CVE-2025-61841

Format Plugins | Out-of-bounds Read (CWE-125)

Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive memory information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Format Plugins

CVE-2026-106612

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-106613

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-106616

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-105900

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-105897

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-106090

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-106614

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-103294

CAI Content Credentials | Improper Certificate Validation (CWE-295)

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2pa C2pa-web C2patool and 2 more

CVE-2026-100133

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

CVSS 3.1 · 9.3 Critical EPSS 1.0% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Magento Open Source

CVE-2026-105994

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion

CVE-2026-106089

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion

CVE-2026-100117

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2pa C2pa-web C2patool and 2 more

CVE-2026-100119

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2pa C2pa-web C2patool and 2 more

CVE-2026-105903

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion

CVE-2026-106615

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion

CVE-2026-106617

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion

CVE-2026-97312

Photoshop Desktop | Out-of-bounds Write (CWE-787)

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Photoshop Macos Windows

CVE-2026-105896

Photoshop Desktop | NULL Pointer Dereference (CWE-476)

Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Photoshop Macos Windows

CVE-2026-104348

Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)

Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Photoshop Macos Windows