Adobe ColdFusion 2025

• CVE-2026-48282 Critical 10.0 Exploited ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 42.4%
• CVE-2026-105897 High 8.6 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 0.7%
• CVE-2026-106616 High 8.6 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 0.5%
• CVE-2026-34633 High 7.7 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 0.5%
• CVE-2026-106618 High 8.8 ColdFusion | Incorrect Authorization (CWE-863) 0.1%
• CVE-2026-105994 High 7.7 ColdFusion | Incorrect Authorization (CWE-863) 0.3%
• CVE-2026-106622 Critical 10.0 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 0.8%
• CVE-2026-106619 Critical 9.0 ColdFusion | Improper Input Validation (CWE-20) 0.6%
• CVE-2026-106089 High 8.8 ColdFusion | Incorrect Authorization (CWE-863) 0.2%
• CVE-2026-106613 High 8.8 ColdFusion | Improper Input Validation (CWE-20) 0.8%
• CVE-2026-106614 High 7.8 ColdFusion | Incorrect Authorization (CWE-863) 0.2%
• CVE-2026-106624 Critical 10.0 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) 1.1%
• CVE-2026-75996 High 7.5 ColdFusion | Uncontrolled Resource Consumption (CWE-400) 0.6%
• CVE-2026-106621 Critical 9.1 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) 0.9%
• CVE-2026-90530 Critical 9.3 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 0.3%
• CVE-2026-105898 High 8.2 ColdFusion | Incorrect Authorization (CWE-863) 0.1%
• CVE-2026-105903 Critical 9.9 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) 0.6%
• CVE-2026-75994 Critical 9.6 ColdFusion | Incorrect Authorization (CWE-863) 0.3%
• CVE-2026-106090 High 8.8 ColdFusion | Incorrect Authorization (CWE-863) 0.1%
• CVE-2026-34634 High 8.6 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 0.4%
• CVE-2026-106620 Critical 9.6 ColdFusion | Incorrect Authorization (CWE-863) 0.4%
• CVE-2026-76001 High 7.1 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 0.5%
• CVE-2026-106612 Critical 9.9 ColdFusion | Incorrect Authorization (CWE-863) 0.5%
• CVE-2026-106615 High 8.8 ColdFusion | Incorrect Authorization (CWE-863) 0.2%
• CVE-2026-75995 High 8.4 ColdFusion | Improper Input Validation (CWE-20) 0.2%
• CVE-2026-75748 High 7.6 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 0.4%
• CVE-2026-105900 High 7.5 ColdFusion | Improper Input Validation (CWE-20) 0.7%
• CVE-2026-105901 High 8.8 ColdFusion | Incorrect Authorization (CWE-863) 0.2%
• CVE-2026-71385 High 8.4 ColdFusion | Incorrect Authorization (CWE-863) 0.3%
• CVE-2026-106623 High 7.5 ColdFusion | Incorrect Authorization (CWE-863) 0.4%
• CVE-2026-105899 Critical 10.0 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) 1.0%
• CVE-2026-106617 High 8.8 ColdFusion | Incorrect Authorization (CWE-863) 0.2%
• CVE-2026-76002 Medium 6.1 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) 0.4%
• CVE-2026-75746 Critical 9.1 ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 1.0%
• CVE-2026-76000 Medium 6.5 ColdFusion | Uncontrolled Resource Consumption (CWE-400) 0.4%
• CVE-2026-75998 High 7.5 ColdFusion | Improper Access Control (CWE-284) 0.8%
• CVE-2026-48273 Critical 9.9 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) 1.3%
• CVE-2026-76190 High 8.6 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) 0.8%
• CVE-2026-75999 High 8.4 ColdFusion | Improper Input Validation (CWE-20) 0.5%
• CVE-2026-75993 High 8.5 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) 0.4%
• CVE-2026-83961 High 7.1 ColdFusion | Improper Authentication (CWE-287) 0.4%
• CVE-2026-71387 High 8.8 ColdFusion | Incorrect Authorization (CWE-863) 0.5%
• CVE-2026-48385 High 7.7 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) 1.6%
• CVE-2026-71383 High 7.3 ColdFusion | Incorrect Authorization (CWE-863) 0.6%
• CVE-2026-21279 High 8.2 ColdFusion | Improper Input Validation (CWE-20) 0.8%
• CVE-2026-48384 Medium 4.9 ColdFusion | Improper Input Validation (CWE-20) 1.0%
• CVE-2026-48375 Medium 6.5 ColdFusion | Incorrect Authorization (CWE-863) 0.8%
• CVE-2026-21269 Medium 4.6 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) 0.6%
• CVE-2026-48376 Medium 5.4 ColdFusion | Improper Encoding or Escaping of Output (CWE-116) 0.7%
• CVE-2026-48440 High 8.1 ColdFusion | Heap-based Buffer Overflow (CWE-122) 1.3%