Adobe vulnerabilities80 known to be exploited.
Adobe has 6,632 published vulnerabilities across 342 products in our catalogue. 80 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Acrobat Reader Dc, with 1,761. If you run Adobe software, patch the exploited flaws first.
The most recent Adobe flaw added to the known-exploited list is CVE-2026-48356, on 27 October 2026. We keep watching the known-exploited list.
Which Adobe products have the most vulnerabilities?
Acrobat Reader Dc leads with 1,761 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Adobe vulnerabilities are being exploited?
80 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.3Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated...
- 10.0Adobe ColdFusion Path Traversal Vulnerability
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
- 8.8Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
- 7.8Adobe Acrobat Use-After-Free Vulnerability
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
- 9.1Adobe Commerce and Magento Improper Input Validation Vulnerability
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
- 10.0Adobe Experience Manager Forms Code Execution Vulnerability
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
- 9.8Adobe ColdFusion Deserialization Vulnerability
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
- 7.4Adobe ColdFusion Improper Access Control Vulnerability
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
Which Adobe flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via...
- >99%
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string...
- >99%
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1)...
- >99%
Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before...
- 97%
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a...
- 94%
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in...
- 93%
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password...
- 93%CVE-2007-0071Critical
Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a...
- 91%
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute...
- 90%
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0,...
All Adobe products we track.
318 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Acrobat Dcacrobat_dc1,761 vulnerabilities235 versions
- Acrobat Reader Dcacrobat_reader_dc1,761 vulnerabilities233 versions
- Acrobatacrobat1,339 vulnerabilities253 versions
- Flash Playerflash_player1,084 vulnerabilities435 versions
- Acrobat Readeracrobat_reader1,067 vulnerabilities230 versions
- Experience Managerexperience_manager925 vulnerabilities157 versions
- Airair413 vulnerabilities42 versions
- Air SDKair_sdk409 vulnerabilities27 versions
- Air SDK & Compilerair_sdk_\&_compiler365 vulnerabilities20 versions
- Readerreader360 vulnerabilities93 versions
- Flash Player Desktop Runtimeflash_player_desktop_runtime294 vulnerabilities36 versions
- Experience Manager Cloud Serviceexperience_manager_cloud_service183 vulnerabilities3 versions
- Coldfusioncoldfusion177 vulnerabilities24 versions
- Shockwave Playershockwave_player174 vulnerabilities77 versions
- Indesignindesign163 vulnerabilities75 versions
- Adobe Airadobe_air146 vulnerabilities65 versions
- Illustratorillustrator146 vulnerabilities84 versions
- Commercecommerce141 vulnerabilities17 versions
- Bridgebridge127 vulnerabilities44 versions
- Magentomagento118 vulnerabilities18 versions
- Dimensiondimension114 vulnerabilities16 versions
- After Effectsafter_effects104 vulnerabilities42 versions
- Animateanimate102 vulnerabilities39 versions
- Adobe Air SDKadobe_air_sdk96 vulnerabilities29 versions
This directory lists the 318 Adobe products with at least one tracked version, of 342 in our catalogue.
Running Adobe? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
- Matched to
- Commerce on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 6,632 published vulnerabilities across 342 products and 4,434 versions from Adobe. The most recent Adobe flaw added to the known-exploited list is CVE-2026-48356, on 27 October 2026.
80 Adobe vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-48356, CVE-2026-48282 and CVE-2009-3459. The full list is on this page.
Acrobat Reader Dc, with 1,761 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Adobe products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.