Adobe
- Exploited flaws
- 83in 14 products
- Added to CISA's list in 2026
- 73 in 2025
- Used by ransomware
- 11of 83, says CISA
- Disclosure to CISA's list
- 2681 daysmedian; 5 of 75 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2007 | 1 |
| 2008 | 2 |
| 2009 | 6 |
| 2010 | 4 |
| 2011 | 3 |
| 2012 | 5 |
| 2013 | 10 |
| 2014 | 6 |
| 2015 | 10 |
| 2016 | 7 |
| 2017 | 2 |
| 2018 | 6 |
| 2019 | 0 |
| 2020 | 1 |
| 2021 | 2 |
| 2022 | 1 |
| 2023 | 8 |
| 2024 | 2 |
| 2025 | 2 |
| 2026 | 5 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Flash Player | 33 | 2021-11-03 | 2024-09-17 |
| ColdFusion | 16 | 2021-11-03 | 2026-07-07 |
| Acrobat and Reader | 13 | 2021-11-03 | 2026-05-20 |
| Reader and Acrobat | 8 | 2022-03-03 | 2022-06-08 |
| Commerce and Magento | 2 | 2026-09-08 | 2026-10-27 |
| Commerce and Magento Open Source | 2 | 2022-02-15 | 2024-07-17 |
| Flash Player and AIR | 2 | 2022-05-25 | 2022-05-25 |
Latest on CISA's list
- Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
- Adobe Commerce and Magento Incorrect Authorization Vulnerability
- Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
- Adobe ColdFusion Path Traversal Vulnerability
- Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
- Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Adobe Acrobat Use-After-Free Vulnerability
- Adobe Commerce and Magento Improper Input Validation Vulnerability
- Adobe Experience Manager Forms Code Execution Vulnerability
- Adobe ColdFusion Deserialization Vulnerability
In the news
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.