ColdFusion 2023 vulnerabilities | LiveThreat CVE Feed

Product

ColdFusion 2023

by Adobe · last CVE Oct 13, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities96 In the news10 Timeline

Severity mix

Critical 32High 52Medium 9Low 3

Severity

All severities96 Critical32 High52 Medium9 Low3

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add ColdFusion 2023 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-75993	8.5	0%	Sep 8	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 23
CVE-2026-48320	8.5	0%	Jul 14	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 21
CVE-2026-75995	8.4	0%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2023.0.25
CVE-2026-71385	8.4	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2023.0.25
CVE-2026-75999	8.4	0%	Sep 8	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 23
CVE-2026-34635	8.4	0%	Aug 11	ColdFusion \| Use of Hard-coded Cryptographic Key (CWE-321) Affected: through 2023.0.22
CVE-2026-47929	8.4	2%	Jun 9	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 19
CVE-2026-47931	8.4	0%	Jun 9	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 19
CVE-2026-27306	8.4	0%	Apr 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 18
CVE-2026-105898	8.2	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2023.0.25
CVE-2026-21279	8.2	1%	Aug 11	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2023.0.22
CVE-2026-48363	8.2	0%	Jul 13	ColdFusion \| Uncontrolled Search Path Element (CWE-427) Affected: through 20
CVE-2026-48364	8.2	0%	Jul 13	ColdFusion \| Uncontrolled Search Path Element (CWE-427) Affected: through 20
CVE-2026-48440	8.1	1%	Aug 11	ColdFusion \| Heap-based Buffer Overflow (CWE-122) Affected: through 2023.0.22
CVE-2026-47930	8.1	1%	Jun 9	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 19
CVE-2026-106614	7.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2023.0.25
CVE-2026-25652	7.8	0%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2023.0.22
CVE-2026-34633	7.7	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2023.0.25
CVE-2026-105994	7.7	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2023.0.25
CVE-2026-48385	7.7	2%	Aug 11	ColdFusion \| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: through 2023.0.22
CVE-2026-48332	7.7	1%	Jul 14	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 21
CVE-2026-48328	7.7	1%	Jul 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 21
CVE-2026-34619	7.7	8%	Apr 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 18
CVE-2026-75748	7.6	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2023.0.25
CVE-2026-75996	7.5	1%	Oct 13	ColdFusion \| Uncontrolled Resource Consumption (CWE-400) Affected: through 2023.0.25
CVE-2026-105900	7.5	1%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2023.0.25
CVE-2026-106623	7.5	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2023.0.25
CVE-2026-75998	7.5	1%	Sep 8	ColdFusion \| Improper Access Control (CWE-284) Affected: through 23
CVE-2026-48386	7.5	1%	Aug 11	ColdFusion \| Use of a Broken or Risky Cryptographic Algorithm (CWE-327) Affected: through 2023.0.22
CVE-2026-27282	7.5	1%	Apr 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 18
CVE-2026-47960	7.4	0%	Jun 9	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 19
CVE-2026-71383	7.3	1%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2023.0.22
CVE-2026-76001	7.1	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2023.0.25
CVE-2026-83961	7.1	0%	Sep 3	ColdFusion \| Improper Authentication (CWE-287) Affected: through 2023.0.22
CVE-2026-48338	6.8	0%	Jul 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 21
CVE-2026-76000	6.5	0%	Sep 8	ColdFusion \| Uncontrolled Resource Consumption (CWE-400) Affected: through 23
CVE-2026-48375	6.5	1%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2023.0.22
CVE-2026-48314	6.5	1%	Jun 30	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 20
CVE-2026-76002	6.1	0%	Sep 8	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 23
CVE-2026-21269	5.4	1%	Aug 11	ColdFusion \| Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 23
CVE-2026-48376	5.4	1%	Aug 11	ColdFusion \| Improper Encoding or Escaping of Output (CWE-116) Affected: through 2023.0.22
CVE-2026-48384	4.9	1%	Aug 11	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2023.0.22
CVE-2026-47933	4.8	0%	Jun 9	ColdFusion \| Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 19
CVE-2026-48329	2.7	1%	Jul 14	ColdFusion \| Insufficient Session Expiration (CWE-613) Affected: through 21
CVE-2026-27308	2.4	2%	Apr 14	ColdFusion \| Uncontrolled Resource Consumption (CWE-400) Affected: through 18
CVE-2026-27307	2.4	3%	Apr 14	ColdFusion \| Uncontrolled Resource Consumption (CWE-400) Affected: through 18