CO
App Server
ColdFusion
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
17
On KEV
10.0
Max CVSS
30
New 30D
Severity mix
Critical 81High 99Medium 49Low 5
Watch
Add ColdFusion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48282 In wildKEV | 10.0 | Jun 30 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2023-38203 RansomwareIn wildKEV | 9.8 | Jul 20 | Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE Affected: through cf2023U1 |
| CVE-2023-29300 RansomwareIn wildKEV | 9.8 | Jul 12 | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution Affected: through 2023.0.0.330468 |
| CVE-2023-26359 In wildKEV | 9.8 | Mar 23 | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution Affected: through CF2018U15, CF2021U5; through None |
| CVE-2018-15961 In wildKEV | 9.8 | Sep 25 | Adobe ColdFusion Unrestricted File Upload Vulnerability Affected: July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions |
| CVE-2018-4939 In wildKEV | 9.8 | May 19 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more |
| CVE-2017-3066 In wildKEV | 9.8 | Apr 27 | Adobe ColdFusion Deserialization Vulnerability Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +33 more |
| CVE-2013-0632 In wildKEV | 9.8 | Jan 17 | Adobe ColdFusion Authentication Bypass Vulnerability Affected: 9.0; 9.0.1; 9.0.2; 10.0 |
| CVE-2013-0625 In wildKEV | 9.8 | Jan 9 | Adobe ColdFusion Authentication Bypass Vulnerability Affected: 9.0; 9.0.1; 9.0.2 |
| CVE-2010-2861 RansomwareIn wildKEV | 9.8 | Aug 11 | Adobe ColdFusion Directory Traversal Vulnerability Affected: through 9.0.1 |
| CVE-2023-26360 In wildKEV | 8.6 | Mar 23 | Adobe ColdFusion Improper Access Control Arbitrary code execution Affected: through CF2018U15; through CF2021U5; through None |
| CVE-2023-38205 In wildKEV | 7.5 | Sep 14 | ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298 Affected: through cf2023U2 |
| CVE-2023-29298 In wildKEV | 7.5 | Jul 12 | Adobe ColdFusion Improper Access Control Security feature bypass Affected: through 2023.0.0.330468 |
| CVE-2013-0629 In wildKEV | 7.5 | Jan 9 | Adobe ColdFusion Directory Traversal Vulnerability Affected: 9.0; 9.0.1; 9.0.2; 10.0 |
| CVE-2013-0631 In wildKEV | 7.5 | Jan 9 | Adobe ColdFusion Information Disclosure Vulnerability Affected: 9.0; 9.0.1; 9.0.2 |
| CVE-2024-20767 In wildKEV | 7.4 | Mar 18 | ColdFusion | Improper Access Control (CWE-284) Affected: through 2021.12 |
| CVE-2009-3960 RansomwareIn wildKEV | 6.5 | Feb 15 | Adobe BlazeDS Information Disclosure Vulnerability Affected: 7.0.2; 8.0; 8.0.1; 9.0 |
| CVE-2026-106622 | 10.0 | Oct 13 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-106624 | 10.0 | Oct 13 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-105899 | 10.0 | Oct 13 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-48362 | 10.0 | Aug 11 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-48316 | 10.0 | Jul 6 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-48281 | 10.0 | Jun 30 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-48277 | 10.0 | Jun 30 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-48276 | 10.0 | Jun 30 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-48283 | 10.0 | Jun 30 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2025-54261 | 10.0 | Sep 9 | ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +34 more |
| CVE-2026-105903 | 9.9 | Oct 13 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-106612 | 9.9 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-48273 | 9.9 | Sep 8 | ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2026-48318 | 9.9 | Jul 14 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more |
| CVE-2026-48322 | 9.9 | Jul 14 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more |
| CVE-2024-41874 | 9.8 | Sep 13 | ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of… Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more |
| CVE-2023-44353 | 9.8 | Nov 17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code… Affected: before 2021; 2021; 2021; 2021; 2021; 2021; +13 more |
| CVE-2023-44351 | 9.8 | Nov 17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code… Affected: before 2021; 2021; 2021; 2021; 2021; 2021; +13 more |
| CVE-2023-44350 | 9.8 | Nov 17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code… Affected: before 2021; 2021; 2021; 2021; 2021; 2021; +13 more |
| CVE-2023-38204 | 9.8 | Sep 14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result… Affected: 2018; 2018; 2018; 2018; 2018; 2018; +24 more |
| CVE-2022-35711 | 9.8 | Oct 14 | Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability Affected: through CF2021U4; through CF2018u14; through None |
| CVE-2022-35690 | 9.8 | Oct 14 | Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability Affected: through CF2021U4; through CF2018u14; through None |
| CVE-2022-35712 | 9.8 | Oct 14 | Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability Affected: through CF2021U4; through CF2018u14; through None |
| CVE-2022-35710 | 9.8 | Oct 14 | Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability Affected: through CF2021U4; through CF2018u14; through None |
| CVE-2022-38418 | 9.8 | Oct 14 | Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability Affected: through CF2021U4; through CF2018u14; through None |
| CVE-2020-3794 | 9.8 | Mar 25 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +16 more |
| CVE-2019-8256 | 9.8 | Dec 19 | ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability Affected: 2018; 2018; 2018; 2018; 2018; 2018; +1 more |
| CVE-2019-8074 | 9.8 | Sep 27 | ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +11 more |
| CVE-2019-8073 | 9.8 | Sep 27 | ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +11 more |
| CVE-2019-7840 | 9.8 | Jun 12 | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +28 more |
| CVE-2019-7839 | 9.8 | Jun 12 | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +28 more |
| CVE-2019-7838 | 9.8 | Jun 12 | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +28 more |
| CVE-2019-7091 | 9.8 | May 24 | ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +20 more |