Vendor
Adobe
83 of 154 Adobe CVEs in Patchfirst (54%) are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it. of vulnerabilities exploited in the wild, 11 of them used by ransomware.
- CVEs
- 154
- In CISA KEV
- 8354%
- Known ransomware use
- 11
- Median days to KEV
- 2,632
- from publication
- Latest KEV listing
- 27 Oct 2026
Products
In KEVOther CVEs
- Flash Player In KEV: 33 CVEs: 33
- ColdFusion In KEV: 16 CVEs: 29
- Acrobat and Reader In KEV: 13 CVEs: 13
- Reader and Acrobat In KEV: 8 CVEs: 8
- Commerce and Magento In KEV: 3 CVEs: 3
- Commerce and Magento Open Source In KEV: 2 CVEs: 2
- Flash Player and AIR In KEV: 2 CVEs: 2
- Acrobat In KEV: 1 CVEs: 1
- Acrobat and Reader, Flash Player In KEV: 1 CVEs: 1
- BlazeDS In KEV: 1 CVEs: 1
Top ATT&CK techniques
What attackers do with Adobe CVEs- T1204.002Malicious File CVEs: 27
- T1190Exploit Public-Facing Application CVEs: 22
- T1059Command and Scripting Interpreter CVEs: 18
- T1105Ingress Tool Transfer CVEs: 17
- T1189Drive-by Compromise CVEs: 14
Counts are Adobe CVEs linked to the technique. Each link’s provenance is on the CVE page.
Adobe CVEs
Top 100 of 154 by priority- CVE-2015-0311Adobe Flash Player Remote Code Execution VulnerabilityAdobe · Flash PlayerKEVPublic exploitCritical · 9.82 reports85.6%Top 0.28%85.9priority
- CVE-2010-0188Adobe Reader and Acrobat Arbitrary Code Execution VulnerabilityAdobe · Reader and AcrobatKEVRansomwarePublic exploitHigh · 7.8T1189Drive-by CompromiseT1105Ingress Tool Transfer2 reports88.2%Top 0.23%84.5priority
- CVE-2016-1019Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe · Flash PlayerKEVRansomwareCritical · 9.8T1105Ingress Tool TransferT1486Data Encrypted for Impact4 reports22.3%Top 2.3%83.4priority
- CVE-2015-8651Adobe Flash Player Integer Overflow VulnerabilityAdobe · Flash PlayerKEVHigh · 8.8T1189Drive-by CompromiseT1105Ingress Tool Transfer+1 more · 3 reports67.7%Top 0.69%81.8priority
- CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1105Ingress Tool Transfer>99.9%Top 0.01%79.9priority
- CVE-2010-2861Adobe ColdFusion Directory Traversal VulnerabilityAdobe · ColdFusionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1119Automated Collection+1 more99.7%Top 0.05%79.9priority
- CVE-2023-38203Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1105Ingress Tool Transfer97.1%Top 0.11%79.8priority
- CVE-2014-8439Adobe Flash Player Dereferenced Pointer Vulnerability20.4%Top 2.5%79.8priority
- CVE-2026-71362Adobe Commerce and Magento Incorrect Authorization VulnerabilityAdobe · Commerce and Magento KEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1068Exploitation for Privilege Escalation90.5%Top 0.2%79.3priority
- CVE-2008-2992Adobe Reader and Acrobat Input Validation Vulnerability99.8%Top 0.04%78.5priority
- CVE-2026-48356Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityAdobe · Commerce and MagentoKEVPublic exploitCritical · 9.3T1189Drive-by CompromiseT1059Command and Scripting Interpreter44.6%Top 1.2%78.3priority
- CVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityAdobe · Commerce and MagentoKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter3.9%Top 9.6%78.1priority
- CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityAdobe · Flash PlayerKEVPublic exploitCritical · 9.8T1497Virtualization/Sandbox EvasionT1622Debugger Evasion+1 more · 3 reports99.8%Top 0.04%77.6priority
- CVE-2009-3960Adobe BlazeDS Information Disclosure Vulnerability90.1%Top 0.2%77.5priority
- CVE-2011-0611Adobe Flash Player Remote Code Execution VulnerabilityAdobe · Flash PlayerKEVPublic exploitHigh · 8.8T1204.002Malicious FileT1105Ingress Tool Transfer3 reports99.4%Top 0.06%76.9priority
- CVE-2015-0313Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitCritical · 9.82 reports95.3%Top 0.13%76.0priority
- CVE-2014-0497Adobe Flash Player Integer Underflow VulnerablityAdobe · Flash PlayerKEVPublic exploitCritical · 9.82 reports99.9%Top 0.03%76.0priority
- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reports98.6%Top 0.08%74.8priority
- CVE-2026-48282Adobe ColdFusion Path Traversal VulnerabilityAdobe · ColdFusionKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter42.4%Top 1.3%74.7priority
- CVE-2017-3066Adobe ColdFusion Deserialization VulnerabilityAdobe · ColdFusionKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report90.6%Top 0.2%73.7priority
- CVE-2020-9715Adobe Acrobat Use-After-Free VulnerabilityAdobe · AcrobatKEVPublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution33.5%Top 1.6%73.1priority
- CVE-2026-34621Adobe Acrobat and Reader Prototype Pollution VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitHigh · 8.6T1204.002Malicious FileT1203Exploitation for Client Execution7.2%Top 5.7%72.9priority
- CVE-2016-4117Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeCritical · 9.8T1105Ingress Tool Transfer3 reports94.3%Top 0.15%72.6priority
- CVE-2023-44353ColdFusion WDDX Deserialization GadgetsAdobe · ColdFusionPublic exploitCritical · 9.880.2%Top 0.38%72.5priority
- CVE-2010-1297Adobe Flash Player Memory Corruption VulnerabilityAdobe · Flash PlayerKEVPublic exploitHigh · 7.8T1189Drive-by CompromiseT1204.002Malicious File+1 more · 1 report82.5%Top 0.34%72.3priority
- CVE-2026-48313ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe · ColdFusion 2025Public exploitCritical · 9.33.0%Top 13%70.5priority
- CVE-2025-54253Adobe Experience Manager Forms Code Execution VulnerabilityAdobe · Experience Manager (AEM) FormsKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter88.8%Top 0.22%70.0priority
- CVE-2024-34102Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) VulnerabilityAdobe · Commerce and Magento Open SourceKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more>99.9%Top 0.01%69.9priority
- CVE-2023-44352Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last versionAdobe · ColdFusionPublic exploitMedium · 6.184.8%Top 0.29%69.9priority
- CVE-2018-15961Adobe ColdFusion Unrestricted File Upload VulnerabilityAdobe · ColdFusionKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1491.002External Defacement>99.9%Top 0.03%69.9priority
- CVE-2022-24086Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityAdobe · Commerce and Magento Open SourceKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1027Obfuscated Files or Information+1 more99.2%Top 0.07%69.8priority
- CVE-2013-0632Adobe ColdFusion Authentication Bypass Vulnerability93.1%Top 0.17%69.8priority
- CVE-2013-0625Adobe ColdFusion Authentication Bypass Vulnerability93.8%Top 0.16%69.8priority
- CVE-2015-7645Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1204.002Malicious File2 reports65.3%Top 0.74%69.4priority
- CVE-2025-54236Adobe Commerce and Magento Improper Input Validation VulnerabilityAdobe · Commerce and MagentoKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1550Use Alternate Authentication Material95.4%Top 0.13%69.3priority
- CVE-2021-21017Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability86.3%Top 0.27%69.1priority
- CVE-2009-3459Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitHigh · 8.8T1203Exploitation for Client ExecutionT1204.002Malicious File86.6%Top 0.26%69.1priority
- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 more97.3%Top 0.1%69.0priority
- CVE-2016-0984Adobe Flash Player and AIR Use-After-Free VulnerabilityAdobe · Flash Player and AIRKEVPublic exploitHigh · 8.8T1204.002Malicious FileT1105Ingress Tool Transfer54.5%Top 0.99%69.0priority
- CVE-2008-0655Adobe Acrobat and Reader Unspecified Vulnerability37.9%Top 1.5%68.9priority
- CVE-2026-48294Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data…Adobe · Adobe Acrobat PDF Extension (Chrome)High · 7.41.9%Top 20%68.7priority
- CVE-2015-5122Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1059Command and Scripting InterpreterT1499.004Application or System Exploitation1 report87.0%Top 0.25%68.7priority
- CVE-2014-0502Adobe Flash Player Double Free VulnerablityAdobe · Flash PlayerKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution24.8%Top 2.1%68.7priority
- CVE-2007-5659Adobe Acrobat and Reader Buffer Overflow Vulnerability87.4%Top 0.24%68.4priority
- CVE-2023-21608Adobe Acrobat and Reader Use-After-Free VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution59.4%Top 0.88%68.3priority
- CVE-2011-0609Adobe Flash Player Unspecified VulnerabilityAdobe · Flash PlayerKEVPublic exploitHigh · 7.8T1189Drive-by CompromiseT1203Exploitation for Client Execution+1 more63.5%Top 0.79%68.3priority
- CVE-2024-20767Adobe ColdFusion Improper Access Control VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 7.4T1190Exploit Public-Facing ApplicationT1005Data from Local System98.5%Top 0.08%68.2priority
- CVE-2023-38205Adobe ColdFusion Improper Access Control Vulnerability99.8%Top 0.04%68.2priority
- CVE-2023-29298Adobe ColdFusion Improper Access Control Vulnerability99.8%Top 0.04%68.2priority
- CVE-2013-0629Adobe ColdFusion Directory Traversal VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1202Indirect Command Execution+1 more65.8%Top 0.73%68.1priority
- CVE-2016-1010Adobe Flash Player and AIR Integer Overflow Vulnerability19.3%Top 2.7%67.5priority
- CVE-2025-49533Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)Adobe · Adobe Experience Manager (MS)Public exploitCritical · 9.851.7%Top 1.1%67.3priority
- CVE-2018-4878Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1219Remote Access Tools+1 more · 1 report90.3%Top 0.2%67.3priority
- CVE-2023-26347CVE-2023-38205 issues | ColdFusion Admin Panel AccessAdobe · ColdFusionPublic exploitHigh · 7.510.1%Top 4.4%65.1priority
- CVE-2018-4939Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application61.8%Top 0.83%64.7priority
- CVE-2013-2729Adobe Reader and Acrobat Arbitrary Integer Overflow VulnerabilityAdobe · Reader and AcrobatKEVPublic exploitEnd of lifeCritical · 9.8T1059Command and Scripting Interpreter66.6%Top 0.72%64.7priority
- CVE-2021-21087ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in…Adobe · ColdFusionPublic exploitMedium · 5.437.1%Top 1.5%64.6priority
- CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter17.0%Top 2.9%64.3priority
- CVE-2021-28550Adobe Acrobat and Reader Use-After-Free Vulnerability51.9%Top 1.1%63.9priority
- CVE-2018-4990Adobe Acrobat and Reader Double Free Vulnerability35.9%Top 1.5%63.9priority
- CVE-2015-0310Adobe Flash Player ASLR Bypass Vulnerability15.1%Top 3.3%63.9priority
- CVE-2018-15982Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1105Ingress Tool Transfer89.6%Top 0.21%63.4priority
- CVE-2025-54254Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)Adobe · Adobe Experience ManagerHigh · 8.670.1%Top 0.62%63.2priority
- CVE-2013-0631Adobe ColdFusion Information Disclosure VulnerabilityAdobe · ColdFusionKEVHigh · 7.5T1592Gather Victim Host InformationT1190Exploit Public-Facing Application66.4%Top 0.72%63.1priority
- CVE-2023-38204Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8Adobe · ColdFusionCritical · 9.866.9%Top 0.71%62.8priority
- CVE-2023-26369Adobe Acrobat and Reader Out-of-Bounds Write VulnerabilityAdobe · Acrobat and ReaderKEVHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution6.7%Top 6%62.3priority
- CVE-2012-2034Adobe Flash Player Memory Corruption Vulnerability7.7%Top 5.4%62.2priority
- CVE-2024-20720Command injection in data collector backup due to insufficient patching of CVE-2023-38208Adobe · Adobe CommerceCritical · 9.13.7%Top 10%61.4priority
- CVE-2015-3043Adobe Flash Player Memory Corruption VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1499.004Application or System Exploitation2 reports73.9%Top 0.52%60.9priority
- CVE-2025-54249Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)Adobe · Adobe Experience ManagerPublic exploitMedium · 6.51.9%Top 20%60.5priority
- CVE-2011-2462Adobe Reader and Acrobat Universal 3D Memory Corruption VulnerabilityAdobe · Reader and AcrobatKEVPublic exploitEnd of lifeCritical · 9.8T1059Command and Scripting InterpreterT1499Endpoint Denial of Service1 report88.6%Top 0.23%58.7priority
- CVE-2025-54251Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)Adobe · Adobe Experience ManagerPublic exploitMedium · 4.31.7%Top 23%58.5priority
- CVE-2024-41869Acrobat Reader | Use After Free (CWE-416)Adobe · Acrobat ReaderHigh · 7.82.4%Top 16%57.9priority
- CVE-2013-0640Adobe Reader and Acrobat Memory Corruption VulnerabilityAdobe · Reader and AcrobatKEVPublic exploitEnd of lifeHigh · 7.8T1566.001Spearphishing Attachment1 report86.9%Top 0.25%57.3priority
- CVE-2023-26397[ZS-VR-22-112] Adobe Acrobat Out-of-bounds Read Memory leakAdobe · Acrobat ReaderMedium · 5.52.9%Top 13%57.0priority
- CVE-2010-2883Adobe Acrobat and Reader Stack-Based Buffer Overflow VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitEnd of lifeHigh · 7.3T1204.002Malicious FileT1059Command and Scripting Interpreter+1 more · 1 report81.4%Top 0.36%56.9priority
- CVE-2019-7816ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload…Adobe · ColdFusion67.8%Top 0.68%54.9priority
- CVE-2013-3346Adobe Reader and Acrobat Memory Corruption Vulnerability78.9%Top 0.41%54.8priority
- CVE-2009-3953Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability83.2%Top 0.32%54.1priority
- CVE-2009-0927Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow VulnerabilityAdobe · Reader and AcrobatKEVPublic exploitEnd of lifeHigh · 8.8T1203Exploitation for Client ExecutionT1204.002Malicious File96.6%Top 0.12%54.1priority
- CVE-2016-7855Adobe Flash Player Use-After-Free Vulnerability25.2%Top 2.1%53.7priority
- CVE-2012-5054Adobe Flash Player Integer Overflow Vulnerability21.2%Top 2.4%53.7priority
- CVE-2012-0754Adobe Flash Player Memory Corruption Vulnerability91.1%Top 0.19%53.6priority
- CVE-2009-4324Adobe Acrobat and Reader Use-After-Free VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1071.001Web Protocols81.9%Top 0.35%53.4priority
- CVE-2012-1535Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1105Ingress Tool Transfer70.4%Top 0.61%53.3priority
- CVE-2016-4171Adobe Flash Player Remote Code Execution Vulnerability20.1%Top 2.6%53.2priority
- CVE-2013-0641Adobe Reader Buffer Overflow VulnerabilityAdobe · ReaderKEVEnd of lifeHigh · 7.8T1204.002Malicious FileT1105Ingress Tool Transfer+1 more · 1 report32.3%Top 1.7%52.0priority
- CVE-2014-0546Adobe Reader and Acrobat Sandbox Bypass VulnerabilityAdobe · Reader and AcrobatKEVEnd of lifeCritical · 9.8T1068Exploitation for Privilege EscalationT1497Virtualization/Sandbox Evasion22.3%Top 2.3%49.4priority
- CVE-2015-5123Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVEnd of lifeCritical · 9.8T1059Command and Scripting InterpreterT1499.004Application or System Exploitation18.8%Top 2.7%49.3priority
- CVE-2014-0496Adobe Reader and Acrobat Use-After-Free Vulnerability40.0%Top 1.4%48.9priority
- CVE-2016-7892Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter18.8%Top 2.7%48.6priority
- CVE-2017-11292Adobe Flash Player Type Confusion VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 8.8T1566.001Spearphishing AttachmentT1204.002Malicious File+2 more11.9%Top 3.9%48.4priority
- CVE-2013-0648Adobe Flash Player Code Execution VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter11.1%Top 4.1%48.3priority
- CVE-2013-0643Adobe Flash Player Incorrect Default Permissions VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter10.5%Top 4.2%48.3priority
- CVE-2014-9163Adobe Flash Player Stack-Based Buffer Overflow VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 7.8T1203Exploitation for Client ExecutionT1059Command and Scripting Interpreter44.9%Top 1.2%48.2priority
- CVE-2018-5002Adobe Flash Player Stack-based Buffer Overflow VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 7.8T1204.002Malicious FileT1059Command and Scripting Interpreter24.4%Top 2.1%48.0priority
- CVE-2009-1862Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability21.2%Top 2.4%48.0priority
- CVE-2012-0767Adobe Flash Player Cross-Site Scripting (XSS) VulnerabilityAdobe · Flash PlayerKEVEnd of lifeMedium · 6.1T1204.001Malicious LinkT1098Account Manipulation+2 more6.2%Top 6.5%46.0priority
- CVE-2023-22232Adobe Connect Improper Access Control Security feature bypassAdobe · ConnectPublic exploitMedium · 5.383.4%Top 0.32%29.3priority
- CVE-2026-103849Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…Adobe · Adobe CommercePublic exploitCritical · 10.01.2%Top 33%27.6priority