Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
82 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2026-71362 | Adobe | Adobe Commerce and Magento Incorrect Authorization Vulnerability | Severity: Critical CVSS 9.1 | Sep 24, 2026 | Not known |
| CVE-2026-75650 | Adobe | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | Severity: Critical CVSS 10.0 | Sep 8, 2026 | Not known |
| CVE-2026-48282 | Adobe | Adobe ColdFusion Path Traversal Vulnerability | Severity: Critical CVSS 10.0 | Jul 7, 2026 | Not known |
| CVE-2009-3459 | Adobe | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | Severity: High CVSS 8.8 | May 20, 2026 | Not known |
| CVE-2026-34621 | Adobe | Adobe Acrobat and Reader Prototype Pollution Vulnerability | Severity: High CVSS 8.6 | Apr 13, 2026 | Not known |
| CVE-2020-9715 | Adobe | Adobe Acrobat Use-After-Free Vulnerability | Severity: High CVSS 7.8 | Apr 13, 2026 | Not known |
| CVE-2025-54236 | Adobe | Adobe Commerce and Magento Improper Input Validation Vulnerability | Severity: Critical CVSS 9.1 | Oct 24, 2025 | Not known |
| CVE-2025-54253 | Adobe | Adobe Experience Manager Forms Code Execution Vulnerability | Severity: Critical CVSS 10.0 | Oct 15, 2025 | Not known |
| CVE-2017-3066 | Adobe | Adobe ColdFusion Deserialization Vulnerability | Severity: Critical CVSS 9.8 | Feb 24, 2025 | Not known |
| CVE-2024-20767 | Adobe | Adobe ColdFusion Improper Access Control Vulnerability | Severity: High CVSS 7.4 | Dec 16, 2024 | Not known |
| CVE-2014-0497 | Adobe | Adobe Flash Player Integer Underflow Vulnerablity | Severity: Critical CVSS 9.8 | Sep 17, 2024 | Not known |
| CVE-2013-0643 | Adobe | Adobe Flash Player Incorrect Default Permissions Vulnerability | Severity: High CVSS 8.8 | Sep 17, 2024 | Not known |
| CVE-2013-0648 | Adobe | Adobe Flash Player Code Execution Vulnerability | Severity: High CVSS 8.8 | Sep 17, 2024 | Not known |
| CVE-2014-0502 | Adobe | Adobe Flash Player Double Free Vulnerablity | Severity: High CVSS 8.8 | Sep 17, 2024 | Not known |
| CVE-2024-34102 | Adobe | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | Severity: Critical CVSS 9.8 | Jul 17, 2024 | Not known |
| CVE-2023-29300 | Adobe | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Jan 8, 2024 | Known |
| CVE-2023-38203 | Adobe | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Jan 8, 2024 | Known |
| CVE-2023-21608 | Adobe | Adobe Acrobat and Reader Use-After-Free Vulnerability | Severity: High CVSS 7.8 | Oct 10, 2023 | Not known |
| CVE-2023-26369 | Adobe | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | Severity: High CVSS 7.8 | Sep 14, 2023 | Not known |
| CVE-2023-26359 | Adobe | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Aug 21, 2023 | Not known |
| CVE-2023-29298 | Adobe | Adobe ColdFusion Improper Access Control Vulnerability | Severity: High CVSS 7.5 | Jul 20, 2023 | Not known |
| CVE-2023-38205 | Adobe | Adobe ColdFusion Improper Access Control Vulnerability | Severity: High CVSS 7.5 | Jul 20, 2023 | Not known |
| CVE-2023-26360 | Adobe | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Severity: High CVSS 8.6 | Mar 15, 2023 | Not known |
| CVE-2011-2462 | Adobe | Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability | Severity: Critical CVSS 9.8 | Jun 8, 2022 | Not known |
| CVE-2008-0655 | Adobe | Adobe Acrobat and Reader Unspecified Vulnerability | Severity: High CVSS 8.8 | Jun 8, 2022 | Not known |
| CVE-2009-3953 | Adobe | Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | Severity: High CVSS 8.8 | Jun 8, 2022 | Not known |
| CVE-2012-5054 | Adobe | Adobe Flash Player Integer Overflow Vulnerability | Severity: High CVSS 8.8 | Jun 8, 2022 | Not known |
| CVE-2018-4990 | Adobe | Adobe Acrobat and Reader Double Free Vulnerability | Severity: High CVSS 8.8 | Jun 8, 2022 | Not known |
| CVE-2012-0754 | Adobe | Adobe Flash Player Memory Corruption Vulnerability | Severity: High CVSS 8.1 | Jun 8, 2022 | Not known |
| CVE-2007-5659 | Adobe | Adobe Acrobat and Reader Buffer Overflow Vulnerability | Severity: High CVSS 7.8 | Jun 8, 2022 | Not known |
| CVE-2009-1862 | Adobe | Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | Severity: High CVSS 7.8 | Jun 8, 2022 | Not known |
| CVE-2009-4324 | Adobe | Adobe Acrobat and Reader Use-After-Free Vulnerability | Severity: High CVSS 7.8 | Jun 8, 2022 | Not known |
| CVE-2010-1297 | Adobe | Adobe Flash Player Memory Corruption Vulnerability | Severity: High CVSS 7.8 | Jun 8, 2022 | Not known |
| CVE-2011-0609 | Adobe | Adobe Flash Player Unspecified Vulnerability | Severity: High CVSS 7.8 | Jun 8, 2022 | Not known |
| CVE-2010-2883 | Adobe | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | Severity: High CVSS 7.3 | Jun 8, 2022 | Not known |
| CVE-2012-0767 | Adobe | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | Severity: Elevated CVSS 6.1 | Jun 8, 2022 | Not known |
| CVE-2014-0546 | Adobe | Adobe Reader and Acrobat Sandbox Bypass Vulnerability | Severity: Critical CVSS 9.8 | May 25, 2022 | Not known |
| CVE-2014-8439 | Adobe | Adobe Flash Player Dereferenced Pointer Vulnerability | Severity: High CVSS 8.8 | May 25, 2022 | Not known |
| CVE-2015-8651 | Adobe | Adobe Flash Player Integer Overflow Vulnerability | Severity: High CVSS 8.8 | May 25, 2022 | Not known |
| CVE-2016-0984 | Adobe | Adobe Flash Player and AIR Use-After-Free Vulnerability | Severity: High CVSS 8.8 | May 25, 2022 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.