Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

16 results

Jul 7, 2026Adobe ColdFusion Path Traversal VulnerabilityCVE-2026-48282 · Websites & servers · Adobe · reported by AdobeExploitedCritical 10
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
Product
ColdFusion
On CISA’s list since
Jul 7, 2026 (federal fix deadline Jul 10, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com cisa.gov
Feb 24, 2025Adobe ColdFusion Deserialization VulnerabilityCVE-2017-3066 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
Product
ColdFusion
On CISA’s list since
Feb 24, 2025 (federal fix deadline Mar 17, 2025)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Dec 16, 2024Adobe ColdFusion Improper Access Control VulnerabilityCVE-2024-20767 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.4
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
Product
ColdFusion
On CISA’s list since
Dec 16, 2024 (federal fix deadline Jan 6, 2025)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jan 8, 2024Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-29300 · Websites & servers · Adobe · reported by AdobeExploitedRansomwareCritical 9.8
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
Product
ColdFusion
On CISA’s list since
Jan 8, 2024 (federal fix deadline Jan 29, 2024)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jan 8, 2024Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-38203 · Websites & servers · Adobe · reported by AdobeExploitedRansomwareCritical 9.8
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
Product
ColdFusion
On CISA’s list since
Jan 8, 2024 (federal fix deadline Jan 29, 2024)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Aug 21, 2023Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-26359 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
Product
ColdFusion
On CISA’s list since
Aug 21, 2023 (federal fix deadline Sep 11, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jul 20, 2023Adobe ColdFusion Improper Access Control VulnerabilityCVE-2023-29298 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Product
ColdFusion
On CISA’s list since
Jul 20, 2023 (federal fix deadline Aug 10, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jul 20, 2023Adobe ColdFusion Improper Access Control VulnerabilityCVE-2023-38205 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Product
ColdFusion
On CISA’s list since
Jul 20, 2023 (federal fix deadline Aug 10, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Mar 15, 2023Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-26360 · Websites & servers · Adobe · reported by AdobeExploitedHigh 8.6
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
Product
ColdFusion
On CISA’s list since
Mar 15, 2023 (federal fix deadline Apr 5, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com helpx.adobe.com
Mar 25, 2022Adobe ColdFusion Directory Traversal VulnerabilityCVE-2010-2861 · Websites & servers · Adobe · reported by AdobeExploitedRansomwareCritical 9.8
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
Product
ColdFusion
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityreason.com securityreason.com
Mar 7, 2022Adobe ColdFusion Information Disclosure VulnerabilityCVE-2013-0631 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.
Product
ColdFusion
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog adobe.com adobe.com
Mar 7, 2022Adobe ColdFusion Directory Traversal VulnerabilityCVE-2013-0629 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.
Product
ColdFusion
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog adobe.com adobe.com
Mar 7, 2022Adobe ColdFusion Authentication Bypass VulnerabilityCVE-2013-0625 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
Product
ColdFusion
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog adobe.com adobe.com
Mar 3, 2022Adobe ColdFusion Authentication Bypass VulnerabilityCVE-2013-0632 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.
Product
ColdFusion
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog adobe.com adobe.com
Nov 3, 2021Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2018-4939 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
Product
ColdFusion
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com helpx.adobe.com
Nov 3, 2021Adobe ColdFusion Unrestricted File Upload VulnerabilityCVE-2018-15961 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
Product
ColdFusion
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.