CO
App Server
ColdFusion
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
17
On KEV
10.0
Max CVSS
30
New 30D
Severity mix
Critical 81High 99Medium 49Low 5
Watch
Add ColdFusion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-26360 In wildKEV | 8.6 | Mar 23 | Adobe ColdFusion Improper Access Control Arbitrary code execution Affected: through CF2018U15; through CF2021U5; through None |
| CVE-2023-38205 In wildKEV | 7.5 | Sep 14 | ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298 Affected: through cf2023U2 |
| CVE-2023-29298 In wildKEV | 7.5 | Jul 12 | Adobe ColdFusion Improper Access Control Security feature bypass Affected: through 2023.0.0.330468 |
| CVE-2013-0629 In wildKEV | 7.5 | Jan 9 | Adobe ColdFusion Directory Traversal Vulnerability Affected: 9.0; 9.0.1; 9.0.2; 10.0 |
| CVE-2013-0631 In wildKEV | 7.5 | Jan 9 | Adobe ColdFusion Information Disclosure Vulnerability Affected: 9.0; 9.0.1; 9.0.2 |
| CVE-2024-20767 In wildKEV | 7.4 | Mar 18 | ColdFusion | Improper Access Control (CWE-284) Affected: through 2021.12 |
| CVE-2026-106618 | 8.8 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-106089 | 8.8 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-106613 | 8.8 | Oct 13 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-106090 | 8.8 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-106615 | 8.8 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-105901 | 8.8 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-106617 | 8.8 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-71387 | 8.8 | Aug 11 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-71386 | 8.8 | Aug 11 | ColdFusion | Cross-site Scripting (XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-48307 | 8.8 | Jun 30 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-47932 | 8.8 | Jun 9 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more |
| CVE-2025-49551 | 8.8 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalation Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2026-21273 | 8.7 | Aug 11 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2025-30290 | 8.7 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2026-105897 | 8.6 | Oct 13 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-106616 | 8.6 | Oct 13 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-34634 | 8.6 | Oct 13 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-76190 | 8.6 | Sep 8 | ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2026-48285 | 8.6 | Jun 30 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-27305 | 8.6 | Apr 14 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more |
| CVE-2016-4264 | 8.6 | Sep 1 | The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to… Affected: through 10.0; through 11.0 |
| CVE-2026-75993 | 8.5 | Sep 8 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2026-48320 | 8.5 | Jul 14 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more |
| CVE-2026-75995 | 8.4 | Oct 13 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-71385 | 8.4 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-75999 | 8.4 | Sep 8 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2026-34635 | 8.4 | Aug 11 | ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-47929 | 8.4 | Jun 9 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more |
| CVE-2026-47931 | 8.4 | Jun 9 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more |
| CVE-2026-27306 | 8.4 | Apr 14 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more |
| CVE-2025-61812 | 8.4 | Dec 10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker to gain arbitrary… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +34 more |
| CVE-2025-61810 | 8.4 | Dec 10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +34 more |
| CVE-2025-43565 | 8.4 | May 13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more |
| CVE-2025-30286 | 8.4 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30285 | 8.4 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30284 | 8.4 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2026-105898 | 8.2 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-21279 | 8.2 | Aug 11 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-48363 | 8.2 | Jul 13 | ColdFusion | Uncontrolled Search Path Element (CWE-427) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-48364 | 8.2 | Jul 13 | ColdFusion | Uncontrolled Search Path Element (CWE-427) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2025-30289 | 8.2 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30288 | 8.2 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30287 | 8.2 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2026-48440 | 8.1 | Aug 11 | ColdFusion | Heap-based Buffer Overflow (CWE-122) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |