CO
App Server
ColdFusion
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
17
On KEV
10.0
Max CVSS
30
New 30D
Severity mix
Critical 81High 99Medium 49Low 5
Watch
Add ColdFusion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48282 In wildKEV | 10.0 | Jun 30 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2023-38203 RansomwareIn wildKEV | 9.8 | Jul 20 | Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE Affected: through cf2023U1 |
| CVE-2023-29300 RansomwareIn wildKEV | 9.8 | Jul 12 | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution Affected: through 2023.0.0.330468 |
| CVE-2023-26359 In wildKEV | 9.8 | Mar 23 | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution Affected: through CF2018U15, CF2021U5; through None |
| CVE-2018-15961 In wildKEV | 9.8 | Sep 25 | Adobe ColdFusion Unrestricted File Upload Vulnerability Affected: July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions |
| CVE-2018-4939 In wildKEV | 9.8 | May 19 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more |
| CVE-2017-3066 In wildKEV | 9.8 | Apr 27 | Adobe ColdFusion Deserialization Vulnerability Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +33 more |
| CVE-2013-0632 In wildKEV | 9.8 | Jan 17 | Adobe ColdFusion Authentication Bypass Vulnerability Affected: 9.0; 9.0.1; 9.0.2; 10.0 |
| CVE-2013-0625 In wildKEV | 9.8 | Jan 9 | Adobe ColdFusion Authentication Bypass Vulnerability Affected: 9.0; 9.0.1; 9.0.2 |
| CVE-2010-2861 RansomwareIn wildKEV | 9.8 | Aug 11 | Adobe ColdFusion Directory Traversal Vulnerability Affected: through 9.0.1 |
| CVE-2023-26360 In wildKEV | 8.6 | Mar 23 | Adobe ColdFusion Improper Access Control Arbitrary code execution Affected: through CF2018U15; through CF2021U5; through None |
| CVE-2023-38205 In wildKEV | 7.5 | Sep 14 | ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298 Affected: through cf2023U2 |
| CVE-2023-29298 In wildKEV | 7.5 | Jul 12 | Adobe ColdFusion Improper Access Control Security feature bypass Affected: through 2023.0.0.330468 |
| CVE-2013-0629 In wildKEV | 7.5 | Jan 9 | Adobe ColdFusion Directory Traversal Vulnerability Affected: 9.0; 9.0.1; 9.0.2; 10.0 |
| CVE-2013-0631 In wildKEV | 7.5 | Jan 9 | Adobe ColdFusion Information Disclosure Vulnerability Affected: 9.0; 9.0.1; 9.0.2 |
| CVE-2024-20767 In wildKEV | 7.4 | Mar 18 | ColdFusion | Improper Access Control (CWE-284) Affected: through 2021.12 |
| CVE-2009-3960 RansomwareIn wildKEV | 6.5 | Feb 15 | Adobe BlazeDS Information Disclosure Vulnerability Affected: 7.0.2; 8.0; 8.0.1; 9.0 |
Showing 17