8651 | Adobe | Flash Player | Jun 15, 2022 | Unknown |
| May 25, 2022 | CVE-2015-0310 | Adobe | Flash Player | Jun 15, 2022 | Unknown |
| May 25, 2022 | CVE-2014-8439 | Adobe | Flash Player | Jun 15, 2022 | Unknown |
| May 25, 2022 | CVE-2014-0546 | Adobe | Reader and Acrobat | Jun 15, 2022 | Unknown |
| May 23, 2022 | CVE-2018-5002 | Adobe | Flash Player | Jun 13, 2022 | Unknown |
| Apr 13, 2022 | CVE-2015-5123 | Adobe | Flash Player | May 4, 2022 | Unknown |
| Apr 13, 2022 | CVE-2015-5122 | Adobe | Flash Player | May 4, 2022 | Unknown |
| Apr 13, 2022 | CVE-2015-3113 | Adobe | Flash Player | May 4, 2022 | Unknown |
| Apr 13, 2022 | CVE-2015-0313 | Adobe | Flash Player | May 4, 2022 | Unknown |
| Apr 13, 2022 | CVE-2015-0311 | Adobe | Flash Player | May 4, 2022 | Unknown |
| Apr 13, 2022 | CVE-2014-9163 | Adobe | Flash Player | May 4, 2022 | Unknown |
How this tracker works
We read CISA’s Known Exploited Vulnerabilities catalog several times a day and count entries by the date CISA added them. The catalog lists flaws with reliable evidence of active exploitation. The patch deadline is the date CISA sets for U.S. federal civilian agencies; CISA urges every organization to treat listed flaws as a priority.
“Known” ransomware use means CISA has confirmed a ransomware campaign used the flaw. “Unknown” means not confirmed, not ruled out. Catalog published October 30, 2026. CISA’s catalog
Tool
Is my software on the list?
Look up any vendor or product in the full catalog.