Coldfusion 2023 (Adobe) - vulnerabilities (CVEs)

96 CVEs, 31 in the last 30 days, 1 known versions, newest CVE from 2026-10-13. Vendor: Adobe.

CVEs of Coldfusion 2023

CVE-2026-105897 - CVSS 8.6 (high), 2026-10-13: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not…
CVE-2026-106616 - CVSS 8.6 (high), 2026-10-13: ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An…
CVE-2026-34633 - CVSS 7.7 (high), 2026-10-13: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could…
CVE-2026-106618 - CVSS 8.8 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-106622 - CVSS 10 (critical), 2026-10-13: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not…
CVE-2026-105994 - CVSS 7.7 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage…
CVE-2026-106619 - CVSS 9 (critical), 2026-10-13: ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An…
CVE-2026-106089 - CVSS 8.8 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-106613 - CVSS 8.8 (high), 2026-10-13: ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-106614 - CVSS 7.8 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-106624 - CVSS 10 (critical), 2026-10-13: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…
CVE-2026-75996 - CVSS 7.5 (high), 2026-10-13: ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this…
CVE-2026-106621 - CVSS 9.1 (critical), 2026-10-13: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…
CVE-2026-90530 - CVSS 9.3 (critical), 2026-10-13: ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary…
CVE-2026-105898 - CVSS 8.2 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-105903 - CVSS 9.9 (critical), 2026-10-13: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…
CVE-2026-106090 - CVSS 8.8 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-75994 - CVSS 9.6 (critical), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An…
CVE-2026-34634 - CVSS 8.6 (high), 2026-10-13: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not…
CVE-2026-106620 - CVSS 9.6 (critical), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage…
CVE-2026-76001 - CVSS 7.1 (high), 2026-10-13: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could…
CVE-2026-106612 - CVSS 9.9 (critical), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-106615 - CVSS 8.8 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-75995 - CVSS 8.4 (high), 2026-10-13: ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An…
CVE-2026-75748 - CVSS 7.6 (high), 2026-10-13: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could…
CVE-2026-105900 - CVSS 7.5 (high), 2026-10-13: ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this…
CVE-2026-71385 - CVSS 8.4 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An…
CVE-2026-105901 - CVSS 8.8 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-106623 - CVSS 7.5 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this…
CVE-2026-105899 - CVSS 10 (critical), 2026-10-13: ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the…
CVE-2026-106617 - CVSS 8.8 (high), 2026-10-13: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-76002 - CVSS 6.1 (medium), 2026-09-08: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a…
CVE-2026-75746 - CVSS 9.1 (critical), 2026-09-08: ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary…
CVE-2026-76000 - CVSS 6.5 (medium), 2026-09-08: ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this…
CVE-2026-75998 - CVSS 7.5 (high), 2026-09-08: ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability…
CVE-2026-48273 - CVSS 9.9 (critical), 2026-09-08: ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in…
CVE-2026-76190 - CVSS 8.6 (high), 2026-09-08: ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in…
CVE-2026-75999 - CVSS 8.4 (high), 2026-09-08: ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2026-75993 - CVSS 8.5 (high), 2026-09-08: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into…
CVE-2026-83961 - CVSS 7.1 (high), 2026-09-03: ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to…
CVE-2026-48385 - CVSS 7.7 (high), 2026-08-11: ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a…
CVE-2026-71387 - CVSS 8.8 (high), 2026-08-11: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An…
CVE-2026-71383 - CVSS 7.3 (high), 2026-08-11: is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to…
CVE-2026-21279 - CVSS 8.2 (high), 2026-08-11: is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to…
CVE-2026-48375 - CVSS 6.5 (medium), 2026-08-11: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could…
CVE-2026-48384 - CVSS 4.9 (medium), 2026-08-11: ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges…
CVE-2026-21269 - CVSS 5.4 (medium), 2026-08-11: ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into…
CVE-2026-48376 - CVSS 5.4 (medium), 2026-08-11: is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could…
CVE-2026-48440 - CVSS 8.1 (high), 2026-08-11: ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit…
CVE-2026-34635 - CVSS 8.4 (high), 2026-08-11: is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage…
CVE-2026-48386 - CVSS 7.5 (high), 2026-08-11: ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker…
CVE-2026-48362 - CVSS 10 (critical), 2026-08-11: ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in…
CVE-2026-71386 - CVSS 8.8 (high), 2026-08-11: is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could…
CVE-2026-71384 - CVSS 9.6 (critical), 2026-08-11: is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to…
CVE-2026-25652 - CVSS 7.8 (high), 2026-08-11: is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability…
CVE-2026-21273 - CVSS 8.7 (high), 2026-08-11: is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this…
CVE-2026-48320 - CVSS 8.5 (high), 2026-07-14: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into…
CVE-2026-48324 - CVSS 9.1 (critical), 2026-07-14: ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary…
CVE-2026-48332 - CVSS 7.7 (high), 2026-07-14: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could…
CVE-2026-48318 - CVSS 9.9 (critical), 2026-07-14: ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file…
CVE-2026-48327 - CVSS 9 (critical), 2026-07-14: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.…
CVE-2026-48338 - CVSS 6.8 (medium), 2026-07-14: ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file…
CVE-2026-48329 - CVSS 2.7 (low), 2026-07-14: ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could…
CVE-2026-48319 - CVSS 9.1 (critical), 2026-07-14: ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code…
CVE-2026-48321 - CVSS 9.3 (critical), 2026-07-14: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to…
CVE-2026-48284 - CVSS 9.6 (critical), 2026-07-14: ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The…
CVE-2026-48322 - CVSS 9.9 (critical), 2026-07-14: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…
CVE-2026-48328 - CVSS 7.7 (high), 2026-07-14: ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage…
CVE-2026-48325 - CVSS 9.3 (critical), 2026-07-14: ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the…
CVE-2026-48363 - CVSS 8.2 (high), 2026-07-13: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code…
CVE-2026-48364 - CVSS 8.2 (high), 2026-07-13: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code…
CVE-2026-48316 - CVSS 10 (critical), 2026-07-06: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…
CVE-2026-48315 - CVSS 9.3 (critical), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…
CVE-2026-48281 - CVSS 10 (critical), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…
CVE-2026-48277 - CVSS 10 (critical), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…
CVE-2026-48285 - CVSS 8.6 (high), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature…
CVE-2026-48313 - CVSS 9.3 (critical), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
CVE-2026-48307 - CVSS 8.8 (high), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
CVE-2026-48314 - CVSS 6.5 (medium), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
CVE-2026-48276 - CVSS 10 (critical), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…
CVE-2026-48282 - CVSS 10 (critical), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
CVE-2026-48283 - CVSS 10 (critical), 2026-06-30: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…
CVE-2026-47960 - CVSS 7.4 (high), 2026-06-09: ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead…
CVE-2026-47933 - CVSS 4.8 (medium), 2026-06-09: ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged…
CVE-2026-47932 - CVSS 8.8 (high), 2026-06-09: ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
CVE-2026-47931 - CVSS 8.4 (high), 2026-06-09: ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…
CVE-2026-47930 - CVSS 8.1 (high), 2026-06-09: ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A…
CVE-2026-47929 - CVSS 8.4 (high), 2026-06-09: ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the…
CVE-2026-47928 - CVSS 9.6 (critical), 2026-06-09: ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…
CVE-2026-34619 - CVSS 7.7 (high), 2026-04-14: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
CVE-2026-27308 - CVSS 2.4 (low), 2026-04-14: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application…
CVE-2026-27306 - CVSS 8.4 (high), 2026-04-14: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…
CVE-2026-27305 - CVSS 8.6 (high), 2026-04-14: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
CVE-2026-27304 - CVSS 9.3 (critical), 2026-04-14: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in…
CVE-2026-27307 - CVSS 2.4 (low), 2026-04-14: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application…
CVE-2026-27282 - CVSS 7.5 (high), 2026-04-14: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An…