ColdFusion 2025 vulnerabilities | LiveThreat CVE Feed

Product

ColdFusion 2025

by Adobe · last CVE Oct 13, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities96 In the news10 Timeline

Severity mix

Critical 32High 52Medium 9Low 3

Severity

All severities96 Critical32 High52 Medium9 Low3

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add ColdFusion 2025 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-106618	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106089	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106613	8.8	1%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2025.0.13
CVE-2026-106090	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106615	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-105901	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-106617	8.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-71387	8.8	1%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.11
CVE-2026-71386	8.8	1%	Aug 11	ColdFusion \| Cross-site Scripting (XSS) (CWE-79) Affected: through 2025.0.11
CVE-2026-48307	8.8	1%	Jun 30	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 9
CVE-2026-47932	8.8	3%	Jun 9	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 8
CVE-2026-21273	8.7	1%	Aug 11	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2025.0.11
CVE-2026-105897	8.6	1%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2025.0.13
CVE-2026-106616	8.6	1%	Oct 13	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2025.0.13
CVE-2026-34634	8.6	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2025.0.13
CVE-2026-76190	8.6	1%	Sep 8	ColdFusion \| Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) Affected: through 12
CVE-2026-48285	8.6	1%	Jun 30	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 9
CVE-2026-27305	8.6	26%	Apr 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 6
CVE-2026-75993	8.5	0%	Sep 8	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 12
CVE-2026-48320	8.5	0%	Jul 14	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 10
CVE-2026-75995	8.4	0%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2025.0.13
CVE-2026-71385	8.4	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-75999	8.4	0%	Sep 8	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 12
CVE-2026-34635	8.4	0%	Aug 11	ColdFusion \| Use of Hard-coded Cryptographic Key (CWE-321) Affected: through 2025.0.11
CVE-2026-47929	8.4	2%	Jun 9	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 8
CVE-2026-47931	8.4	0%	Jun 9	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 8
CVE-2026-27306	8.4	0%	Apr 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 6
CVE-2026-105898	8.2	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-21279	8.2	1%	Aug 11	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2025.0.11
CVE-2026-48363	8.2	0%	Jul 13	ColdFusion \| Uncontrolled Search Path Element (CWE-427) Affected: through 9
CVE-2026-48364	8.2	0%	Jul 13	ColdFusion \| Uncontrolled Search Path Element (CWE-427) Affected: through 9
CVE-2026-48440	8.1	1%	Aug 11	ColdFusion \| Heap-based Buffer Overflow (CWE-122) Affected: through 2025.0.11
CVE-2026-47930	8.1	1%	Jun 9	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 8
CVE-2026-106614	7.8	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-25652	7.8	0%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.11
CVE-2026-34633	7.7	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2025.0.13
CVE-2026-105994	7.7	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-48385	7.7	2%	Aug 11	ColdFusion \| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: through 2025.0.11
CVE-2026-48332	7.7	1%	Jul 14	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 10
CVE-2026-48328	7.7	1%	Jul 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 10
CVE-2026-34619	7.7	8%	Apr 14	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 6
CVE-2026-75748	7.6	0%	Oct 13	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2025.0.13
CVE-2026-75996	7.5	1%	Oct 13	ColdFusion \| Uncontrolled Resource Consumption (CWE-400) Affected: through 2025.0.13
CVE-2026-105900	7.5	1%	Oct 13	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 2025.0.13
CVE-2026-106623	7.5	0%	Oct 13	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.13
CVE-2026-75998	7.5	1%	Sep 8	ColdFusion \| Improper Access Control (CWE-284) Affected: through 12
CVE-2026-48386	7.5	1%	Aug 11	ColdFusion \| Use of a Broken or Risky Cryptographic Algorithm (CWE-327) Affected: through 2025.0.11
CVE-2026-27282	7.5	1%	Apr 14	ColdFusion \| Improper Input Validation (CWE-20) Affected: through 6
CVE-2026-47960	7.4	0%	Jun 9	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 8
CVE-2026-71383	7.3	1%	Aug 11	ColdFusion \| Incorrect Authorization (CWE-863) Affected: through 2025.0.11