Login Request a demo
EM
Product
Experience Manager
by Adobe · last CVE Oct 13, 2026
1,272
CVEs
0
On KEV
9.9
Max CVSS
6
New 30D
Vulnerabilities1,272In the news0Timeline
Severity mix
Critical 19High 30Medium 451Low 0
Severity
All severities500Critical19High30Medium451Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Experience Manager to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105895
9.9
1%
Oct 13
Adobe Experience Manager | Improper Input Validation (CWE-20)
Affected: through 6.5; through 6.5.25.0; through 2026.9.28187
CVE-2026-19232
9.9
1%
Sep 8
Adobe Experience Manager | Incorrect Authorization (CWE-863)
Affected: before 6.5; before 6.5.25.0; before 2026.8.0; 6.5; 6.5; 6.5
CVE-2025-49533
9.8
52%
Jul 8
Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an…
Affected: through 6.5.23.0
CVE-2024-26029
9.8
1%
Jun 13
Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass
Affected: before 6.5.21; before 2024.5
CVE-2021-40722
9.8
3%
Jan 13
AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker…
Affected: through 6.5.10.0
CVE-2019-8088
9.8
6%
Oct 25
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability
Affected: 6.2; 6.3; 6.4; 6.5
CVE-2019-7964
9.8
10%
Aug 16
Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability
Affected: 6.4; 6.5
CVE-2017-3108
9.8
9%
Aug 11
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability
Affected: through 6.2
CVE-2026-48259
9.6
1%
Jul 14
Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)
Affected: through 6.5.25.0; through 2020.5.0; 6.5; 6.5; 6.5
CVE-2026-48359
9.6
1%
Jul 14
Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Affected: through 6.5.25.0; through 2020.5.0; 6.5; 6.5; 6.5
CVE-2026-106630
9.3
1%
Oct 13
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 6.5; through 6.5.25.0
CVE-2026-106629
9.3
1%
Oct 13
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 6.5; through 6.5.25.0
CVE-2026-34691
9.3
0%
Jun 9
Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 6.5.24.0; 6.5; 6.5
CVE-2025-64539
9.3
0%
Dec 10
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution
Affected: before 6.5.24.0; before 2025.12.0; 6.5
CVE-2025-64538
9.3
1%
Dec 10
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution
Affected: before 6.5.24.0; before 2025.12.0; 6.5
CVE-2025-64537
9.3
1%
Dec 10
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution
Affected: before 6.5.24.0; before 2025.12.0; 6.5
CVE-2026-106626
9.1
1%
Oct 13
Adobe Experience Manager | Improper Input Validation (CWE-20)
Affected: through 6.5; through 6.5.25.0; through 2026.9.28187
CVE-2020-24445
9.0
3%
Dec 10
AEM's Cloud Service offering, as well as version 6.5.6.0 (and below), are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…
Affected: through 6.5.6.0
CVE-2020-9732
9.0
3%
Sep 10
The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store…
Affected: through 6.2.1.20; 6.3.0.0 through 6.3.3.8; 6.4.0.0 through 6.4.8.1; 6.5.0.0 through 6.5.5.0
Showing 19
The 500 most important CVEs for this product (exploited first, then by severity)