Skip to content
Noroxi

Adobe records

7,885 published records for vendor Adobe. 83 of them have been exploited in the wild (listed in CISA KEV) and 111 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
83 · 1.1%
Weaponized
111 · 1.4%
Pre-auth RCE
2,347
With a fix record
16%
Median publish → KEV
2515 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

7,885 records
  • CVE-2026-75650
    100Now

    Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    adobe · commerceSep 7, 2026

  • CVE-2024-34102
    99Now

    XXE can expose crypt key and other secrets granting full admin access

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · commerceJun 13, 2024

  • CVE-2023-29300
    99Now

    Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · coldfusionJul 12, 2023

  • CVE-2018-15961
    99Now

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploa

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · coldfusionSep 25, 2018

  • CVE-2014-0497
    99Now

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · flash playerFeb 5, 2014

  • CVE-2015-3113
    99Now

    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · flash playerJun 23, 2015

  • CVE-2010-2861
    99Now

    Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to re

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · coldfusionAug 11, 2010

  • CVE-2022-24086
    99Now

    Adobe Commerce checkout improper input validation leads to remote code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · commerceFeb 16, 2022

  • CVE-2015-5119
    99Now

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    adobe · flash playerJul 8, 2015

  • CVE-2023-38203
    98Now

    Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    adobe · coldfusionJul 20, 2023

  • CVE-2015-0313
    98Now

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    adobe · flash playerFeb 2, 2015

  • CVE-2016-4117
    97Now

    Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wil

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    adobe · flash playerMay 10, 2016

  • CVE-2013-0625
    97Now

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exe

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    adobe · coldfusionJan 8, 2013

  • CVE-2013-0632
    97Now

    administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitr

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    adobe · coldfusionJan 16, 2013

  • CVE-2017-3066
    96Now

    Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserializa

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    adobe · coldfusionApr 27, 2017

  • CVE-2011-2462
    96Now

    Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x

    CriticalCVSS 9.8KEVWeaponizedEPSS 88%

    adobe · acrobatDec 7, 2011

  • CVE-2011-0611
    95Now

    Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    adobe · flash playerApr 13, 2011

  • CVE-2025-54236
    95Now

    Adobe Commerce | Improper Input Validation (CWE-20)

    CriticalCVSS 9.1KEVWeaponizedEPSS 95%

    adobe · commerceSep 9, 2025

  • CVE-2015-5122
    95Now

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0

    CriticalCVSS 9.8KEVWeaponizedEPSS 87%

    adobe · flash playerJul 14, 2015

  • CVE-2015-0311
    95Now

    Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and throu

    CriticalCVSS 9.8KEVWeaponizedEPSS 85%

    adobe · flash playerJan 23, 2015

  • CVE-2009-0927
    94Now

    Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to e

    HighCVSS 8.8KEVWeaponizedEPSS 96%

    adobe · acrobat readerMar 19, 2009

  • CVE-2026-71362
    94Now

    Adobe Commerce | Incorrect Authorization (CWE-863)

    CriticalCVSS 9.1KEVWeaponizedEPSS 91%

    adobe · commerceAug 11, 2026

  • CVE-2025-54253
    94Now

    Adobe Experience Manager | Incorrect Authorization (CWE-863)

    CriticalCVSS 10.0KEVWeaponizedEPSS 80%

    adobe · experience manager formsAug 5, 2025

  • CVE-2023-26360
    93Now

    Adobe ColdFusion Improper Access Control Arbitrary code execution

    HighCVSS 8.6KEVWeaponizedEPSS 97%

    adobe · coldfusionMar 23, 2023

  • CVE-2013-3346
    93Now

    Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a

    CriticalCVSS 9.8KEVWeaponizedEPSS 78%

    adobe · acrobatAug 30, 2013