Vulnerabilidades de Adobe

CVE-2026-48365 Alta · 7.8 CWE-787 14/07/2026

Audition | Out-of-bounds Write (CWE-787)

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-48309 Alta · 7.8 CWE-787 14/07/2026

Audition | Out-of-bounds Write (CWE-787)

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-47969 Média · 5.5 CWE-125 14/07/2026

Audition | Out-of-bounds Read (CWE-125)

Audition is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-47968 Alta · 7.8 CWE-787 14/07/2026

Audition | Out-of-bounds Write (CWE-787)

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-47967 Alta · 7.8 CWE-787 14/07/2026

Audition | Out-of-bounds Write (CWE-787)

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-48364 Alta · 8.2 CWE-427 13/07/2026

ColdFusion | Uncontrolled Search Path Element (CWE-427)

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVE-2026-48363 Alta · 8.2 CWE-427 13/07/2026

ColdFusion | Uncontrolled Search Path Element (CWE-427)

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVE-2026-48267 Média · 5.5 CWE-476 06/07/2026

DNG SDK | NULL Pointer Dereference (CWE-476)

DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-48316 Crítica · 10.0 CWE-20 06/07/2026

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-48315 Crítica · 9.3 CWE-20 30/06/2026

Adobe ColdFusion: validação imprópria de entrada (CVE-2026-48315)

As versões 2025.9, 2023.20 e anteriores do ColdFusion são afetadas por uma vulnerabilidade de Validação Imprópria de Entrada que poderia resultar em execução arbitrária de código no contexto do usuário atual. Um atacante poderia explorar esta vulnerabilidade para injetar scripts maliciosos em uma página web, potencialmente obtendo acesso elevado ou controle sobre a conta ou sessão da vítima. A exploração deste problema requer interação do usuário, pois uma vítima deve abrir um arquivo malicioso. O escopo é alterado.

CVE-2026-48314 Média · 6.5 CWE-22 30/06/2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain limited read and write access to unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.

CVE-2026-48313 Crítica · 9.3 Exploit público CWE-22 30/06/2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-48307 Alta · 8.8 CWE-79 30/06/2026

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is changed.

CVE-2026-48286 Crítica · 10.0 CWE-863 30/06/2026

Adobe Campaign Classic: falha de autorização incorreta (CWE-863)

As versões 7.4.3 build 9396 e anteriores do Adobe Campaign Classic (ACC) são afetadas por uma vulnerabilidade de Autorização Incorreta que poderia resultar em execução arbitrária de código no contexto do usuário atual. A exploração desse problema não requer interação do usuário. O escopo é alterado.

CVE-2026-48285 Alta · 8.6 CWE-918 30/06/2026

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-48283 Crítica · 10.0 CWE-434 30/06/2026

Adobe ColdFusion: upload irrestrito de arquivo com risco de execução de código (CVE-2026-48283)

O ColdFusion nas versões 2025.9, 2023.20 e anteriores é afetado por uma vulnerabilidade de Upload Irrestrito de Arquivo com Tipo Perigoso, que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração dessa falha não requer interação do usuário. O escopo é alterado.

CVE-2026-48281 Crítica · 10.0 CWE-20 30/06/2026

Adobe ColdFusion: validação de entrada inadequada com execução de código (CVE-2026-48281)

As versões 2025.9, 2023.20 e anteriores do ColdFusion são afetadas por uma vulnerabilidade de Validação de Entrada Inadequada que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração desse problema não requer interação do usuário. O escopo é alterado.

CVE-2026-48277 Crítica · 10.0 CWE-20 30/06/2026

Validação Imprópria de Entrada no Adobe ColdFusion (CVE-2026-48277)

As versões 2025.9, 2023.20 e anteriores do ColdFusion são afetadas por uma vulnerabilidade de Validação Imprópria de Entrada que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração desse problema não requer interação do usuário. O escopo é alterado.

CVE-2026-48276 Crítica · 10.0 CWE-434 30/06/2026

Upload irrestrito de arquivo perigoso no Adobe ColdFusion leva à execução arbitrária de código (CVE-2026-48276)

As versões 2025.9, 2023.20 e anteriores do ColdFusion são afetadas por uma vulnerabilidade de Upload irrestrito de arquivo com tipo perigoso, que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração desse problema não requer interação do usuário. O escopo é alterado.

CVE-2026-48282 Crítica · 10.0 KEV Urgente · 73 Exploit público CWE-22 30/06/2026

Adobe ColdFusion Path Traversal Vulnerability

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2020-9713 Média · 5.5 CWE-125 23/06/2026

Acrobat Reader | Out-of-bounds Read (CWE-125)

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2020-9711 Média · 5.5 CWE-125 23/06/2026

Acrobat Reader | Out-of-bounds Read (CWE-125)

Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2020-9695 Alta · 7.8 CWE-787 23/06/2026

Acrobat Reader | Out-of-bounds Write (CWE-787)

Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-48294 Alta · 7.4 CWE-79 17/06/2026

Cross-site Scripting (XSS) em Adobe Acrobat

Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVE-2026-47964 Alta · 7.8 CWE-122 16/06/2026

DNG SDK | Heap-based Buffer Overflow (CWE-122)

DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.