Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2026-71362 — Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
|
Adobe | Commerce and Magento | Sep 24, 2026 | Sep 27, 2026 | |
|
CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
|
Adobe | Commerce and Magento | Sep 8, 2026 | Sep 11, 2026 | |
|
CVE-2026-48282 — Adobe ColdFusion Path Traversal Vulnerability
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
|
Adobe | ColdFusion | Jul 7, 2026 | Jul 10, 2026 | |
|
CVE-2009-3459 — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
|
Adobe | Acrobat and Reader | May 20, 2026 | Jun 3, 2026 | |
|
CVE-2020-9715 — Adobe Acrobat Use-After-Free Vulnerability
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
|
Adobe | Acrobat | Apr 13, 2026 | Apr 27, 2026 | |
|
CVE-2026-34621 — Adobe Acrobat and Reader Prototype Pollution Vulnerability
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
|
Adobe | Acrobat and Reader | Apr 13, 2026 | Apr 27, 2026 | |
|
CVE-2025-54236 — Adobe Commerce and Magento Improper Input Validation Vulnerability
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
|
Adobe | Commerce and Magento | Oct 24, 2025 | Nov 14, 2025 | |
|
CVE-2025-54253 — Adobe Experience Manager Forms Code Execution Vulnerability
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
|
Adobe | Experience Manager (AEM) Forms | Oct 15, 2025 | Nov 5, 2025 | |
|
CVE-2017-3066 — Adobe ColdFusion Deserialization Vulnerability
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
|
Adobe | ColdFusion | Feb 24, 2025 | Mar 17, 2025 | |
|
CVE-2024-20767 — Adobe ColdFusion Improper Access Control Vulnerability
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
|
Adobe | ColdFusion | Dec 16, 2024 | Jan 6, 2025 |
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
Commerce and Magento · Sep 24, 2026
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
Commerce and Magento · Sep 8, 2026
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
ColdFusion · Jul 7, 2026
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
Acrobat and Reader · May 20, 2026
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
Acrobat · Apr 13, 2026
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
Acrobat and Reader · Apr 13, 2026
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
Commerce and Magento · Oct 24, 2025
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
Experience Manager (AEM) Forms · Oct 15, 2025
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
ColdFusion · Feb 24, 2025
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
ColdFusion · Dec 16, 2024