By year
99
00
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Adobe flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous TypeExploited since Oct 27, 2026 · CVSS 9.3
- CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability Exploited since Sep 24, 2026 · CVSS 9.1
- CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template EngineExploited since Sep 8, 2026 · CVSS 10
- CVE-2026-48282 Adobe ColdFusion Path TraversalExploited since Jul 7, 2026 · CVSS 10
- CVE-2009-3459 Adobe Acrobat and Reader Heap-Based Buffer OverflowExploited since May 20, 2026 · CVSS 8.8
- CVE-2026-34621 Adobe Acrobat and Reader Prototype PollutionExploited since Apr 13, 2026 · CVSS 8.6
- CVE-2020-9715 Adobe Acrobat Use-After-FreeExploited since Apr 13, 2026 · CVSS 7.8
- CVE-2025-54236 Adobe Commerce and Magento Improper Input ValidationExploited since Oct 24, 2025 · CVSS 9.1
- CVE-2025-54253 Adobe Experience Manager Forms Code ExecutionExploited since Oct 15, 2025 · CVSS 10
- CVE-2017-3066 Adobe ColdFusion DeserializationExploited since Feb 24, 2025 · CVSS 9.8
- CVE-2024-20767 Adobe ColdFusion Improper Access ControlExploited since Dec 16, 2024 · CVSS 7.4
- CVE-2014-0502 Adobe Flash Player Double Free VulnerablityExploited since Sep 17, 2024 · CVSS 8.8
- CVE-2013-0643 Adobe Flash Player Incorrect Default PermissionsExploited since Sep 17, 2024 · CVSS 8.8
- CVE-2013-0648 Adobe Flash Player Code ExecutionExploited since Sep 17, 2024 · CVSS 8.8
- CVE-2014-0497 Adobe Flash Player Integer Underflow VulnerablityExploited since Sep 17, 2024 · CVSS 9.8
- CVE-2024-34102 Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)Exploited since Jul 17, 2024 · CVSS 9.8
- CVE-2023-29300 Adobe ColdFusion Deserialization of Untrusted DataExploited since Jan 8, 2024 · ransomware · CVSS 9.8
- CVE-2023-38203 Adobe ColdFusion Deserialization of Untrusted DataExploited since Jan 8, 2024 · ransomware · CVSS 9.8
- CVE-2023-21608 Adobe Acrobat and Reader Use-After-FreeExploited since Oct 10, 2023 · CVSS 7.8
- CVE-2023-26369 Adobe Acrobat and Reader Out-of-Bounds WriteExploited since Sep 14, 2023 · CVSS 7.8
- CVE-2023-26359 Adobe ColdFusion Deserialization of Untrusted DataExploited since Aug 21, 2023 · CVSS 9.8
- CVE-2023-38205 Adobe ColdFusion Improper Access ControlExploited since Jul 20, 2023 · CVSS 7.5
- CVE-2023-29298 Adobe ColdFusion Improper Access ControlExploited since Jul 20, 2023 · CVSS 7.5
- CVE-2023-26360 Adobe ColdFusion Deserialization of Untrusted DataExploited since Mar 15, 2023 · CVSS 8.6
- CVE-2008-0655 Adobe Acrobat and Reader UnspecifiedExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2018-4990 Adobe Acrobat and Reader Double FreeExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2012-5054 Adobe Flash Player Integer OverflowExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2012-0767 Adobe Flash Player Cross-Site Scripting (XSS)Exploited since Jun 8, 2022 · CVSS 6.1
- CVE-2012-0754 Adobe Flash Player Memory CorruptionExploited since Jun 8, 2022 · CVSS 8.1
- CVE-2011-2462 Adobe Reader and Acrobat Universal 3D Memory CorruptionExploited since Jun 8, 2022 · CVSS 9.8
- CVE-2011-0609 Adobe Flash Player UnspecifiedExploited since Jun 8, 2022 · CVSS 7.8
- CVE-2010-2883 Adobe Acrobat and Reader Stack-Based Buffer OverflowExploited since Jun 8, 2022 · CVSS 7.3
- CVE-2010-1297 Adobe Flash Player Memory CorruptionExploited since Jun 8, 2022 · CVSS 7.8
- CVE-2009-3953 Adobe Acrobat and Reader Universal 3D Remote Code ExecutionExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2009-4324 Adobe Acrobat and Reader Use-After-FreeExploited since Jun 8, 2022 · CVSS 7.8
- CVE-2009-1862 Adobe Acrobat and Reader, Flash Player UnspecifiedExploited since Jun 8, 2022 · CVSS 7.8
- CVE-2007-5659 Adobe Acrobat and Reader Buffer OverflowExploited since Jun 8, 2022 · CVSS 7.8
- CVE-2016-1010 Adobe Flash Player and AIR Integer OverflowExploited since May 25, 2022 · CVSS 8.8
- CVE-2015-0310 Adobe Flash Player ASLR BypassExploited since May 25, 2022 · CVSS 7.8
- CVE-2014-8439 Adobe Flash Player Dereferenced PointerExploited since May 25, 2022 · CVSS 8.8
- CVE-2014-0546 Adobe Reader and Acrobat Sandbox BypassExploited since May 25, 2022 · CVSS 9.8
- CVE-2015-8651 Adobe Flash Player Integer OverflowExploited since May 25, 2022 · CVSS 8.8
- CVE-2016-0984 Adobe Flash Player and AIR Use-After-FreeExploited since May 25, 2022 · CVSS 8.8
- CVE-2018-5002 Adobe Flash Player Stack-based Buffer OverflowExploited since May 23, 2022 · CVSS 7.8
- CVE-2015-3113 Adobe Flash Player Heap-Based Buffer OverflowExploited since Apr 13, 2022 · CVSS 9.8
- CVE-2014-9163 Adobe Flash Player Stack-Based Buffer OverflowExploited since Apr 13, 2022 · CVSS 7.8
- CVE-2015-5122 Adobe Flash Player Use-After-FreeExploited since Apr 13, 2022 · CVSS 9.8
- CVE-2015-0313 Adobe Flash Player Use-After-FreeExploited since Apr 13, 2022 · CVSS 9.8
- CVE-2015-0311 Adobe Flash Player Remote Code ExecutionExploited since Apr 13, 2022 · CVSS 9.8
- CVE-2015-5123 Adobe Flash Player Use-After-FreeExploited since Apr 13, 2022 · CVSS 9.8
- CVE-2012-2034 Adobe Flash Player Memory CorruptionExploited since Mar 28, 2022 · CVSS 7.5
- CVE-2013-2729 Adobe Reader and Acrobat Arbitrary Integer OverflowExploited since Mar 28, 2022 · CVSS 9.8
- CVE-2016-4171 Adobe Flash Player Remote Code ExecutionExploited since Mar 25, 2022 · CVSS 9.8
- CVE-2016-7892 Adobe Flash Player Use-After-FreeExploited since Mar 25, 2022 · CVSS 8.8
- CVE-2010-2861 Adobe ColdFusion Directory TraversalExploited since Mar 25, 2022 · ransomware · CVSS 9.8
- CVE-2009-0927 Adobe Reader and Adobe Acrobat Stack-Based Buffer OverflowExploited since Mar 25, 2022 · CVSS 8.8
- CVE-2013-0631 Adobe ColdFusion Information DisclosureExploited since Mar 7, 2022 · CVSS 7.5
- CVE-2013-0625 Adobe ColdFusion Authentication BypassExploited since Mar 7, 2022 · CVSS 9.8
- CVE-2009-3960 Adobe BlazeDS Information DisclosureExploited since Mar 7, 2022 · ransomware · CVSS 6.5
- CVE-2013-0629 Adobe ColdFusion Directory TraversalExploited since Mar 7, 2022 · CVSS 7.5
Latest high and critical flaws
- CVE-2026-48379 Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current useHigh 7.8 · Oct 27, 2026
- CVE-2026-48360 Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the conCritical 9.6 · Oct 27, 2026
- CVE-2026-105781 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCritical 10 · Oct 27, 2026
- CVE-2026-105780 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the currentCritical 9.9 · Oct 27, 2026
- CVE-2026-105779 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCritical 9.1 · Oct 27, 2026
- CVE-2026-105489 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCritical 9.9 · Oct 27, 2026
- CVE-2026-104354 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCritical 9.1 · Oct 27, 2026
- CVE-2026-104353 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that couCritical 9.9 · Oct 27, 2026
- CVE-2026-104351 Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execuCritical 9.9 · Oct 27, 2026
- CVE-2026-104350 Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.Critical 9.3 · Oct 27, 2026
- CVE-2026-104349 Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the currHigh 7.3 · Oct 27, 2026
- CVE-2026-100134 Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.High 8.8 · Oct 20, 2026
- CVE-2026-95634 CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.High 8.6 · Oct 13, 2026
- CVE-2026-95633 CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.High 7.5 · Oct 13, 2026
- CVE-2026-95632 CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.High 7.5 · Oct 13, 2026
- CVE-2026-106627 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.High 7.5 · Oct 13, 2026
- CVE-2026-105902 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.High 7.5 · Oct 13, 2026
- CVE-2026-104345 CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.High 7.5 · Oct 13, 2026
- CVE-2026-103297 CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.High 7.5 · Oct 13, 2026
- CVE-2026-103296 CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.High 7.5 · Oct 13, 2026
- CVE-2026-100139 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.High 7.5 · Oct 13, 2026
- CVE-2026-100138 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.High 7.5 · Oct 13, 2026
- CVE-2026-100137 CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.High 7.5 · Oct 13, 2026
- CVE-2026-100136 CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service.High 7.5 · Oct 13, 2026
- CVE-2026-100135 CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.High 7.5 · Oct 13, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.