Tracker · Cybersecurity
Exploited vulnerabilities
Every flaw the U.S. Cybersecurity and Infrastructure Security Agency has confirmed attackers are using, with the deadline federal agencies have to patch it.
Updated Nov 2, 2026, 3:37 a.m. ET from CISA catalog version 2026.10.30
In the catalog
1,766
Added in 2026
282
245 in all of 2025
Added in Nov so far
0
8 in the last 7 days
2026 entries tied to ransomware
27
*Nov through Nov 2, 2026. Source: CISA Known Exploited Vulnerabilities catalog.
Entries matching “IBM”
8 entries match.
| Added | CVE | Vendor | Product | Patch deadline | Ransomware use |
|---|---|---|---|---|---|
| Aug 4 | CVE-2026-9198 | IBM | Langflow | Aug 7 | Unknown |
| Feb 21, 2023 | CVE-2022-47986 | IBM | Aspera Faspex | Mar 14, 2023 | Known |
| May 25, 2022 | CVE-2013-3993 | IBM | InfoSphere BigInsights | Jun 15, 2022 | Known |
| Jan 10, 2022 | CVE-2015-7450 | IBM | WebSphere Application Server and Server Hypervisor Edition | Jul 10, 2022 | Unknown |
| Nov 3, 2021 | CVE-2020-4430 | IBM | Data Risk Manager | May 3, 2022 | Unknown |
| Nov 3, 2021 | CVE-2020-4428 | IBM | Data Risk Manager | May 3, 2022 | Unknown |
| Nov 3, 2021 | CVE-2020-4427 | IBM | Data Risk Manager | May 3, 2022 | Unknown |
| Nov 3, 2021 | CVE-2019-4716 | IBM | Planning Analytics | May 3, 2022 | Unknown |
How this tracker works
We read CISA’s Known Exploited Vulnerabilities catalog several times a day and count entries by the date CISA added them. The catalog lists flaws with reliable evidence of active exploitation. The patch deadline is the date CISA sets for U.S. federal civilian agencies; CISA urges every organization to treat listed flaws as a priority.
“Known” ransomware use means CISA has confirmed a ransomware campaign used the flaw. “Unknown” means not confirmed, not ruled out. Catalog published October 30, 2026. CISA’s catalog
Tool
Is my software on the list?
Look up any vendor or product in the full catalog.