Adobe vulnerabilities in CISA KEV
Adobe has 83 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 4th highest of any vendor. 7 were added in the last 12 months; 11 are linked to known ransomware use (13.3% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 184), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Flash Player, with 33 entries. Other frequently affected products: ColdFusion (16); Acrobat and Reader (13).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor adobe --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
83
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-10-27
most recent entry
┌─ last 12 months
7
entries added
┌─ ransomware use
11 of 83
13.3% linked to ransomware
┌─ distinct products
14
affected products
$ awk -F, {print $1} /var/log/kev/adobe.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 5 | 1 |
| 2022 | 54 | 8 |
| 2023 | 6 | 0 |
| 2024 | 8 | 2 |
| 2025 | 3 | 0 |
| 2026 | 7 | 0 |
$ sort /var/log/kev/adobe.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Flash Player 33 entries
- ColdFusion 16 entries
- Acrobat and Reader 13 entries
- Reader and Acrobat 8 entries
- Commerce and Magento 2 entries
$ kev-due-dates --vendor adobe
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Adobe
21 days (range 3 to 184)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/adobe.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (70 of 83 have at least one CWE).
$ grep -ril 'Adobe' /var/log/news | head -5
Our reporting that names Adobe or one of its KEV CVE ids, newest first.
- [INFO] Hackers Use Fake Events to Steal Microsoft and Google Accounts news/fake-events-steal-microsoft-google-accounts.md
Patch Week pages with these entries
$ wc -l ./adobe.kev · 83 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-48356
Commerce and Magento
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
due 2026-11-10 · CWE-434
$ cat CVE-2026-48356.txt
Description. Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-71362
Commerce and Magento
Adobe Commerce and Magento Incorrect Authorization Vulnerability
due 2026-09-27 · CWE-863
$ cat CVE-2026-71362.txt
Description. Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-75650
Commerce and Magento
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
due 2026-09-11 · CWE-1336
$ cat CVE-2026-75650.txt
Description. Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-48282
ColdFusion
Adobe ColdFusion Path Traversal Vulnerability
due 2026-07-10 · CWE-22
$ cat CVE-2026-48282.txt
Description. Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2009-3459
Acrobat and Reader
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
due 2026-06-03 · CWE-119
$ cat CVE-2009-3459.txt
Description. Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2020-9715
Acrobat
Adobe Acrobat Use-After-Free Vulnerability
due 2026-04-27 · CWE-416
$ cat CVE-2020-9715.txt
Description. Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-34621
Acrobat and Reader
Adobe Acrobat and Reader Prototype Pollution Vulnerability
due 2026-04-27 · CWE-1321
$ cat CVE-2026-34621.txt
Description. Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-54236
Commerce and Magento
Adobe Commerce and Magento Improper Input Validation Vulnerability
due 2025-11-14 · CWE-20
$ cat CVE-2025-54236.txt
Description. Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-54253
Experience Manager (AEM) Forms
Adobe Experience Manager Forms Code Execution Vulnerability
due 2025-11-05
$ cat CVE-2025-54253.txt
Description. Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2017-3066
ColdFusion
Adobe ColdFusion Deserialization Vulnerability
due 2025-03-17 · CWE-502
$ cat CVE-2017-3066.txt
Description. Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-20767
ColdFusion
Adobe ColdFusion Improper Access Control Vulnerability
due 2025-01-06 · CWE-284
$ cat CVE-2024-20767.txt
Description. Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2013-0643
Flash Player
Adobe Flash Player Incorrect Default Permissions Vulnerability
due 2024-10-08 · CWE-264
$ cat CVE-2013-0643.txt
Description. Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.
Required action. The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CVE-2013-0648
Flash Player
Adobe Flash Player Code Execution Vulnerability
due 2024-10-08
$ cat CVE-2013-0648.txt
Description. Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.
Required action. The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CVE-2014-0497
Flash Player
Adobe Flash Player Integer Underflow Vulnerablity
due 2024-10-08 · CWE-191
$ cat CVE-2014-0497.txt
Description. Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.
Required action. The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CVE-2014-0502
Flash Player
Adobe Flash Player Double Free Vulnerablity
due 2024-10-08 · CWE-399
$ cat CVE-2014-0502.txt
Description. Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.
Required action. The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CVE-2024-34102
Commerce and Magento Open Source
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
due 2024-08-07 · CWE-611
$ cat CVE-2024-34102.txt
Description. Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-29300
ColdFusion [RANSOMWARE]
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
due 2024-01-29 · CWE-502
$ cat CVE-2023-29300.txt
Description. Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-38203
ColdFusion [RANSOMWARE]
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
due 2024-01-29 · CWE-502
$ cat CVE-2023-38203.txt
Description. Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-21608
Acrobat and Reader
Adobe Acrobat and Reader Use-After-Free Vulnerability
due 2023-10-31 · CWE-416
$ cat CVE-2023-21608.txt
Description. Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-26369
Acrobat and Reader
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
due 2023-10-05 · CWE-787
$ cat CVE-2023-26369.txt
Description. Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-26359
ColdFusion
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
due 2023-09-11 · CWE-502
$ cat CVE-2023-26359.txt
Description. Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-29298
ColdFusion
Adobe ColdFusion Improper Access Control Vulnerability
due 2023-08-10 · CWE-284
$ cat CVE-2023-29298.txt
Description. Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-38205
ColdFusion
Adobe ColdFusion Improper Access Control Vulnerability
due 2023-08-10 · CWE-284
$ cat CVE-2023-38205.txt
Description. Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-26360
ColdFusion
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
due 2023-04-05 · CWE-284
$ cat CVE-2023-26360.txt
Description. Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2007-5659
Acrobat and Reader
Adobe Acrobat and Reader Buffer Overflow Vulnerability
due 2022-06-22 · CWE-119
$ cat CVE-2007-5659.txt
Description. Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.
Required action. Apply updates per vendor instructions.
- CVE-2008-0655
Acrobat and Reader
Adobe Acrobat and Reader Unspecified Vulnerability
due 2022-06-22
$ cat CVE-2008-0655.txt
Description. Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.
Required action. Apply updates per vendor instructions.
- CVE-2009-1862
Acrobat and Reader, Flash Player
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
due 2022-06-22 · CWE-94
$ cat CVE-2009-1862.txt
Description. Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).
Required action. For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.
- CVE-2009-3953
Acrobat and Reader
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
due 2022-06-22 · CWE-119
$ cat CVE-2009-3953.txt
Description. Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2009-4324
Acrobat and Reader
Adobe Acrobat and Reader Use-After-Free Vulnerability
due 2022-06-22 · CWE-399
$ cat CVE-2009-4324.txt
Description. Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Required action. Apply updates per vendor instructions.
- CVE-2010-1297
Flash Player
Adobe Flash Player Memory Corruption Vulnerability
due 2022-06-22 · CWE-787
$ cat CVE-2010-1297.txt
Description. Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2010-2883
Acrobat and Reader
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
due 2022-06-22 · CWE-119
$ cat CVE-2010-2883.txt
Description. Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Required action. Apply updates per vendor instructions.
- CVE-2011-0609
Flash Player
Adobe Flash Player Unspecified Vulnerability
due 2022-06-22
$ cat CVE-2011-0609.txt
Description. Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2011-2462
Reader and Acrobat
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
due 2022-06-22 · CWE-787
$ cat CVE-2011-2462.txt
Description. The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).
Required action. Apply updates per vendor instructions.
- CVE-2012-0754
Flash Player
Adobe Flash Player Memory Corruption Vulnerability
due 2022-06-22 · CWE-787
$ cat CVE-2012-0754.txt
Description. Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2012-0767
Flash Player
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
due 2022-06-22 · CWE-79
$ cat CVE-2012-0767.txt
Description. Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2012-5054
Flash Player
Adobe Flash Player Integer Overflow Vulnerability
due 2022-06-22 · CWE-189
$ cat CVE-2012-5054.txt
Description. Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2018-4990
Acrobat and Reader
Adobe Acrobat and Reader Double Free Vulnerability
due 2022-06-22 · CWE-415
$ cat CVE-2018-4990.txt
Description. Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2014-0546
Reader and Acrobat
Adobe Reader and Acrobat Sandbox Bypass Vulnerability
due 2022-06-15
$ cat CVE-2014-0546.txt
Description. Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.
Required action. Apply updates per vendor instructions.
- CVE-2014-8439
Flash Player
Adobe Flash Player Dereferenced Pointer Vulnerability
due 2022-06-15 · CWE-119
$ cat CVE-2014-8439.txt
Description. Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-0310
Flash Player
Adobe Flash Player ASLR Bypass Vulnerability
due 2022-06-15 · CWE-264
$ cat CVE-2015-0310.txt
Description. Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-8651
Flash Player
Adobe Flash Player Integer Overflow Vulnerability
due 2022-06-15 · CWE-189
$ cat CVE-2015-8651.txt
Description. Integer overflow in Adobe Flash Player allows attackers to execute code.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2016-0984
Flash Player and AIR
Adobe Flash Player and AIR Use-After-Free Vulnerability
due 2022-06-15 · CWE-416
$ cat CVE-2016-0984.txt
Description. Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.
Required action. The impacted products are end-of-life and should be disconnected if still in use.
- CVE-2016-1010
Flash Player and AIR
Adobe Flash Player and AIR Integer Overflow Vulnerability
due 2022-06-15 · CWE-190
$ cat CVE-2016-1010.txt
Description. Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.
Required action. The impacted products are end-of-life and should be disconnected if still in use.
- CVE-2018-5002
Flash Player
Adobe Flash Player Stack-based Buffer Overflow Vulnerability
due 2022-06-13 · CWE-787
$ cat CVE-2018-5002.txt
Description. Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2014-9163
Flash Player
Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
due 2022-05-04
$ cat CVE-2014-9163.txt
Description. Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-0311
Flash Player
Adobe Flash Player Remote Code Execution Vulnerability
due 2022-05-04
$ cat CVE-2015-0311.txt
Description. Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-0313
Flash Player
Adobe Flash Player Use-After-Free Vulnerability
due 2022-05-04 · CWE-416
$ cat CVE-2015-0313.txt
Description. Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-3113
Flash Player
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
due 2022-05-04 · CWE-119
$ cat CVE-2015-3113.txt
Description. Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-5122
Flash Player
Adobe Flash Player Use-After-Free Vulnerability
due 2022-05-04 · CWE-416
$ cat CVE-2015-5122.txt
Description. Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-5123
Flash Player
Adobe Flash Player Use-After-Free Vulnerability
due 2022-05-04 · CWE-416
$ cat CVE-2015-5123.txt
Description. Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2012-2034
Flash Player
Adobe Flash Player Memory Corruption Vulnerability
due 2022-04-18 · CWE-119
$ cat CVE-2012-2034.txt
Description. Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2013-2729
Reader and Acrobat
Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
due 2022-04-18 · CWE-189
$ cat CVE-2013-2729.txt
Description. Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
Required action. Apply updates per vendor instructions.
- CVE-2009-0927
Reader and Acrobat
Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability
due 2022-04-15 · CWE-20
$ cat CVE-2009-0927.txt
Description. Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.
Required action. Apply updates per vendor instructions.
- CVE-2010-2861
ColdFusion [RANSOMWARE]
Adobe ColdFusion Directory Traversal Vulnerability
due 2022-04-15 · CWE-22
$ cat CVE-2010-2861.txt
Description. A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
Required action. Apply updates per vendor instructions.
- CVE-2016-4171
Flash Player
Adobe Flash Player Remote Code Execution Vulnerability
due 2022-04-15
$ cat CVE-2016-4171.txt
Description. Unspecified vulnerability in Adobe Flash Player allows for remote code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2016-7892
Flash Player
Adobe Flash Player Use-After-Free Vulnerability
due 2022-04-15 · CWE-416
$ cat CVE-2016-7892.txt
Description. Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2009-3960
BlazeDS [RANSOMWARE]
Adobe BlazeDS Information Disclosure Vulnerability
due 2022-09-07
$ cat CVE-2009-3960.txt
Description. Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
Required action. Apply updates per vendor instructions.
- CVE-2013-0625
ColdFusion
Adobe ColdFusion Authentication Bypass Vulnerability
due 2022-09-07 · CWE-255
$ cat CVE-2013-0625.txt
Description. Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
Required action. Apply updates per vendor instructions.
- CVE-2013-0629
ColdFusion
Adobe ColdFusion Directory Traversal Vulnerability
due 2022-09-07 · CWE-264
$ cat CVE-2013-0629.txt
Description. Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.
Required action. Apply updates per vendor instructions.
- CVE-2013-0631
ColdFusion
Adobe ColdFusion Information Disclosure Vulnerability
due 2022-09-07 · CWE-200
$ cat CVE-2013-0631.txt
Description. Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.
Required action. Apply updates per vendor instructions.
- CVE-2008-2992
Acrobat and Reader [RANSOMWARE]
Adobe Reader and Acrobat Input Validation Vulnerability
due 2022-03-24 · CWE-119
$ cat CVE-2008-2992.txt
Description. Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2010-0188
Reader and Acrobat [RANSOMWARE]
Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability
due 2022-03-24 · CWE-94
$ cat CVE-2010-0188.txt
Description. Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.
Required action. Apply updates per vendor instructions.
- CVE-2011-0611
Flash Player
Adobe Flash Player Remote Code Execution Vulnerability
due 2022-03-24 · CWE-843
$ cat CVE-2011-0611.txt
Description. Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2012-1535
Flash Player
Adobe Flash Player Arbitrary Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2012-1535.txt
Description. Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2013-0632
ColdFusion
Adobe ColdFusion Authentication Bypass Vulnerability
due 2022-03-24 · CWE-200
$ cat CVE-2013-0632.txt
Description. An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.
Required action. Apply updates per vendor instructions.
- CVE-2013-0640
Reader and Acrobat
Adobe Reader and Acrobat Memory Corruption Vulnerability
due 2022-03-24 · CWE-787
$ cat CVE-2013-0640.txt
Description. An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2013-0641
Reader
Adobe Reader Buffer Overflow Vulnerability
due 2022-03-24 · CWE-120
$ cat CVE-2013-0641.txt
Description. A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2013-3346
Reader and Acrobat
Adobe Reader and Acrobat Memory Corruption Vulnerability
due 2022-03-24 · CWE-119
$ cat CVE-2013-3346.txt
Description. Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.
Required action. Apply updates per vendor instructions.
- CVE-2014-0496
Reader and Acrobat
Adobe Reader and Acrobat Use-After-Free Vulnerability
due 2022-03-24 · CWE-399
$ cat CVE-2014-0496.txt
Description. Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.
Required action. Apply updates per vendor instructions.
- CVE-2015-3043
Flash Player
Adobe Flash Player Memory Corruption Vulnerability
due 2022-03-24 · CWE-787
$ cat CVE-2015-3043.txt
Description. A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-5119
Flash Player
Adobe Flash Player Use-After-Free Vulnerability
due 2022-03-24 · CWE-119
$ cat CVE-2015-5119.txt
Description. A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-7645
Flash Player [RANSOMWARE]
Adobe Flash Player Arbitrary Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2015-7645.txt
Description. Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2016-1019
Flash Player [RANSOMWARE]
Adobe Flash Player Arbitrary Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2016-1019.txt
Description. Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2016-4117
Flash Player [RANSOMWARE]
Adobe Flash Player Arbitrary Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2016-4117.txt
Description. An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2016-7855
Flash Player
Adobe Flash Player Use-After-Free Vulnerability
due 2022-03-24 · CWE-416
$ cat CVE-2016-7855.txt
Description. Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2017-11292
Flash Player
Adobe Flash Player Type Confusion Vulnerability
due 2022-03-24 · CWE-843
$ cat CVE-2017-11292.txt
Description. Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2018-15982
Flash Player [RANSOMWARE]
Adobe Flash Player Use-After-Free Vulnerability
due 2022-08-15 · CWE-416
$ cat CVE-2018-15982.txt
Description. Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2022-24086
Commerce and Magento Open Source
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
due 2022-03-01 · CWE-20
$ cat CVE-2022-24086.txt
Description. Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
Required action. Apply updates per vendor instructions.
- CVE-2018-15961
ColdFusion
Adobe ColdFusion Unrestricted File Upload Vulnerability
due 2022-05-03 · CWE-434
$ cat CVE-2018-15961.txt
Description. Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
Required action. Apply updates per vendor instructions.
- CVE-2018-4878
Flash Player [RANSOMWARE]
Adobe Flash Player Use-After-Free Vulnerability
due 2022-05-03 · CWE-416
$ cat CVE-2018-4878.txt
Description. Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2018-4939
ColdFusion
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
due 2022-05-03 · CWE-502
$ cat CVE-2018-4939.txt
Description. Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-21017
Acrobat and Reader
Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability
due 2021-11-17 · CWE-122
$ cat CVE-2021-21017.txt
Description. Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
Required action. Apply updates per vendor instructions.
- CVE-2021-28550
Acrobat and Reader
Adobe Acrobat and Reader Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-28550.txt
Description. Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
Required action. Apply updates per vendor instructions.