CO
App Server
ColdFusion
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
17
On KEV
10.0
Max CVSS
30
New 30D
Severity mix
Critical 81High 99Medium 49Low 5
Watch
Add ColdFusion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21273 | 8.7 | Aug 11 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2025-30290 | 8.7 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2026-105897 | 8.6 | Oct 13 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-106616 | 8.6 | Oct 13 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-34634 | 8.6 | Oct 13 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-76190 | 8.6 | Sep 8 | ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2026-48285 | 8.6 | Jun 30 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-27305 | 8.6 | Apr 14 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more |
| CVE-2016-4264 | 8.6 | Sep 1 | The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to… Affected: through 10.0; through 11.0 |
| CVE-2026-75993 | 8.5 | Sep 8 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2026-48320 | 8.5 | Jul 14 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more |
| CVE-2026-75995 | 8.4 | Oct 13 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-71385 | 8.4 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-75999 | 8.4 | Sep 8 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2026-34635 | 8.4 | Aug 11 | ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-47929 | 8.4 | Jun 9 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more |
| CVE-2026-47931 | 8.4 | Jun 9 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more |
| CVE-2026-27306 | 8.4 | Apr 14 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more |
| CVE-2025-61812 | 8.4 | Dec 9 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 2021.22 |
| CVE-2025-61810 | 8.4 | Dec 9 | ColdFusion | Deserialization of Untrusted Data (CWE-502) Affected: through 2021.22 |
| CVE-2025-43565 | 8.4 | May 13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more |
| CVE-2025-30286 | 8.4 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30285 | 8.4 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30284 | 8.4 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2026-105898 | 8.2 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-21279 | 8.2 | Aug 11 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-48363 | 8.2 | Jul 13 | ColdFusion | Uncontrolled Search Path Element (CWE-427) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2026-48364 | 8.2 | Jul 13 | ColdFusion | Uncontrolled Search Path Element (CWE-427) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2025-30289 | 8.2 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30288 | 8.2 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30287 | 8.2 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2026-48440 | 8.1 | Aug 11 | ColdFusion | Heap-based Buffer Overflow (CWE-122) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-47930 | 8.1 | Jun 9 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more |
| CVE-2024-53961 | 8.1 | Dec 23 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 2021.17 |
| CVE-2025-49537 | 7.9 | Jul 8 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: through 2021.20 |
| CVE-2026-106614 | 7.8 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-25652 | 7.8 | Aug 11 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2020-10145 | 7.8 | May 27 | The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\ Affected: 2016; 2018; 2021 |
| CVE-2020-9673 | 7.8 | Jul 17 | Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +20 more |
| CVE-2020-9672 | 7.8 | Jul 17 | Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +20 more |
| CVE-2020-3768 | 7.8 | Jun 26 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +18 more |
| CVE-2018-4938 | 7.8 | May 19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more |
| CVE-2026-34633 | 7.7 | Oct 13 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-105994 | 7.7 | Oct 13 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +32 more |
| CVE-2026-48385 | 7.7 | Aug 11 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-48332 | 7.7 | Jul 14 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more |
| CVE-2026-48328 | 7.7 | Jul 14 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more |
| CVE-2026-34619 | 7.7 | Apr 14 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more |
| CVE-2026-75748 | 7.6 | Oct 13 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |
| CVE-2026-75996 | 7.5 | Oct 13 | ColdFusion | Uncontrolled Resource Consumption (CWE-400) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +33 more |