Login Request a demo
C2
Product
ColdFusion 2025
by Adobe · last CVE Oct 13, 2026
On CISA KEVExploited in the wild
96
CVEs
1
On KEV
10.0
Max CVSS
31
New 30D
Vulnerabilities96In the news10Timeline
Severity mix
Critical 32High 52Medium 9Low 3
Severity
All severities96Critical32High52Medium9Low3
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add ColdFusion 2025 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-48338
6.8
0%
Jul 14
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 10
CVE-2026-76000
6.5
0%
Sep 8
ColdFusion | Uncontrolled Resource Consumption (CWE-400)
Affected: through 12
CVE-2026-48375
6.5
1%
Aug 11
ColdFusion | Incorrect Authorization (CWE-863)
Affected: through 2025.0.11
CVE-2026-48314
6.5
1%
Jun 30
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 9
CVE-2026-76002
6.1
0%
Sep 8
ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
Affected: through 12
CVE-2026-21269
5.4
1%
Aug 11
ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 12
CVE-2026-48376
5.4
1%
Aug 11
ColdFusion | Improper Encoding or Escaping of Output (CWE-116)
Affected: through 2025.0.11
CVE-2026-48384
4.9
1%
Aug 11
ColdFusion | Improper Input Validation (CWE-20)
Affected: through 2025.0.11
CVE-2026-47933
4.8
0%
Jun 9
ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 8
Showing 9