CO
App Server
ColdFusion
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
17
On KEV
10.0
Max CVSS
30
New 30D
Severity mix
Critical 81High 99Medium 49Low 5
Watch
Add ColdFusion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2009-3960 RansomwareIn wildKEV | 6.5 | Feb 15 | Adobe BlazeDS Information Disclosure Vulnerability Affected: 7.0.2; 8.0; 8.0.1; 9.0 |
| CVE-2026-48338 | 6.8 | Jul 14 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more |
| CVE-2025-61821 | 6.8 | Dec 9 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2021.22 |
| CVE-2025-49544 | 6.8 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2025-43566 | 6.8 | May 13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more |
| CVE-2025-30294 | 6.8 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2025-30293 | 6.8 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2026-76000 | 6.5 | Sep 8 | ColdFusion | Uncontrolled Resource Consumption (CWE-400) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2026-48375 | 6.5 | Aug 11 | ColdFusion | Incorrect Authorization (CWE-863) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-48314 | 6.5 | Jun 30 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +25 more |
| CVE-2020-3796 | 6.5 | Jun 26 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +18 more |
| CVE-2020-3767 | 6.5 | Jun 26 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +18 more |
| CVE-2025-61822 | 6.2 | Dec 9 | ColdFusion | Improper Input Validation (CWE-20) Affected: through 2021.22 |
| CVE-2025-61823 | 6.2 | Dec 9 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) Affected: through 2021.22 |
| CVE-2025-49545 | 6.2 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2026-76002 | 6.1 | Sep 8 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +31 more |
| CVE-2025-30292 | 6.1 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2023-44352 | 6.1 | Nov 17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: before 2021; 2021; 2021; 2021; 2021; 2021; +13 more |
| CVE-2022-28818 | 6.1 | May 12 | ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: before 2018; 2018; 2018; 2018; 2018; 2018; +13 more |
| CVE-2019-7092 | 6.1 | May 24 | ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +20 more |
| CVE-2018-4941 | 6.1 | May 19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more |
| CVE-2018-4940 | 6.1 | May 19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more |
| CVE-2017-11285 | 6.1 | Dec 1 | Adobe ColdFusion has a cross-site scripting (XSS) vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +12 more |
| CVE-2017-3008 | 6.1 | Apr 27 | Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +33 more |
| CVE-2016-4159 | 6.1 | Jun 16 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web… Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +25 more |
| CVE-2016-1113 | 6.1 | May 11 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web… Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +22 more |
| CVE-2016-1115 | 5.9 | May 11 | Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle… Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +22 more |
| CVE-2025-64897 | 5.6 | Dec 9 | ColdFusion | Improper Access Control (CWE-284) Affected: through 2021.22 |
| CVE-2025-30291 | 5.5 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2024-34113 | 5.5 | Jun 13 | ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +14 more |
| CVE-2026-21269 | 5.4 | Aug 11 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-48376 | 5.4 | Aug 11 | ColdFusion | Improper Encoding or Escaping of Output (CWE-116) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2021-21087 | 5.4 | Apr 15 | Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page… Affected: 2016; 2016; 2016; 2016; 2016; 2016; +23 more |
| CVE-2025-64898 | 5.3 | Dec 9 | ColdFusion | Insufficiently Protected Credentials (CWE-522) Affected: through 2021.22 |
| CVE-2023-38206 | 5.3 | Sep 14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a… Affected: 2018; 2018; 2018; 2018; 2018; 2018; +24 more |
| CVE-2018-15963 | 5.3 | Sep 25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +17 more |
| CVE-2018-15962 | 5.3 | Sep 25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +17 more |
| CVE-2011-0737 | 5.3 | Feb 1 | Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error… Affected: through 9.0.1; 4.5; 5.0; 6.0; 6.1; 7.0; +7 more |
| CVE-2011-0736 | 5.3 | Feb 1 | Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database… Affected: through 9.0.1; 4.5; 5.0; 6.0; 6.1; 7.0; +7 more |
| CVE-2025-49542 | 5.2 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2026-48384 | 4.9 | Aug 11 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2023-26361 | 4.9 | Mar 23 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path… Affected: 2018; 2018; 2018; 2018; 2018; 2018; +16 more |
| CVE-2022-38423 | 4.9 | Oct 14 | Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability Affected: through CF2021U4; through CF2018u14; through None |
| CVE-2026-47933 | 4.8 | Jun 9 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more |
| CVE-2025-49539 | 4.5 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2025-49543 | 4.3 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2025-49541 | 4.3 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2025-49540 | 4.3 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2023-44355 | 4.3 | Nov 17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass Affected: before 2021; 2021; 2021; 2021; 2021; 2021; +13 more |
Showing 49