CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 2:50 AM ET)

What this means for you

This week: 3,100 CVEs published, 233 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,100; Show in the list
Critical, last 7 days: 233; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product adobe:coldfusion. Show all products

123 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2009-3960 Known exploited	Medium 6.5	Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8… Assigned by adobe	Feb 15, 2010
CVE-2010-2861 Known exploited	High 7.5	Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/ad… Assigned by adobe	Aug 11, 2010
CVE-2013-0631 Known exploited	High 7.5	Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013. Assigned by adobe	Jan 8, 2013
CVE-2013-0629 Known exploited	High 7.5	Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013. Assigned by adobe	Jan 8, 2013
CVE-2013-0625 Known exploited	Critical 9.8	Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited i… Assigned by adobe	Jan 8, 2013
CVE-2013-0632 Known exploited	Critical 9.8	administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the defau… Assigned by adobe	Jan 16, 2013
CVE-2017-3066 Known exploited	Critical 9.8	Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Assigned by adobe	Apr 27, 2017
CVE-2018-4939 Known exploited	Critical 9.8	Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Assigned by adobe	May 19, 2018
CVE-2018-15961 Known exploited	Critical 9.8	Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Assigned by adobe	Sep 25, 2018
CVE-2023-26360 Known exploited	High 8.6	Adobe ColdFusion Improper Access Control Arbitrary code execution Assigned by adobe	Mar 22, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.