Read the docs

Adobe

Records8047All Threatist records
Exploited (KEV)83In CISA KEV
CVSS critical1940CVSS 9.0–10.0
CVSS high3102CVSS 7.0–8.9

Exploited now

Adobe records in CISA KEV
TI-2026-35762 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-50010 Adobe Commerce and Magento Incorrect Authorization Vulnerability Priority CRITICAL 98KEV 2026-09-24TI-2026-52938 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability Priority CRITICAL 100KEV 2026-09-08TI-2026-35688 Adobe ColdFusion Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-07-07TI-2009-03297 Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 97KEV 2026-05-20TI-2020-07801 Adobe Acrobat Use-After-Free Vulnerability Priority CRITICAL 93KEV 2026-04-13

Components

Products in the NVD configurations · select one to filter the records
Acrobat Dc 1832 records CRITICAL Acrobat Reader Dc 1832 records CRITICAL Acrobat 1414 records CRITICAL Experience Manager 1299 records HIGH Acrobat Reader 1085 records CRITICAL Flash Player 1084 records CRITICAL Air 413 records CRITICAL Air Sdk 409 records CRITICAL

Records

8 records in Experience Manager Forms · all components

TI-2025-34084 CVE-2025-54253 · GHSA-7mcc-8f7p-x6v7

Adobe Experience Manager | Incorrect Authorization (CWE-863)

Priority CRITICAL 100KEV

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.80848 Published 2025-08-05 No fix listed CWE-863
TI-2020-07818 CVE-2020-9732 · GHSA-xmq3-w762-fqmr

Stored XSS in AEM Sites Components

Priority MEDIUM 44

The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.02809 Published 2020-09-10 No fix listed CWE-79
TI-2017-02287 CVE-2017-3067 · GHSA-p56m-rmx6-qqvf

Information disclosure in Adobe Experience Manager Forms 6.2, 6.1, 6.0

Priority MEDIUM 41

Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04791 Published 2017-05-09 No fix listed CWE-200
TI-2020-07819 CVE-2020-9733 · GHSA-wrr9-hwhq-cmwg

Sensitive information disclosure possible in AEM

Priority LOW 39

An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03751 Published 2020-09-10 No fix listed CWE-200
TI-2019-05048 CVE-2019-7129 · GHSA-jvjw-24q3-xphj

Cross-site scripting in Adobe Experience Manager Forms

Priority LOW 31

Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01626 Published 2019-05-29 No fix listed CWE-79
TI-2019-05762 CVE-2019-8089 · GHSA-pp5v-p8x7-m4g8

Cross-site scripting in Adobe Experience Manager Forms

Priority LOW 30

Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01498 Published 2019-10-22 No fix listed CWE-79
Open these records in search →