ColdFusion 2025 vulnerabilities | LiveThreat CVE Feed

Product

ColdFusion 2025

by Adobe · last CVE Oct 13, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities96 In the news10 Timeline

Severity mix

Critical 32High 52Medium 9Low 3

Severity

All severities96 Critical32 High52 Medium9 Low3

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add ColdFusion 2025 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-48282 In wildKEV	10.0	42%	Jun 30	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 9
CVE-2026-106622	10.0	1%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2025.0.13
CVE-2026-106624	10.0	1%	Oct 13	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: through 2025.0.13
CVE-2026-105899	10.0	1%	Oct 13	ColdFusion \| Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: through 2025.0.13
CVE-2026-48362	10.0	4%	Aug 11	ColdFusion \| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: through 2025.0.11
CVE-2026-48316	10.0	1%	Jul 6	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 9
CVE-2026-48281	10.0	1%	Jun 30	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 9
CVE-2026-48277	10.0	1%	Jun 30	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 9
CVE-2026-48276	10.0	1%	Jun 30	ColdFusion \| Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: through 9
CVE-2026-48283	10.0	1%	Jun 30	ColdFusion \| Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: through 9
CVE-2026-105903	9.9	1%	Oct 13	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: through 2025.0.13
CVE-2026-106612	9.9	1%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-48273	9.9	1%	Sep 8	ColdFusion \| Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) Affected: through 12
CVE-2026-48318	9.9	1%	Jul 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 10
CVE-2026-48322	9.9	1%	Jul 14	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: through 10
CVE-2026-75994	9.6	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106620	9.6	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-71384	9.6	0%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.11
CVE-2026-48284	9.6	0%	Jul 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 10
CVE-2026-47928	9.6	2%	Jun 9	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 8
CVE-2026-90530	9.3	0%	Oct 13	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 2025.0.13
CVE-2026-48321	9.3	0%	Jul 14	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 10
CVE-2026-48325	9.3	1%	Jul 14	ColdFusion \| Missing Authentication for Critical Function (CWE-306) Affected: through 10
CVE-2026-48315	9.3	1%	Jun 30	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 9
CVE-2026-48313	9.3	3%	Jun 30	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 9
CVE-2026-27304	9.3	4%	Apr 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 6
CVE-2026-106621	9.1	1%	Oct 13	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: through 2025.0.13
CVE-2026-75746	9.1	1%	Sep 8	ColdFusion \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) Affected: through 12
CVE-2026-48324	9.1	1%	Jul 14	ColdFusion \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) Affected: through 10
CVE-2026-48319	9.1	1%	Jul 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 10
CVE-2026-106619	9.0	1%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2025.0.13
CVE-2026-48327	9.0	0%	Jul 14	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 10
CVE-2026-106618	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106089	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106613	8.8	1%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2025.0.13
CVE-2026-106090	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106615	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-105901	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106617	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-71387	8.8	1%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.11
CVE-2026-71386	8.8	1%	Aug 11	ColdFusion \| Cross-site Scripting (XSS) (CWE-79) Affected: through 2025.0.11
CVE-2026-48307	8.8	1%	Jun 30	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 9
CVE-2026-47932	8.8	3%	Jun 9	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 8
CVE-2026-21273	8.7	1%	Aug 11	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2025.0.11
CVE-2026-105897	8.6	1%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2025.0.13
CVE-2026-106616	8.6	1%	Oct 13	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2025.0.13
CVE-2026-34634	8.6	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2025.0.13
CVE-2026-76190	8.6	1%	Sep 8	ColdFusion \| Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) Affected: through 12
CVE-2026-48285	8.6	1%	Jun 30	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 9
CVE-2026-27305	8.6	26%	Apr 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 6