Adobe
Vulnerability activity for Adobe: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 22
- Critical (CVSS 9+)
- 14
- Exploited (CISA KEV)
- 1
- With exploit code
- 0
Last 90 days
- CVEs
- 24
- Critical (CVSS 9+)
- 16
- Exploited (CISA KEV)
- 3
- With exploit code
- 1
Last 365 days
- CVEs
- 30
- Critical (CVSS 9+)
- 18
- Exploited (CISA KEV)
- 7
- With exploit code
- 3
Next expected patch release
Adobe security updates
Nov 10, 2026, in 12 days (usually with Microsoft)
Expected from the vendor's usual schedule; vendors can shift dates.
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.3CriticalJul 14, 2026Adobe Commerce Path traversal / file handlingCVE-2026-48356Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.Added to KEV Oct 27, 2026 · 104 days after publicationExploited1% likely
- 9.1CriticalSep 24, 2026Adobe Commerce and Magento Auth bypass / access controlCVE-2026-71362Adobe Commerce and Magento platforms are affected. An attacker gains unauthorized access to sensitive data and system administration capabilities. Update Adobe Commerce and Magento to the latest version and apply security patches immediately.Added to KEV Sep 24, 2026Exploited88% likelyExploit codeNucleiDetection
- 10.0CriticalSep 8, 2026Adobe Commerce and Magento Code / command injectionCVE-2026-75650Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.Added to KEV Sep 8, 2026Exploited3.9% likelyDetection
- 10.0CriticalJul 7, 2026Adobe ColdFusion Path traversal / file handlingCVE-2026-48282Affected: Adobe ColdFusion versions prior to 2023.1. Attacker gains: Unrestricted file access and potential remote code execution. Recommended action: Update to Adobe ColdFusion version 2023.1 or later.Added to KEV Jul 7, 2026Exploited42% likelyExploit codeNucleiDetection
- 8.8HighMay 20, 2026Adobe Acrobat and Reader Memory corruptionCVE-2009-3459Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.Added to KEV May 20, 2026Exploited87% likelyExploit codeExploit-DB · Metasploit
- 8.6HighApr 13, 2026Adobe Acrobat and ReaderCVE-2026-34621Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.Added to KEV Apr 13, 2026Exploited2.2% likely
- 7.8HighApr 13, 2026Adobe Acrobat Memory corruptionCVE-2020-9715Adobe Acrobat contains a use-after-free vulnerability that allows for code executionAdded to KEV Apr 13, 2026Exploited33% likely
- 9.1CriticalOct 24, 2025Adobe Commerce and MagentoCVE-2025-54236Adobe Commerce and Magento are affected. An attacker gains unauthorized access to sensitive data and potentially executes arbitrary code. Patch Adobe Commerce and Magento immediately to prevent exploitation.Added to KEV Oct 24, 2025Exploited95% likelyExploit codeMetasploit · NucleiDetection
- 10.0CriticalAug 5, 2025Adobe Experience Manager (AEM) Forms Auth bypass / access controlCVE-2025-54253Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.Added to KEV Oct 15, 2025 · 70 days after publicationExploited89% likelyDetection
- 9.8CriticalApr 27, 2017Adobe ColdFusion DeserializationCVE-2017-3066Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.Added to KEV Feb 24, 2025 · 2,859 days after publicationExploited91% likelyExploit codeExploit-DBDetection
- 7.4HighMar 18, 2024Adobe ColdFusion Auth bypass / access controlCVE-2024-20767Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.Added to KEV Dec 16, 2024 · 273 days after publicationExploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 8.8HighFeb 5, 2014Adobe Flash Player Memory corruptionCVE-2014-0497Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.Added to KEV Sep 17, 2024 · 3,877 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit
- 8.8HighFeb 27, 2013Adobe Flash Player Privilege escalationCVE-2013-0643Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content. Added to KEV Sep 17, 2024 · 4,220 days after publicationExploited11% likely
- 8.8HighFeb 27, 2013Adobe Flash Player Code / command injectionCVE-2013-0648Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.Added to KEV Sep 17, 2024 · 4,220 days after publicationExploited11% likely
- 8.8HighFeb 21, 2014Adobe Flash Player Memory corruptionCVE-2014-0502Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.Added to KEV Sep 17, 2024 · 3,861 days after publicationExploited25% likely
- 9.8CriticalJun 13, 2024Adobe Commerce and Magento Open SourceCVE-2024-34102Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.Added to KEV Jul 17, 2024 · 34 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalJul 20, 2023Adobe ColdFusion DeserializationCVE-2023-38203Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.Added to KEV Jan 8, 2024 · 171 days after publicationExploited97% likelyExploit codeNucleiDetection
- 9.8CriticalJul 12, 2023Adobe ColdFusion DeserializationCVE-2023-29300Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.Added to KEV Jan 8, 2024 · 179 days after publicationExploited100% likelyExploit codeNucleiDetection
- 7.8HighJan 18, 2023Adobe Acrobat and Reader Memory corruptionCVE-2023-21608Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.Added to KEV Oct 10, 2023 · 265 days after publicationExploited59% likely
- 7.8HighSep 13, 2023Adobe Acrobat and Reader Memory corruptionCVE-2023-26369Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.Added to KEV Sep 14, 2023 · 1 day after publicationExploited6.7% likely
- 9.8CriticalMar 23, 2023Adobe ColdFusion DeserializationCVE-2023-26359Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.Added to KEV Aug 21, 2023 · 151 days after publicationExploited17% likelyDetection
- 7.5HighSep 14, 2023Adobe ColdFusion Auth bypass / access controlCVE-2023-38205Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.Added to KEV Jul 20, 2023 · same day as publicationExploited100% likelyExploit codeNucleiDetection
- 7.5HighJul 12, 2023Adobe ColdFusion Auth bypass / access controlCVE-2023-29298Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.Added to KEV Jul 20, 2023 · 7 days after publicationExploited100% likelyExploit codeNucleiDetection
- 8.6HighMar 23, 2023Adobe ColdFusion Auth bypass / access controlCVE-2023-26360Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.Added to KEV Mar 15, 2023 · same day as publicationExploited97% likelyExploit codeMetasploit · NucleiDetection
- 7.8HighFeb 12, 2008Adobe Acrobat and Reader Memory corruptionCVE-2007-5659Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.Added to KEV Jun 8, 2022 · 5,229 days after publicationExploited87% likelyExploit codeExploit-DB · Metasploit
Recent
- 6.3MediumOct 29, 2026Adobe Digital Editions Path traversal / file handlingCVE-2026-113576Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- –UnscoredOct 28, 2026AdobeADV-cccs-1173eb0f7ccbSerial number: AV26-1092 Date: October 28, 2026 As of October 27, 2026, Adobe is affected by vulnerabilities in the following products: Adobe Substance 3D Painter Prior to or equal to 12.1.5 Creative Cloud Desktop Application Prior to or equal to 6.10 Adobe Campaign Classic Prior to or equal to 7.4.4 build 9402 Adobe Connect Android Mobile App Prior to or equal to 4.4 Adobe Connect Desktop App Prior to or equal to 2026.8.51 (Win), 2026.08.45 (Mac Silicon), 2026.01.39 (Mac Intel) The Cyber Centre
- 7.8HighOct 27, 2026Adobe Substance 3D Painter Memory corruptionCVE-2026-48379Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 9.6CriticalOct 27, 2026Adobe Connect Desktop App Code / command injectionCVE-2026-48360Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
- 10.0CriticalOct 27, 2026Adobe Campaign Classic SQL injectionCVE-2026-105781Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.9CriticalOct 27, 2026Adobe Campaign Classic Auth bypass / access controlCVE-2026-105780Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.1CriticalOct 27, 2026Adobe Campaign Classic SQL injectionCVE-2026-105779Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.9CriticalOct 27, 2026Adobe Campaign Classic SQL injectionCVE-2026-105489Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.1CriticalOct 27, 2026Adobe Campaign Classic SQL injectionCVE-2026-104354Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.9CriticalOct 27, 2026Adobe Campaign Classic Code / command injectionCVE-2026-104353Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.1.3% likely
- 9.9CriticalOct 27, 2026Adobe Campaign Classic Code / command injectionCVE-2026-104351Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.3CriticalOct 27, 2026Adobe Campaign Classic XSSCVE-2026-104350Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
- 7.3HighOct 27, 2026Adobe Creative Cloud Desktop Application Privilege escalationCVE-2026-104349Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 9.3CriticalJul 14, 2026Adobe Commerce Path traversal / file handlingCVE-2026-48356Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.Exploited1% likely
- 4.3MediumOct 20, 2026Adobe Acrobat for Edge Memory corruptionCVE-2026-100132Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
- –UnscoredOct 14, 2026AdobeADV-cccs-da22e13cce62Serial number: AV26-1039 Date: October 14, 2026 As of October 13, 2026, Adobe is affected by vulnerabilities in the following products: Adobe Bridge Prior to or equal to 16.0.7 Adobe Bridge (LTS) Prior to or equal to 15.1.8 Adobe ColdFusion 2025 Version 2025.0.13 Adobe ColdFusion 2023 Version 2023.0.25 Adobe Commerce Multiple versions Adobe Commerce B2B Multiple versions Adobe Credentials SDK Multiple versions Adobe Dimension Prior to or equal to 4.1.8 Adobe Experience Manager Multiple versions
- 7.8HighOct 13, 2026Adobe photoshop Memory corruptionCVE-2026-96521Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 9.3CriticalOct 13, 2026Adobe experience manager XSSCVE-2026-106630Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
- 9.3CriticalOct 13, 2026Adobe experience manager XSSCVE-2026-106629Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
- 5.4MediumOct 13, 2026Adobe experience manager XSSCVE-2026-106628Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- 9.1CriticalOct 13, 2026Adobe experience manager Code / command injectionCVE-2026-106626Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.9CriticalOct 13, 2026Adobe experience manager Code / command injectionCVE-2026-105895Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.1CriticalSep 24, 2026Adobe Commerce and Magento Auth bypass / access controlCVE-2026-71362Adobe Commerce and Magento platforms are affected. An attacker gains unauthorized access to sensitive data and system administration capabilities. Update Adobe Commerce and Magento to the latest version and apply security patches immediately.Exploited88% likelyExploit codeNucleiDetection
- 10.0CriticalSep 8, 2026Adobe Commerce and Magento Code / command injectionCVE-2026-75650Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.Exploited3.9% likelyDetection
- 10.0CriticalJul 7, 2026Adobe ColdFusion Path traversal / file handlingCVE-2026-48282Affected: Adobe ColdFusion versions prior to 2023.1. Attacker gains: Unrestricted file access and potential remote code execution. Recommended action: Update to Adobe ColdFusion version 2023.1 or later.Exploited42% likelyExploit codeNucleiDetection
- 5.5MediumJul 6, 2026Adobe dng software development kit Memory corruptionCVE-2026-48267DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 10.0CriticalJul 6, 2026Adobe coldfusion Code / command injectionCVE-2026-48316ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.1.1% likely
- 8.8HighMay 20, 2026Adobe Acrobat and Reader Memory corruptionCVE-2009-3459Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.Exploited87% likelyExploit codeExploit-DB · Metasploit
- 7.8HighApr 13, 2026Adobe Acrobat Memory corruptionCVE-2020-9715Adobe Acrobat contains a use-after-free vulnerability that allows for code executionExploited33% likely
- 8.6HighApr 13, 2026Adobe Acrobat and ReaderCVE-2026-34621Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.Exploited2.2% likely
- 9.1CriticalOct 24, 2025Adobe Commerce and MagentoCVE-2025-54236Adobe Commerce and Magento are affected. An attacker gains unauthorized access to sensitive data and potentially executes arbitrary code. Patch Adobe Commerce and Magento immediately to prevent exploitation.Exploited95% likelyExploit codeMetasploit · NucleiDetection
- 10.0CriticalAug 5, 2025Adobe Experience Manager (AEM) Forms Auth bypass / access controlCVE-2025-54253Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.Exploited89% likelyDetection
- 9.8CriticalApr 27, 2017Adobe ColdFusion DeserializationCVE-2017-3066Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.Exploited91% likelyExploit codeExploit-DBDetection
- 7.4HighMar 18, 2024Adobe ColdFusion Auth bypass / access controlCVE-2024-20767Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.Exploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 8.8HighFeb 21, 2014Adobe Flash Player Memory corruptionCVE-2014-0502Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.Exploited25% likely
- 8.8HighFeb 27, 2013Adobe Flash Player Code / command injectionCVE-2013-0648Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.Exploited11% likely
- 8.8HighFeb 27, 2013Adobe Flash Player Privilege escalationCVE-2013-0643Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content. Exploited11% likely
- 8.8HighFeb 5, 2014Adobe Flash Player Memory corruptionCVE-2014-0497Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.Exploited100% likelyExploit codeExploit-DB · Metasploit
- 9.8CriticalJun 13, 2024Adobe Commerce and Magento Open SourceCVE-2024-34102Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.Exploited100% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalJul 12, 2023Adobe ColdFusion DeserializationCVE-2023-29300Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.Exploited100% likelyExploit codeNucleiDetection
- 9.8CriticalJul 20, 2023Adobe ColdFusion DeserializationCVE-2023-38203Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.Exploited97% likelyExploit codeNucleiDetection
- 7.8HighJan 18, 2023Adobe Acrobat and Reader Memory corruptionCVE-2023-21608Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.Exploited59% likely
- 7.5HighSep 14, 2023Adobe ColdFusion Auth bypass / access controlCVE-2023-38205Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.Exploited100% likelyExploit codeNucleiDetection
- 7.8HighSep 13, 2023Adobe Acrobat and Reader Memory corruptionCVE-2023-26369Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.Exploited6.7% likely
- 9.8CriticalMar 23, 2023Adobe ColdFusion DeserializationCVE-2023-26359Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.Exploited17% likelyDetection
- 7.5HighJul 12, 2023Adobe ColdFusion Auth bypass / access controlCVE-2023-29298Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.Exploited100% likelyExploit codeNucleiDetection
- 8.6HighMar 23, 2023Adobe ColdFusion Auth bypass / access controlCVE-2023-26360Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.Exploited97% likelyExploit codeMetasploit · NucleiDetection
- 7.8HighFeb 17, 2023Adobe premiere rush Memory corruptionCVE-2023-22234Adobe Premiere Rush version 2.6 (and earlier) is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 5.5MediumFeb 17, 2023Adobe bridge Memory corruptionCVE-2023-22231Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- 8.8HighJul 9, 2018Adobe Acrobat and Reader Memory corruptionCVE-2018-4990Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.Exploited36% likely
Top products
- Adobe Campaign Classic8 CVEs in the last year, 8 critical
- experience manager5 CVEs in the last year, 4 critical
- Commerce and Magento2 CVEs in the last year, 2 critical, 2 exploited
- ColdFusion2 CVEs in the last year, 2 critical, 1 exploited
- Acrobat and Reader2 CVEs in the last year, 2 exploited
- photoshop1 CVE in the last year
- dng software development kit1 CVE in the last year
- Creative Cloud Desktop Application1 CVE in the last year
- Adobe Substance 3D Painter1 CVE in the last year
- Adobe Digital Editions1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 28, 2026Adobe security advisory (AV26-1092)ADV-cccs-1173eb0f7ccb
- CCCS (Canada) · Oct 27, 2026Adobe security advisory (AV26-697) – Update 1CVE-2026-48356
- CISA · Oct 27, 2026CISA Adds Two Known Exploited Vulnerabilities to CatalogCVE-2026-48356
- CCCS (Canada) · Oct 14, 2026Adobe security advisory (AV26-1039)ADV-cccs-da22e13cce62
- EUVD exploited · Jul 14, 2026EUVD-2026-44420 · Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could…CVE-2026-48356
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.