The Signal Edition
Tracker · Cybersecurity

Exploited vulnerabilities

Every flaw the U.S. Cybersecurity and Infrastructure Security Agency has confirmed attackers are using, with the deadline federal agencies have to patch it.

Updated Nov 2, 2026, 3:37 a.m. ET from CISA catalog version 2026.10.30
In the catalog
1,766
Added in 2026
282
245 in all of 2025
Added in Nov so far
0
8 in the last 7 days
2026 entries tied to ransomware
27
Added per month, 2026
*Nov through Nov 2, 2026. Source: CISA Known Exploited Vulnerabilities catalog.
Most-listed vendors, 2026
  1. Microsoft40
  2. Cisco20
  3. Apple9
  4. Fortinet9
  5. Google9
  6. Linux9
  7. Ivanti8
  8. Adobe7

Entries matching “Adobe”

Download CSV

86 entries match. Page 1 of 2.

AddedCVEVendorProductPatch deadlineRansomware use
Oct 27CVE-2026-48356AdobeCommerce and MagentoNov 10Unknown
Sep 24CVE-2026-71362AdobeCommerce and MagentoSep 27Unknown
Sep 8CVE-2026-75650AdobeCommerce and MagentoSep 11Unknown
Jul 7CVE-2026-48282AdobeColdFusionJul 10Unknown
May 20CVE-2009-3459AdobeAcrobat and ReaderJun 3Unknown
Apr 13CVE-2026-34621AdobeAcrobat and ReaderApr 27Unknown
Apr 13CVE-2020-9715AdobeAcrobatApr 27Unknown
Oct 24, 2025CVE-2025-54236AdobeCommerce and MagentoNov 14, 2025Unknown
Oct 15, 2025CVE-2025-54253AdobeExperience Manager (AEM) FormsNov 5, 2025Unknown
Feb 24, 2025CVE-2017-3066AdobeColdFusionMar 17, 2025Unknown
Dec 16, 2024CVE-2024-20767AdobeColdFusionJan 6, 2025Unknown
Sep 17, 2024CVE-2014-0502AdobeFlash PlayerOct 8, 2024Unknown
Sep 17, 2024CVE-2014-0497AdobeFlash PlayerOct 8, 2024Unknown
Sep 17, 2024CVE-2013-0648AdobeFlash PlayerOct 8, 2024Unknown
Sep 17, 2024CVE-2013-0643AdobeFlash PlayerOct 8, 2024Unknown
Jul 17, 2024CVE-2024-34102AdobeCommerce and Magento Open SourceAug 7, 2024Unknown
Jan 8, 2024CVE-2023-38203AdobeColdFusionJan 29, 2024Known
Jan 8, 2024CVE-2023-29300AdobeColdFusionJan 29, 2024Known
Oct 10, 2023CVE-2023-21608AdobeAcrobat and ReaderOct 31, 2023Unknown
Sep 14, 2023CVE-2023-26369AdobeAcrobat and ReaderOct 5, 2023Unknown
Aug 21, 2023CVE-2023-26359AdobeColdFusionSep 11, 2023Unknown
Jul 20, 2023CVE-2023-38205AdobeColdFusionAug 10, 2023Unknown
Jul 20, 2023CVE-2023-29298AdobeColdFusionAug 10, 2023Unknown
Mar 15, 2023CVE-2023-26360AdobeColdFusionApr 5, 2023Unknown
Jun 8, 2022CVE-2018-4990AdobeAcrobat and ReaderJun 22, 2022Unknown
Jun 8, 2022CVE-2012-5054AdobeFlash PlayerJun 22, 2022Unknown
Jun 8, 2022CVE-2012-0767AdobeFlash PlayerJun 22, 2022Unknown
Jun 8, 2022CVE-2012-0754AdobeFlash PlayerJun 22, 2022Unknown
Jun 8, 2022CVE-2011-2462AdobeReader and AcrobatJun 22, 2022Unknown
Jun 8, 2022CVE-2011-0609AdobeFlash PlayerJun 22, 2022Unknown
Jun 8, 2022CVE-2010-2883AdobeAcrobat and ReaderJun 22, 2022Unknown
Jun 8, 2022CVE-2010-1297AdobeFlash PlayerJun 22, 2022Unknown
Jun 8, 2022CVE-2009-4324AdobeAcrobat and ReaderJun 22, 2022Unknown
Jun 8, 2022CVE-2009-3953AdobeAcrobat and ReaderJun 22, 2022Unknown
Jun 8, 2022CVE-2009-1862AdobeAcrobat and Reader, Flash PlayerJun 22, 2022Unknown
Jun 8, 2022CVE-2008-0655AdobeAcrobat and ReaderJun 22, 2022Unknown
Jun 8, 2022CVE-2007-5659AdobeAcrobat and ReaderJun 22, 2022Unknown
May 25, 2022CVE-2016-1010AdobeFlash Player and AIRJun 15, 2022Unknown
May 25, 2022CVE-2016-0984AdobeFlash Player and AIRJun 15, 2022Unknown
May 25, 2022CVE-2015-8651AdobeFlash PlayerJun 15, 2022Unknown
May 25, 2022CVE-2015-0310AdobeFlash PlayerJun 15, 2022Unknown
May 25, 2022CVE-2014-8439AdobeFlash PlayerJun 15, 2022Unknown
May 25, 2022CVE-2014-0546AdobeReader and AcrobatJun 15, 2022Unknown
May 23, 2022CVE-2018-5002AdobeFlash PlayerJun 13, 2022Unknown
Apr 13, 2022CVE-2015-5123AdobeFlash PlayerMay 4, 2022Unknown
Apr 13, 2022CVE-2015-5122AdobeFlash PlayerMay 4, 2022Unknown
Apr 13, 2022CVE-2015-3113AdobeFlash PlayerMay 4, 2022Unknown
Apr 13, 2022CVE-2015-0313AdobeFlash PlayerMay 4, 2022Unknown
Apr 13, 2022CVE-2015-0311AdobeFlash PlayerMay 4, 2022Unknown
Apr 13, 2022CVE-2014-9163AdobeFlash PlayerMay 4, 2022Unknown

How this tracker works

We read CISA’s Known Exploited Vulnerabilities catalog several times a day and count entries by the date CISA added them. The catalog lists flaws with reliable evidence of active exploitation. The patch deadline is the date CISA sets for U.S. federal civilian agencies; CISA urges every organization to treat listed flaws as a priority.

“Known” ransomware use means CISA has confirmed a ransomware campaign used the flaw. “Unknown” means not confirmed, not ruled out. Catalog published October 30, 2026. CISA’s catalog

Tool
Is my software on the list?
Look up any vendor or product in the full catalog.