Adobe Based in San Jose, best known for creating Photoshop, Acrobat (PDF).
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Adobe product.
RSS Feeds for Adobe security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Adobe products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Adobe Sorted by Most Security Vulnerabilities since 2018
Adobe Experience Manager1325 vulnerabilities
Adobe Experience Manager (AEM), is a comprehensive content management solution for building websites, mobile apps and forms
Adobe ColdFusion254 vulnerabilities
Web application server since 1995. Tag or script based programming language CFML.
Adobe Creative Cloud Desktop Application24 vulnerabilities
The desktop client for Adobe Creative Cloud
Recent Adobe Security Advisories
| Advisory | Title | Published |
|---|---|---|
| APSB26-178 | Substance 3D Painter Security Bulletin APSB26-178 | October 27, 2026 |
| APSB26-182 | Adobe Connect Security Bulletin APSB26-182 | October 27, 2026 |
| APSB26-135 | Adobe Creative Cloud Desktop Application Security Bulletin APSB26-135 | October 27, 2026 |
| APSB26-162 | Adobe Campaign Classic Security Bulletin APSB26-162 | October 27, 2026 |
| APSB26-158 | Adobe Photoshop Security Bulletin APSB26-158 | October 13, 2026 |
| APSB26-171 | Adobe Dimension Security Bulletin APSB26-171 | October 13, 2026 |
| APSB26-163 | Adobe Content Credentials SDK Security Bulletin APSB26-163 | October 13, 2026 |
| APSB26-159 | Adobe Substance 3D Sampler Security Bulletin APSB26-159 | October 13, 2026 |
| APSB26-172 | Adobe FrameMaker Security Bulletin APSB26-172 | October 13, 2026 |
| APSB26-153 | Adobe Commerce Security Bulletin APSB26-153 | October 13, 2026 |
Known Exploited Adobe Vulnerabilities
The following Adobe vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability |
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. CVE-2026-48356 Exploit Probability: 28.2% |
October 27, 2026 |
| Adobe Commerce and Magento Incorrect Authorization Vulnerability |
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. CVE-2026-71362 |
September 24, 2026 |
| Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vul |
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. CVE-2026-75650 |
September 8, 2026 |
| Adobe ColdFusion Path Traversal Vulnerability |
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CVE-2026-48282 Exploit Probability: 99.0% |
July 7, 2026 |
| Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability |
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption. CVE-2009-3459 Exploit Probability: 86.5% |
May 20, 2026 |
| Adobe Acrobat and Reader Prototype Pollution Vulnerability |
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution. CVE-2026-34621 Exploit Probability: 7.1% |
April 13, 2026 |
| Adobe Acrobat Use-After-Free Vulnerability |
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution CVE-2020-9715 Exploit Probability: 33.3% |
April 13, 2026 |
| Adobe Commerce and Magento Improper Input Validation Vulnerability |
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. CVE-2025-54236 Exploit Probability: 95.4% |
October 24, 2025 |
| Adobe Experience Manager Forms Code Execution Vulnerability |
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution. CVE-2025-54253 Exploit Probability: 80.8% |
October 15, 2025 |
| Adobe ColdFusion Deserialization Vulnerability |
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. CVE-2017-3066 Exploit Probability: 90.6% |
February 24, 2025 |
| Adobe ColdFusion Improper Access Control Vulnerability |
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. CVE-2024-20767 Exploit Probability: 98.5% |
December 16, 2024 |
| Adobe Flash Player Incorrect Default Permissions Vulnerability |
Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content. CVE-2013-0643 Exploit Probability: 10.5% |
September 17, 2024 |
| Adobe Flash Player Code Execution Vulnerability |
Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content. CVE-2013-0648 Exploit Probability: 11.1% |
September 17, 2024 |
| Adobe Flash Player Double Free Vulnerablity |
Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code. CVE-2014-0502 Exploit Probability: 24.8% |
September 17, 2024 |
| Adobe Flash Player Integer Underflow Vulnerablity |
Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code. CVE-2014-0497 Exploit Probability: 99.9% |
September 17, 2024 |
| Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) V |
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. CVE-2024-34102 Exploit Probability: 100.0% |
July 17, 2024 |
| Adobe ColdFusion Deserialization of Untrusted Data Vulnerability |
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-29300 Exploit Probability: 100.0% |
January 8, 2024 |
| Adobe ColdFusion Deserialization of Untrusted Data Vulnerability |
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-38203 Exploit Probability: 97.1% |
January 8, 2024 |
| Adobe Acrobat and Reader Use-After-Free Vulnerability |
Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user. CVE-2023-21608 Exploit Probability: 59.4% |
October 10, 2023 |
| Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability |
Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution. CVE-2023-26369 Exploit Probability: 7.5% |
September 14, 2023 |
Of the known exploited vulnerabilities above, 11 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 5 known exploited Adobe vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
Top 10 Riskiest Adobe Vulnerabilities
Based on the current exploit probability, these Adobe vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.
| Rank | CVE | EPSS | Vulnerability |
|---|---|---|---|
| 1 | CVE-2024-34102 | 100.0% | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) V |
| 2 | CVE-2023-29300 | 100.0% | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability |
| 3 | CVE-2018-15961 | 100.0% | Adobe ColdFusion Remote Code Execution |
| 4 | CVE-2014-0497 | 99.9% | Adobe Flash Player Integer Underflow Vulnerablity |
| 5 | CVE-2015-3113 | 99.8% | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability |
| 6 | CVE-2023-38205 | 99.8% | Adobe ColdFusion Improper Access Control Vulnerability |
| 7 | CVE-2023-29298 | 99.8% | Adobe ColdFusion Improper Access Control Vulnerability |
| 8 | CVE-2008-2992 | 99.8% | Adobe Reader and Acrobat Input Validation Vulnerability |
| 9 | CVE-2010-2861 | 99.7% | Adobe ColdFusion Directory Traversal Vulnerability |
| 10 | CVE-2011-0611 | 99.4% | Adobe Flash Player Remote Code Execution Vulnerability |
By the Year
In 2026 there have been 1051 vulnerabilities in Adobe with an average score of 7.1 out of ten. Last year, in 2025 Adobe had 817 security vulnerabilities published. That is, 234 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.77.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1051 | 7.10 |
| 2025 | 817 | 6.33 |
| 2024 | 753 | 6.20 |
| 2023 | 668 | 6.35 |
| 2022 | 421 | 6.77 |
| 2021 | 323 | 6.73 |
| 2020 | 344 | 7.74 |
| 2019 | 324 | 6.72 |
| 2018 | 94 | 7.91 |
It may take a day or so for new Adobe vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Adobe Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-123259 | Nov 10, 2026 |
Adobe Experience Manager Stored XSS in Form FieldsAdobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. |
Experience Manager
|
| CVE-2026-123258 | Nov 10, 2026 |
Adobe Experience Manager DOMBased XSS (CVE2026123258)Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. |
Experience Manager
|
| CVE-2026-119017 | Nov 10, 2026 |
Adobe Experience Manager Authz Bypass RCEAdobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Experience Manager
|
| CVE-2026-118482 | Nov 10, 2026 |
Adobe Experience Manager Improper Input Validation Bypass (CVE-2026-118482)Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited read and write access. Exploitation of this issue does not require user interaction. |
Experience Manager
|
| CVE-2026-118481 | Nov 10, 2026 |
Adobe Experience Manager DOMBased XSS (CVE2026118481)Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. |
Experience Manager
|
| CVE-2026-118480 | Nov 10, 2026 |
Adobe Experience Manager DOMbased XSS (CVE2026118480)Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. |
Experience Manager
|
| CVE-2026-118479 | Nov 10, 2026 |
Adobe Experience Manager DOMBased XSS (CVE2026118479)Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. |
Experience Manager
|
| CVE-2026-118478 | Nov 10, 2026 |
Adobe Experience Manager stored XSS in form fieldsAdobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. |
Experience Manager
|
| CVE-2026-118197 | Nov 10, 2026 |
Adobe Experience Manager DOMbased XSS (CVE2026118197)Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. |
Experience Manager
|
| CVE-2026-114372 | Nov 10, 2026 |
Adobe Experience Manager Stored XSS (CVE-2026-114372)Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. |
Experience Manager
|
| CVE-2026-114371 | Nov 10, 2026 |
Adobe Experience Manager Auth Bypass RCE via Improper AuthorizationAdobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Experience Manager
|
| CVE-2026-113580 | Nov 10, 2026 |
CVE-2026-113580: Adobe Experience Manager Code InjectionAdobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Experience Manager
|
| CVE-2026-113579 | Nov 10, 2026 |
Adobe Experience Manager Code Injection (CVE-2026-113579)Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Experience Manager
|
| CVE-2026-123341 | Nov 10, 2026 |
Adobe Experience Manager Reflected XSS (CVE2026123341)Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed. |
Experience Manager
|
| CVE-2026-121898 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilityAdobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121896 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilityAdobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121913 | Nov 10, 2026 |
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalationAdobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction. |
Connect
|
| CVE-2026-121908 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilityAdobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121912 | Nov 10, 2026 |
Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerabilityAdobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. |
Connect
|
| CVE-2026-121352 | Nov 10, 2026 |
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalationAdobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121887 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerabilityAdobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121350 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilityAdobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121349 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilityAdobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121910 | Nov 10, 2026 |
Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerabilityAdobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed. |
Connect
|
| CVE-2026-121900 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilityAdobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction. |
Connect
|
| CVE-2026-121355 | Nov 10, 2026 |
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalationAdobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction. |
Connect
|
| CVE-2026-121351 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilityAdobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121889 | Nov 10, 2026 |
Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalationAdobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121894 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilityAdobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121356 | Nov 10, 2026 |
Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalationAdobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121906 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilityAdobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121904 | Nov 10, 2026 |
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerabilityAdobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. |
Connect
|
| CVE-2026-121353 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerabilityAdobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121902 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilityAdobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the application. Exploitation of this issue does not require user interaction. |
Connect
|
| CVE-2026-121890 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerabilityAdobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121892 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerabilityAdobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-121354 | Nov 10, 2026 |
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilityAdobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. |
Connect
|
| CVE-2026-122102 | Nov 10, 2026 |
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerabilityAdobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. |
Connect
|
| CVE-2026-118483 | Nov 10, 2026 |
Dimension is affected by an Improper Input Validation vulnerabilityDimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. |
Dimension
|
| CVE-2026-116003 | Nov 10, 2026 |
Photoshop Desktop is affected by an out-of-bounds write vulnerabilityPhotoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-118198 | Nov 10, 2026 |
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-servicePhotoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-113575 | Nov 10, 2026 |
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerabilityPhotoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-118199 | Nov 10, 2026 |
Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memoryPhotoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-117547 | Nov 10, 2026 |
Photoshop Desktop is affected by an out-of-bounds write vulnerabilityPhotoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-116480 | Nov 10, 2026 |
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerabilityPhotoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-113578 | Nov 10, 2026 |
Photoshop Desktop is affected by an Uncontrolled Recursion vulnerability that could result in an application denial-of-servicePhotoshop Desktop is affected by an Uncontrolled Recursion vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-117546 | Nov 10, 2026 |
Photoshop Desktop is affected by a Use After Free vulnerabilityPhotoshop Desktop is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-114373 | Nov 10, 2026 |
Photoshop Desktop is affected by a Divide By Zero vulnerability that could result in an application denial-of-servicePhotoshop Desktop is affected by a Divide By Zero vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-113571 | Nov 10, 2026 |
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-servicePhotoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|
| CVE-2026-118200 | Nov 10, 2026 |
Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memoryPhotoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
Photoshop
|