Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Adobe

Adobe ColdFusion vulnerabilities

110 published CVEs name Adobe ColdFusion among the affected products; CISA lists 8 of them as exploited in the wild.

All 110 in the listAtom feed of new CVEs
Published CVEs
110
Last 12 months
11
Critical
40
Known exploited
8

Critical 40High 38Medium 30Low 2Not scored 0

CVEs per yearBy the year they were published

  1. 20189
  2. 20197
  3. 20205
  4. 20212
  5. 202214
  6. 202318
  7. 20246
  8. 202549

Known exploitedNewest addition to KEV first

  • CVE-2024-20767

    ColdFusion | Improper Access Control (CWE-284)

    Adobe · ColdFusion

    ExploitedHigh7.4
  • CVE-2023-38203

    Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE

    Adobe · ColdFusion

    ExploitedCritical9.8
  • CVE-2023-29300

    Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

    Adobe · ColdFusion

    ExploitedCritical9.8
  • CVE-2023-26359

    Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

    Adobe · ColdFusion

    ExploitedCritical9.8
  • CVE-2023-38205

    ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

    Adobe · ColdFusion

    ExploitedHigh7.5
  • CVE-2023-29298

    Adobe ColdFusion Improper Access Control Security feature bypass

    Adobe · ColdFusion

    ExploitedHigh7.5
  • CVE-2023-26360

    Adobe ColdFusion Improper Access Control Arbitrary code execution

    Adobe · ColdFusion

    ExploitedHigh8.6
  • CVE-2018-15961

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability.…

    Adobe · ColdFusion

    ExploitedCritical9.8

Newest CVEs

  • CVE-2025-61808

    ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

    Adobe · ColdFusion

    Critical9.1
  • CVE-2025-61813

    ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

    Adobe · ColdFusion

    High7.4
  • CVE-2025-61812

    ColdFusion | Improper Input Validation (CWE-20)

    Adobe · ColdFusion

    High8.4
  • CVE-2025-61821

    ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

    Adobe · ColdFusion

    Medium6.8
  • CVE-2025-64898

    ColdFusion | Insufficiently Protected Credentials (CWE-522)

    Adobe · ColdFusion

    Medium5.3
  • CVE-2025-61810

    ColdFusion | Deserialization of Untrusted Data (CWE-502)

    Adobe · ColdFusion

    High8.4
  • CVE-2025-61809

    ColdFusion | Improper Input Validation (CWE-20)

    Adobe · ColdFusion

    Critical9.1
  • CVE-2025-61822

    ColdFusion | Improper Input Validation (CWE-20)

    Adobe · ColdFusion

    Medium6.2
  • CVE-2025-64897

    ColdFusion | Improper Access Control (CWE-284)

    Adobe · ColdFusion

    Medium5.6
  • CVE-2025-61823

    ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

    Adobe · ColdFusion

    Medium6.2

Most common weaknesses

  1. CWE-502 Deserialization of untrusted data18
  2. CWE-284 Improper access control14
  3. CWE-20 Improper input validation12
  4. CWE-22 Path traversal11
  5. CWE-79 Cross-site scripting (XSS)9
  6. CWE-611 XML external entity (XXE)8
  7. CWE-434 Unrestricted file upload4
  8. CWE-78 OS command injection4
  9. CWE-787 Out-of-bounds write4
  10. CWE-863 Incorrect authorization4