C2
Product
ColdFusion 2025
On CISA KEVExploited in the wild
96
CVEs
1
On KEV
10.0
Max CVSS
31
New 30D
Severity mix
Critical 32High 52Medium 9Low 3
Watch
Add ColdFusion 2025 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48282 In wildKEV | 10.0 | Jun 30 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 9 |
| CVE-2026-106622 | 10.0 | Oct 13 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2025.0.13 |
| CVE-2026-106624 | 10.0 | Oct 13 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: through 2025.0.13 |
| CVE-2026-105899 | 10.0 | Oct 13 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: through 2025.0.13 |
| CVE-2026-48362 | 10.0 | Aug 11 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: through 2025.0.11 |
| CVE-2026-48316 | 10.0 | Jul 6 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 9 |
| CVE-2026-48281 | 10.0 | Jun 30 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 9 |
| CVE-2026-48277 | 10.0 | Jun 30 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 9 |
| CVE-2026-48276 | 10.0 | Jun 30 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: through 9 |
| CVE-2026-48283 | 10.0 | Jun 30 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: through 9 |
| CVE-2026-105903 | 9.9 | Oct 13 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: through 2025.0.13 |
| CVE-2026-106612 | 9.9 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: through 2025.0.13 |
| CVE-2026-48273 | 9.9 | Sep 8 | ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) Affected: through 12 |
| CVE-2026-48318 | 9.9 | Jul 14 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 10 |
| CVE-2026-48322 | 9.9 | Jul 14 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: through 10 |
| CVE-2026-75994 | 9.6 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: through 2025.0.13 |
| CVE-2026-106620 | 9.6 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: through 2025.0.13 |
| CVE-2026-71384 | 9.6 | Aug 11 | ColdFusion | Incorrect Authorization (CWE-863) Affected: through 2025.0.11 |
| CVE-2026-48284 | 9.6 | Jul 14 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 10 |
| CVE-2026-47928 | 9.6 | Jun 9 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 8 |
| CVE-2026-90530 | 9.3 | Oct 13 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 2025.0.13 |
| CVE-2026-48321 | 9.3 | Jul 14 | ColdFusion | Incorrect Authorization (CWE-863) Affected: through 10 |
| CVE-2026-48325 | 9.3 | Jul 14 | ColdFusion | Missing Authentication for Critical Function (CWE-306) Affected: through 10 |
| CVE-2026-48315 | 9.3 | Jun 30 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 9 |
| CVE-2026-48313 | 9.3 | Jun 30 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 9 |
| CVE-2026-27304 | 9.3 | Apr 14 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 6 |
| CVE-2026-106621 | 9.1 | Oct 13 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: through 2025.0.13 |
| CVE-2026-75746 | 9.1 | Sep 8 | ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) Affected: through 12 |
| CVE-2026-48324 | 9.1 | Jul 14 | ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) Affected: through 10 |
| CVE-2026-48319 | 9.1 | Jul 14 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 10 |
| CVE-2026-106619 | 9.0 | Oct 13 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 2025.0.13 |
| CVE-2026-48327 | 9.0 | Jul 14 | ColdFusion | Incorrect Authorization (CWE-863) Affected: through 10 |
Showing 32