Adobe Based in San Jose, best known for creating Photoshop, Acrobat (PDF).

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Adobe product.

RSS Feeds for Adobe security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Adobe products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Adobe Sorted by Most Security Vulnerabilities since 2018

Adobe Experience Manager1162 vulnerabilities
Adobe Experience Manager (AEM), is a comprehensive content management solution for building websites, mobile apps and forms

Adobe Acrobat545 vulnerabilities
Application for working with PDF documents

Adobe ColdFusion216 vulnerabilities
Web application server since 1995. Tag or script based programming language CFML.

Adobe Commerce215 vulnerabilities

Adobe Commerce182 vulnerabilities

Adobe InDesign173 vulnerabilities

Adobe Magento146 vulnerabilities

Adobe Illustrator133 vulnerabilities

Adobe Dimension107 vulnerabilities

Adobe Bridge99 vulnerabilities

Adobe Commerce B2b92 vulnerabilities

Adobe Photoshop91 vulnerabilities
Popular Photo Editing Software

Adobe Substance 3d Stager84 vulnerabilities

Adobe Animate83 vulnerabilities

Adobe Framemaker79 vulnerabilities

Adobe Substance 3d Painter78 vulnerabilities

Adobe After Effects73 vulnerabilities

Adobe Connect61 vulnerabilities

Adobe Magento Open Source53 vulnerabilities

Adobe Incopy45 vulnerabilities

Adobe Substance 3d Designer43 vulnerabilities

Adobe Media Encoder43 vulnerabilities

Adobe Substance 3d Modeler37 vulnerabilities

Adobe Reader32 vulnerabilities

Adobe Audition32 vulnerabilities

Adobe Substance 3d Sampler29 vulnerabilities

Adobe Xmp Toolkit Software Development Kit28 vulnerabilities

Adobe Premiere Pro27 vulnerabilities

Adobe Creative Cloud Desktop Application23 vulnerabilities
The desktop client for Adobe Creative Cloud

Adobe Magento Commerce21 vulnerabilities

Adobe Lightroom17 vulnerabilities

Adobe Experience Manager Screens15 vulnerabilities

Adobe Dreamweaver14 vulnerabilities

Adobe Format Plugins12 vulnerabilities

Adobe Premiere Rush11 vulnerabilities

Adobe Substance 3d Viewer10 vulnerabilities

Adobe Photoshop Elements3 vulnerabilities

Adobe Framemaker Publishing Server2 vulnerabilities

Adobe Robohelp2 vulnerabilities

Adobe Acrobat 20171 vulnerability

Adobe Lifecycle Data Services1 vulnerability

Adobe Acrobat 20201 vulnerability

Adobe Acrobat Reader 20171 vulnerability

Adobe Acrobat Reader 20201 vulnerability

Adobe Aero1 vulnerability

Adobe Air Sdk Compiler1 vulnerability

Adobe Livecycle1 vulnerability

Adobe Pdf Library Sdk1 vulnerability

Adobe Pass1 vulnerability

Recent Adobe Security Advisories

Advisory	Title	Published
APSB26-92	Security Updates Available for Adobe Commerce \| APSB26-92	August 11, 2026
APSB26-90	Security updates available for Adobe ColdFusion \| APSB26-90	August 11, 2026
APSB26-94	Security Updates Available for Adobe Lightroom \| APSB26-94	August 11, 2026
APSB26-123	Security updates available for Adobe Campaign Classic \| APSB26-123	August 11, 2026
APSB26-111	Security updates available for Content Credentials SDK \| APSB26-111	August 11, 2026
APSB26-114	Security updates available for Adobe Campaign Classic \| APSB26-114	July 29, 2026
APSB26-87	Security updates available for Adobe Format Plugins \| APSB26-87	July 28, 2026
APSB26-89	Security Updates Available for Adobe Bridge \| APSB26-89	July 28, 2026
APSB26-73	Security Updates Available for Adobe Commerce \| APSB26-73	July 14, 2026
APSB26-79	Security Updates Available for Adobe Illustrator \| APSB26-79	July 14, 2026

Known Exploited Adobe Vulnerabilities

The following Adobe vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Adobe ColdFusion Path Traversal Vulnerability	Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CVE-2026-48282 Exploit Probability: 99.0%	July 7, 2026
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability	Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption. CVE-2009-3459 Exploit Probability: 86.6%	May 20, 2026
Adobe Acrobat Use-After-Free Vulnerability	Adobe Acrobat contains a use-after-free vulnerability that allows for code execution CVE-2020-9715 Exploit Probability: 48.4%	April 13, 2026
Adobe Acrobat and Reader Prototype Pollution Vulnerability	Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution. CVE-2026-34621 Exploit Probability: 7.1%	April 13, 2026
Adobe Commerce and Magento Improper Input Validation Vulnerability	Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. CVE-2025-54236 Exploit Probability: 96.7%	October 24, 2025
Adobe Experience Manager Forms Code Execution Vulnerability	Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution. CVE-2025-54253 Exploit Probability: 87.5%	October 15, 2025
Adobe ColdFusion Deserialization Vulnerability	Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. CVE-2017-3066 Exploit Probability: 90.6%	February 24, 2025
Adobe ColdFusion Improper Access Control Vulnerability	Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. CVE-2024-20767 Exploit Probability: 98.5%	December 16, 2024
Adobe Flash Player Code Execution Vulnerability	Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content. CVE-2013-0648 Exploit Probability: 11.1%	September 17, 2024
Adobe Flash Player Incorrect Default Permissions Vulnerability	Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content. CVE-2013-0643 Exploit Probability: 10.5%	September 17, 2024
Adobe Flash Player Integer Underflow Vulnerablity	Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code. CVE-2014-0497 Exploit Probability: 99.9%	September 17, 2024
Adobe Flash Player Double Free Vulnerablity	Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code. CVE-2014-0502 Exploit Probability: 24.2%	September 17, 2024
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) V	Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. CVE-2024-34102 Exploit Probability: 100.0%	July 17, 2024
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-38203 Exploit Probability: 96.7%	January 8, 2024
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-29300 Exploit Probability: 100.0%	January 8, 2024
Adobe Acrobat and Reader Use-After-Free Vulnerability	Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user. CVE-2023-21608 Exploit Probability: 61.5%	October 10, 2023
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability	Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution. CVE-2023-26369 Exploit Probability: 7.0%	September 14, 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. CVE-2023-26359 Exploit Probability: 17.9%	August 21, 2023
Adobe ColdFusion Improper Access Control Vulnerability	Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. CVE-2023-29298 Exploit Probability: 99.8%	July 20, 2023
Adobe ColdFusion Improper Access Control Vulnerability	Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. CVE-2023-38205 Exploit Probability: 99.7%	July 20, 2023

Of the known exploited vulnerabilities above, 13 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 5 known exploited Adobe vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest Adobe Vulnerabilities

Based on the current exploit probability, these Adobe vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

Rank	CVE	EPSS	Vulnerability
1	CVE-2024-34102	100.0%	Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) V
2	CVE-2023-29300	100.0%	Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
3	CVE-2018-15961	100.0%	Adobe ColdFusion Remote Code Execution
4	CVE-2015-3113	99.9%	Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
5	CVE-2014-0497	99.9%	Adobe Flash Player Integer Underflow Vulnerablity
6	CVE-2023-29298	99.8%	Adobe ColdFusion Improper Access Control Vulnerability
7	CVE-2023-38205	99.7%	Adobe ColdFusion Improper Access Control Vulnerability
8	CVE-2010-2861	99.7%	Adobe ColdFusion Directory Traversal Vulnerability
9	CVE-2015-5119	99.3%	Adobe Flash Player Use-After-Free Vulnerability
10	CVE-2022-24086	99.1%	Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

By the Year

In 2026 there have been 570 vulnerabilities in Adobe with an average score of 7.0 out of ten. Last year, in 2025 Adobe had 817 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Adobe in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.64.

Year	Vulnerabilities	Average Score
2026	570	6.97
2025	817	6.33
2024	753	6.20
2023	668	6.35
2022	421	6.77
2021	323	6.73
2020	344	7.74
2019	324	6.72
2018	94	7.91

It may take a day or so for new Adobe vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Adobe Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-48414	Aug 11, 2026	Adobe Commerce Stored XSS in Form Fields (CVE-2026-48414) Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control. Scope is changed.	Commerce Commerce B2b Magento Open Source And others...
CVE-2026-48416	Aug 11, 2026	Adobe Commerce Incorrect Authorization Bypass Unauthorized Read Access Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.	Commerce Commerce B2b Magento Open Source And others...
CVE-2026-48415	Aug 11, 2026	Adobe Commerce Incorrect Auth Bypass Grants Read/Write Access Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.	Commerce Commerce B2b Magento Open Source And others...
CVE-2026-48413	Aug 11, 2026	Adobe Commerce XSS: Stored XSS in Form Fields (CVE-2026-48413) Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.	Commerce Commerce B2b Magento Open Source And others...
CVE-2026-48412	Aug 11, 2026	Adobe Commerce (Magento) Incorrect Auth Privilege Escalation Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.	Commerce Commerce B2b Magento Open Source And others...
CVE-2026-48411	Aug 11, 2026	Adobe Commerce Auth Bypass: Security Feature Bypass via Incorrect Authorization Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.	Commerce Commerce B2b Magento Open Source And others...
CVE-2026-71362	Aug 11, 2026	Adobe Commerce Incorrect Authorization Privilege Escalation (CVE-2026-71362) Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.	Commerce Commerce B2b Magento Open Source And others...
CVE-2026-48381	Aug 11, 2026	Adobe Campaign Classic SQLi Fields May Lead to Remote Code Exec Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-71398	Aug 11, 2026	Adobe Campaign Classic ACC Incorrect Auth leads to arbitrary code execution Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-27302	Aug 11, 2026	Adobe Campaign Classic: Incorrect Auth Allows Arbitrary Code Exec Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.	Connect
CVE-2026-48409	Aug 11, 2026	Lightroom Classic OOB Write Arbitrary Code Exec via Malicious File Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Lightroom
CVE-2026-48408	Aug 11, 2026	Adobe Lightroom Classic OOB Write Arbitrary Code Exec Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Lightroom
CVE-2026-48441	Aug 11, 2026	Lightroom Classic Path Traversal Enables Arbitrary File Read Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.	Lightroom
CVE-2026-48447	Aug 11, 2026	Adobe Lightroom Classic Unauthorized File-Open Code Execution Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.	Lightroom
CVE-2026-48406	Aug 11, 2026	Adobe Lightroom Classic OOB Write RCE Vulnerability Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Lightroom
CVE-2026-48405	Aug 11, 2026	Lightroom Classic OOB write arbitrary code exec Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Lightroom
CVE-2026-48397	Aug 11, 2026	Adobe Lightroom Classic Deserialization Vulnerability Allows Arbitrary Code Exec Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.	Lightroom
CVE-2026-48407	Aug 11, 2026	Adobe Lightroom Classic VLB Out-Of-Bounds Write Arbitrary Code Execution Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Lightroom
CVE-2026-48410	Aug 11, 2026	Out-of-bounds Write in Adobe Lightroom Classic Enabling Arbitrary Exec Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Lightroom
CVE-2026-48404	Aug 11, 2026	Adobe Lightroom Classic: OOB write vuln (CVE-2026-48404) Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Lightroom
CVE-2026-47940	Aug 11, 2026	Adobe Lightroom Classic Integer Overflow (int) leads to arbitrary code execution Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Lightroom
CVE-2026-48434	Aug 11, 2026	Uncontrolled Resource Consumption in CAI Content Credentials Leads to DoS CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-48443	Aug 11, 2026	Uncontrolled Resource Consumption in CAI Content Credentials Leads to DoS CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-47922	Aug 11, 2026	SSRF in CAI Content Credentials Enables Priv Escalation CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVE-2026-71390	Aug 11, 2026	Adobe CAI Content Credentials Improper Input Validation Bypass CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
CVE-2026-48445	Aug 11, 2026	CAI Content Credentials: Integer Overflow DoS Vulnerability CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-48442	Aug 11, 2026	Adobe CAI Content Credentials Path Traversal -> arbitrary FS read CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-48387	Aug 11, 2026	Adobe Content Credentials Integer Overflow DoS CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-48436	Aug 11, 2026	CVE-2026-48436: Imp. Input Validation in CAI Content Credentials Enables Bypass CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
CVE-2026-48438	Aug 11, 2026	Adobe CAI Content Credentials NULL Deref DoS CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-48446	Aug 11, 2026	Adobe CAI Content Credentials: Path Traversal Read CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
CVE-2026-48444	Aug 11, 2026	Integer Overflow in CAI Content Credentials Enables Unauth DoS CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-48435	Aug 11, 2026	Adobe CAI Content Credentials Integer Underflow Crash Vulnerability CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-48439	Aug 11, 2026	URC: Uncontrolled Resource Consumption in Adobe CAI Content Credentials CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-48437	Aug 11, 2026	Adobe CAI Content Credentials Improper Cert Validation Bypass CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
CVE-2026-71389	Aug 11, 2026	CAI Content Creds Integer Underflow DoS CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-71387	Aug 11, 2026	ColdFusion Incorrect Auth Leading to Code Execution ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction.	ColdFusion
CVE-2026-48385	Aug 11, 2026	ColdFusion OS Command Injection Security Feature Bypass ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.	ColdFusion
CVE-2026-71383	Aug 11, 2026	Adobe Acrobat Reader Incorrect Authorization Bypass (CVE-2026-71383) is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.	ColdFusion
CVE-2026-21279	Aug 11, 2026	Adobe Reader Improper Input Validation Allows Sec Feature Bypass is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.	ColdFusion
CVE-2026-48384	Aug 11, 2026	ColdFusion Improper Input Validation Leads to DoS (CVE-2026-48384) ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.	ColdFusion
CVE-2026-48375	Aug 11, 2026	ColdFusion Incorrect Auth Enables DoS Crash ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.	ColdFusion
CVE-2026-48376	Aug 11, 2026	Adobe Acrobat Reader Improper Output Encoding Bypass to Unprivileged Write is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.	ColdFusion
CVE-2026-21269	Aug 11, 2026	Adobe Stored XSS in Form Fields is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.	ColdFusion
CVE-2026-48440	Aug 11, 2026	Adobe ColdFusion Heap Buffer Overflow Remote Code Execution ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.	ColdFusion
CVE-2026-34635	Aug 11, 2026	Adobe Acrobat Reader CVE-2026-34635 Hardcoded Crypto Key Bypass is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed.	ColdFusion
CVE-2026-48386	Aug 11, 2026	Broken Crypto in Adobe ColdFusion Exposes Sensitive Memory ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.	ColdFusion
CVE-2026-48362	Aug 11, 2026	ColdFusion OS Command Injection (CVE-2026-48362) Arbitrary Code Exec ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.	ColdFusion
CVE-2026-71386	Aug 11, 2026	Adobe Reader XSS allows arbitrary code exec in admin zone is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.	ColdFusion
CVE-2026-71384	Aug 11, 2026	Adobe CVE-2026-71384: Incorrect Auth Bypass Unrestricted Access is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.	ColdFusion