Vendor
Adobe
7,974 known vulnerabilities in products by Adobe, 82 of them actively exploited (CISA KEV).
Key figures
7,974
Vulnerabilities
82
Actively exploited (KEV)
11
Used by ransomware
875
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2023-29300 | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2023-38203 | Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2010-2861 | Adobe ColdFusion Directory Traversal Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2016-4117 | Adobe Flash Player Arbitrary Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2016-1019 | Adobe Flash Player Arbitrary Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2026-71362 | Adobe Commerce | Incorrect Authorization (CWE-863) In CISA KEV | 9.1 | |
| Critical | CVE-2026-48282 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) In CISA KEV | 10.0 | |
| Critical | CVE-2008-2992 | Adobe Reader and Acrobat Input Validation Vulnerability In CISA KEVRansomware | 7.8 | |
| Critical | CVE-2018-15982 | Adobe Flash Player Use-After-Free Vulnerability In CISA KEVRansomware | 7.8 | |
| Critical | CVE-2018-4878 | Adobe Flash Player Use-After-Free Vulnerability In CISA KEVRansomware | 7.8 | |
| Critical | CVE-2010-0188 | Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability In CISA KEVRansomware | 7.8 | |
| Critical | CVE-2015-7645 | Adobe Flash Player Arbitrary Code Execution Vulnerability In CISA KEVRansomware | 7.8 | |
| Critical | CVE-2026-75650 | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) In CISA KEV | 10.0 | |
| Critical | CVE-2025-54253 | Adobe Experience Manager | Incorrect Authorization (CWE-863) In CISA KEV | 10.0 | |
| Critical | CVE-2009-3960 | Adobe BlazeDS Information Disclosure Vulnerability In CISA KEVRansomware | 6.5 | |
| Critical | CVE-2025-54236 | Adobe Commerce | Improper Input Validation (CWE-20) In CISA KEV | 9.1 | |
| Critical | CVE-2024-34102 | XXE can expose crypt key and other secrets granting full admin access In CISA KEV | 9.8 | |
| Critical | CVE-2022-24086 | Adobe Commerce checkout improper input validation leads to remote code execution In CISA KEV | 9.8 | |
| Critical | CVE-2018-15961 | Adobe ColdFusion Unrestricted File Upload Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2014-0497 | Adobe Flash Player Integer Underflow Vulnerablity In CISA KEV | 9.8 | |
| Critical | CVE-2015-3113 | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2015-0313 | Adobe Flash Player Use-After-Free Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2015-5122 | Adobe Flash Player Use-After-Free Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2013-0632 | Adobe ColdFusion Authentication Bypass Vulnerability In CISA KEV | 9.8 |
News
- Critical BlockStrap flaw lets hackers run code on Magento serversbleepingcomputer,
- October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero dayscsoonline,
- NCSC-2026-0393 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classicncsc-nl,
- NCSC-2026-0391 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Connect en Adobe Connect Android Mobile Appncsc-nl,
- NCSC-2026-0390 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Experience Manager Forms JEEncsc-nl,
- September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windowscsoonline,