Vendor CVEs

Adobe Inc.

All CVEs

7,928 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2016-0997	Adobe Inc. Air	Hig	0.63	8.8	0.30	Mar 12, 2016	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows…
CVE-2016-0974	Adobe Inc. Air SDK	Hig	0.63	8.8	0.31	Feb 10, 2016	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…
CVE-2016-0971	Adobe Inc. Air SDK	Hig	0.63	8.8	0.33	Feb 10, 2016	Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…
CVE-2026-82000	Adobe Inc. Experience Manager Forms	Cri	0.62	9.6	—	Sep 22, 2026	Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue…
CVE-2026-82443	Adobe Inc. Campaign Classic	Cri	0.62	9.6	—	Sep 22, 2026	Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not…
CVE-2026-71384	Adobe Inc. Coldfusion	Cri	0.62	9.6	0.00	Aug 11, 2026	is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application…
CVE-2026-48317	Adobe Inc. Campaign	Cri	0.62	9.6	0.00	Aug 3, 2026	Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this…
CVE-2026-48319	Adobe Inc. Coldfusion	Cri	0.62	9.1	0.32	Jul 14, 2026	ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to…
CVE-2026-48359	Adobe Inc. Experience Manager	Cri	0.62	9.6	0.01	Jul 14, 2026	Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive…
CVE-2026-48259	Adobe Inc. Experience Manager	Cri	0.62	9.6	0.01	Jul 14, 2026	Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests,…
CVE-2026-34659	Adobe Inc. Connect	Cri	0.62	9.6	0.01	May 12, 2026	Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.…
CVE-2026-27303	Adobe Inc. Connect	Cri	0.62	9.6	0.01	Apr 14, 2026	Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must visit a…
CVE-2025-27203	Adobe Inc. Connect	Cri	0.62	9.6	0.01	Jul 8, 2025	Adobe Connect versions 24.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does require user interaction and scope is changed.
CVE-2025-43562	Adobe Inc. Coldfusion	Cri	0.62	9.1	0.45	May 13, 2025	ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2019-7111	Adobe Inc. Acrobat	Hig	0.62	8.8	0.16	May 23, 2019	Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2018-4937	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.26	May 19, 2018	Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-4935	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.26	May 19, 2018	Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2017-3106	Adobe Inc. Adobe Flash Player	Hig	0.62	8.8	0.22	Aug 11, 2017	Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
CVE-2017-3068	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.20	May 9, 2017	Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2988	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.18	Feb 15, 2017	Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2985	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.22	Feb 15, 2017	Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2932	Adobe Inc. Flashplayer	Hig	0.62	8.8	0.25	Jan 11, 2017	Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2931	Adobe Inc. Flashplayer	Hig	0.62	8.8	0.21	Jan 11, 2017	Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2930	Adobe Inc. Flashplayer	Hig	0.62	8.8	0.25	Jan 11, 2017	Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution.
CVE-2016-4273	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.20	Oct 13, 2016	Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2016-4275	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.19	Sep 14, 2016	Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2016-4179	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.20	Jul 13, 2016	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2016-4177	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.18	Jul 13, 2016	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability…
CVE-2016-4176	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.18	Jul 13, 2016	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability…
CVE-2016-4175	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.20	Jul 13, 2016	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2016-4137	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.16	Jun 16, 2016	Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVE-2016-4136	Adobe Inc. Flash Player Desktop Runtime	Hig	0.62	8.8	0.16	Jun 16, 2016	Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVE-2016-4135	Microsoft Internet Explorer	Hig	0.62	8.8	0.17	Jun 16, 2016	Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVE-2016-1013	Adobe Inc. Air SDK	Hig	0.62	8.8	0.23	Apr 9, 2016	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011,…
CVE-2016-1011	Adobe Inc. Air SDK	Hig	0.62	8.8	0.26	Apr 9, 2016	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1013,…
CVE-2016-1002	Adobe Inc. Air	Hig	0.62	8.8	0.21	Mar 12, 2016	Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary…
CVE-2016-1001	Adobe Inc. Air	Hig	0.62	8.8	0.26	Mar 12, 2016	Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows…
CVE-2016-0985	Adobe Inc. Air SDK	Hig	0.62	8.8	0.26	Feb 10, 2016	Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…
CVE-2016-0967	Adobe Inc. Air SDK	Hig	0.62	8.8	0.20	Feb 10, 2016	Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…
CVE-2016-0965	Adobe Inc. Air SDK	Hig	0.62	8.8	0.20	Feb 10, 2016	Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…
CVE-2016-0964	Adobe Inc. Air SDK	Hig	0.62	8.8	0.20	Feb 10, 2016	Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…
CVE-2015-8644	Adobe Inc. Air	Hig	0.62	8.8	0.25	Dec 28, 2015	Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code…
CVE-2015-8636	Adobe Inc. Air	Hig	0.62	8.8	0.21	Dec 28, 2015	Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code…
CVE-2015-8635	Adobe Inc. Air	Hig	0.62	8.8	0.25	Dec 28, 2015	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…
CVE-2015-8634	Adobe Inc. Air	Hig	0.62	8.8	0.25	Dec 28, 2015	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…
CVE-2010-1280	Adobe Inc. Shockwave Player	Hig	0.62	8.8	0.17	May 13, 2010	Adobe Shockwave Player before 11.5.7.609 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file, related to (1) an erroneous dereference and (2) a certain Shock.dir file.
CVE-2026-71362	Adobe Inc. Commerce	Cri	0.61	9.1	0.25	Aug 11, 2026	Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
CVE-2026-48356	Adobe Inc. Commerce	Cri	0.61	9.3	0.01	Jul 14, 2026	Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of…
CVE-2026-48315	Adobe Inc. Coldfusion	Cri	0.61	9.3	0.01	Jun 30, 2026	ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page,…
CVE-2026-48313	Adobe Inc. Coldfusion	Cri	0.61	9.3	0.03	Jun 30, 2026	ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to…

CVE-2016-0997HigMar 12, 2016
Adobe Inc.
Air
risk 0.63cvss 8.8epss 0.30
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows…
CVE-2016-0974HigFeb 10, 2016
Adobe Inc.
Air SDK
risk 0.63cvss 8.8epss 0.31
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…
CVE-2016-0971HigFeb 10, 2016
Adobe Inc.
Air SDK
risk 0.63cvss 8.8epss 0.33
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…
CVE-2026-82000CriSep 22, 2026
Adobe Inc.
Experience Manager Forms
risk 0.62cvss 9.6epss —
Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue…
CVE-2026-82443CriSep 22, 2026
Adobe Inc.
Campaign Classic
risk 0.62cvss 9.6epss —
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not…
CVE-2026-71384CriAug 11, 2026
Adobe Inc.
Coldfusion
risk 0.62cvss 9.6epss 0.00
is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application…
CVE-2026-48317CriAug 3, 2026
Adobe Inc.
Campaign
risk 0.62cvss 9.6epss 0.00
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this…
CVE-2026-48319CriJul 14, 2026
Adobe Inc.
Coldfusion
risk 0.62cvss 9.1epss 0.32
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to…
CVE-2026-48359CriJul 14, 2026
Adobe Inc.
Experience Manager
risk 0.62cvss 9.6epss 0.01
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive…
CVE-2026-48259CriJul 14, 2026
Adobe Inc.
Experience Manager
risk 0.62cvss 9.6epss 0.01
Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests,…
CVE-2026-34659CriMay 12, 2026
Adobe Inc.
Connect
risk 0.62cvss 9.6epss 0.01
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.…
CVE-2026-27303CriApr 14, 2026
Adobe Inc.
Connect
risk 0.62cvss 9.6epss 0.01
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must visit a…
CVE-2025-27203CriJul 8, 2025
Adobe Inc.
Connect
risk 0.62cvss 9.6epss 0.01
Adobe Connect versions 24.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does require user interaction and scope is changed.
CVE-2025-43562CriMay 13, 2025
Adobe Inc.
Coldfusion
risk 0.62cvss 9.1epss 0.45
ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A…
CVE-2019-7111HigMay 23, 2019
Adobe Inc.
Acrobat
risk 0.62cvss 8.8epss 0.16
Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2018-4937HigMay 19, 2018
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.26
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-4935HigMay 19, 2018
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.26
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2017-3106HigAug 11, 2017
Adobe Inc.
Adobe Flash Player
risk 0.62cvss 8.8epss 0.22
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
CVE-2017-3068HigMay 9, 2017
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.20
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2988HigFeb 15, 2017
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.18
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2985HigFeb 15, 2017
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.22
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2932HigJan 11, 2017
Adobe Inc.
Flashplayer
risk 0.62cvss 8.8epss 0.25
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2931HigJan 11, 2017
Adobe Inc.
Flashplayer
risk 0.62cvss 8.8epss 0.21
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2930HigJan 11, 2017
Adobe Inc.
Flashplayer
risk 0.62cvss 8.8epss 0.25
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution.
CVE-2016-4273HigOct 13, 2016
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.20
Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2016-4275HigSep 14, 2016
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.19
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2016-4179HigJul 13, 2016
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.20
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2016-4177HigJul 13, 2016
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.18
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability…
CVE-2016-4176HigJul 13, 2016
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.18
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability…
CVE-2016-4175HigJul 13, 2016
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.20
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2016-4137HigJun 16, 2016
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.16
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVE-2016-4136HigJun 16, 2016
Adobe Inc.
Flash Player Desktop Runtime
risk 0.62cvss 8.8epss 0.16
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVE-2016-4135HigJun 16, 2016
Microsoft
Internet Explorer
risk 0.62cvss 8.8epss 0.17
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVE-2016-1013HigApr 9, 2016
Adobe Inc.
Air SDK
risk 0.62cvss 8.8epss 0.23
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011,…
CVE-2016-1011HigApr 9, 2016
Adobe Inc.
Air SDK
risk 0.62cvss 8.8epss 0.26
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1013,…
CVE-2016-1002HigMar 12, 2016
Adobe Inc.
Air
risk 0.62cvss 8.8epss 0.21
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary…
CVE-2016-1001HigMar 12, 2016
Adobe Inc.
Air
risk 0.62cvss 8.8epss 0.26
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows…
CVE-2016-0985HigFeb 10, 2016
Adobe Inc.
Air SDK
risk 0.62cvss 8.8epss 0.26
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…
CVE-2016-0967HigFeb 10, 2016
Adobe Inc.
Air SDK
risk 0.62cvss 8.8epss 0.20
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…
CVE-2016-0965HigFeb 10, 2016
Adobe Inc.
Air SDK
risk 0.62cvss 8.8epss 0.20
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…
CVE-2016-0964HigFeb 10, 2016
Adobe Inc.
Air SDK
risk 0.62cvss 8.8epss 0.20
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…
CVE-2015-8644HigDec 28, 2015
Adobe Inc.
Air
risk 0.62cvss 8.8epss 0.25
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code…
CVE-2015-8636HigDec 28, 2015
Adobe Inc.
Air
risk 0.62cvss 8.8epss 0.21
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code…
CVE-2015-8635HigDec 28, 2015
Adobe Inc.
Air
risk 0.62cvss 8.8epss 0.25
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…
CVE-2015-8634HigDec 28, 2015
Adobe Inc.
Air
risk 0.62cvss 8.8epss 0.25
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…
CVE-2010-1280HigMay 13, 2010
Adobe Inc.
Shockwave Player
risk 0.62cvss 8.8epss 0.17
Adobe Shockwave Player before 11.5.7.609 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file, related to (1) an erroneous dereference and (2) a certain Shock.dir file.
CVE-2026-71362CriAug 11, 2026
Adobe Inc.
Commerce
risk 0.61cvss 9.1epss 0.25
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
CVE-2026-48356CriJul 14, 2026
Adobe Inc.
Commerce
risk 0.61cvss 9.3epss 0.01
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of…
CVE-2026-48315CriJun 30, 2026
Adobe Inc.
Coldfusion
risk 0.61cvss 9.3epss 0.01
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page,…
CVE-2026-48313CriJun 30, 2026
Adobe Inc.
Coldfusion
risk 0.61cvss 9.3epss 0.03
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to…

Page 16 of 159