Adobe vulnerabilities
- Adobe has 2,889 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #5 of 420 vendors on this site by that count.
- Of the 2,889 with a CVSS score, 1,172 (40.6%) are rated critical or high; 0 (0% of all) have no CVSS score.
- 83 vulnerabilities attributed to Adobe are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2026-48356, was added on 27 Oct 2026.
- 11 of them (13.3%) are marked as known to be used in ransomware campaigns.
- For the 83 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 2,515 days.
Records are attributed to Adobe from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 353 |
| 2018 | 387 |
| 2019 | 703 |
| 2020 | 349 |
| 2021 | 432 |
| 2022 | 460 |
| 2023 | 681 |
| 2024 | 753 |
| 2025 | 829 |
| 2026 | 1,009 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 1,009 | 108 | 465 | 56.8% | 0% |
| 2025 | 829 | 25 | 275 | 36.2% | 0% |
| 2024 | 753 | 14 | 237 | 33.3% | 0% |
| 2023 | 681 | 12 | 259 | 39.8% | 0% |
| 2022 | 460 | 9 | 262 | 58.9% | 0% |
| 2021 | 432 | 20 | 246 | 61.6% | 0% |
| 2020 | 349 | 8 | 57 | 69.1% | 73.1% |
| 2019 | 703 | 1 | 2 | 42.9% | 99% |
| 2018 | 387 | 6 | 6 | 85.7% | 96.4% |
| 2017 | 353 | 1 | 2 | 100% | 99.2% |
| Before 2017 | 1,824 | ||||
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-48356 | Commerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 2026-10-27 | Unknown |
| CVE-2026-71362 | Commerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 2026-09-24 | Unknown |
| CVE-2026-75650 | Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 2026-09-08 | Unknown |
| CVE-2026-48282 | ColdFusion | Adobe ColdFusion Path Traversal Vulnerability | 2026-07-07 | Unknown |
| CVE-2009-3459 | Acrobat and Reader | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | 2026-05-20 | Unknown |
| CVE-2020-9715 | Acrobat | Adobe Acrobat Use-After-Free Vulnerability | 2026-04-13 | Unknown |
| CVE-2026-34621 | Acrobat and Reader | Adobe Acrobat and Reader Prototype Pollution Vulnerability | 2026-04-13 | Unknown |
| CVE-2025-54236 | Commerce and Magento | Adobe Commerce and Magento Improper Input Validation Vulnerability | 2025-10-24 | Unknown |
| CVE-2025-54253 | Experience Manager (AEM) Forms | Adobe Experience Manager Forms Code Execution Vulnerability | 2025-10-15 | Unknown |
| CVE-2017-3066 | ColdFusion | Adobe ColdFusion Deserialization Vulnerability | 2025-02-24 | Unknown |
| CVE-2024-20767 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2024-12-16 | Unknown |
| CVE-2013-0643 | Flash Player | Adobe Flash Player Incorrect Default Permissions Vulnerability | 2024-09-17 | Unknown |
| CVE-2013-0648 | Flash Player | Adobe Flash Player Code Execution Vulnerability | 2024-09-17 | Unknown |
| CVE-2014-0497 | Flash Player | Adobe Flash Player Integer Underflow Vulnerablity | 2024-09-17 | Unknown |
| CVE-2014-0502 | Flash Player | Adobe Flash Player Double Free Vulnerablity | 2024-09-17 | Unknown |
| CVE-2024-34102 | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | 2024-07-17 | Unknown |
| CVE-2023-29300 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2024-01-08 | Known |
| CVE-2023-38203 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2024-01-08 | Known |
| CVE-2023-21608 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2023-10-10 | Unknown |
| CVE-2023-26369 | Acrobat and Reader | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | 2023-09-14 | Unknown |
| CVE-2023-26359 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2023-08-21 | Unknown |
| CVE-2023-29298 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2023-07-20 | Unknown |
| CVE-2023-38205 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2023-07-20 | Unknown |
| CVE-2023-26360 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2023-03-15 | Unknown |
| CVE-2007-5659 | Acrobat and Reader | Adobe Acrobat and Reader Buffer Overflow Vulnerability | 2022-06-08 | Unknown |
| CVE-2008-0655 | Acrobat and Reader | Adobe Acrobat and Reader Unspecified Vulnerability | 2022-06-08 | Unknown |
| CVE-2009-1862 | Acrobat and Reader, Flash Player | Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | 2022-06-08 | Unknown |
| CVE-2009-3953 | Acrobat and Reader | Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | 2022-06-08 | Unknown |
| CVE-2009-4324 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2022-06-08 | Unknown |
| CVE-2010-1297 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-06-08 | Unknown |
| CVE-2010-2883 | Acrobat and Reader | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | 2022-06-08 | Unknown |
| CVE-2011-0609 | Flash Player | Adobe Flash Player Unspecified Vulnerability | 2022-06-08 | Unknown |
| CVE-2011-2462 | Reader and Acrobat | Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability | 2022-06-08 | Unknown |
| CVE-2012-0754 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-06-08 | Unknown |
| CVE-2012-0767 | Flash Player | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | 2022-06-08 | Unknown |
| CVE-2012-5054 | Flash Player | Adobe Flash Player Integer Overflow Vulnerability | 2022-06-08 | Unknown |
| CVE-2018-4990 | Acrobat and Reader | Adobe Acrobat and Reader Double Free Vulnerability | 2022-06-08 | Unknown |
| CVE-2014-0546 | Reader and Acrobat | Adobe Reader and Acrobat Sandbox Bypass Vulnerability | 2022-05-25 | Unknown |
| CVE-2014-8439 | Flash Player | Adobe Flash Player Dereferenced Pointer Vulnerability | 2022-05-25 | Unknown |
| CVE-2015-0310 | Flash Player | Adobe Flash Player ASLR Bypass Vulnerability | 2022-05-25 | Unknown |
| CVE-2015-8651 | Flash Player | Adobe Flash Player Integer Overflow Vulnerability | 2022-05-25 | Unknown |
| CVE-2016-0984 | Flash Player and AIR | Adobe Flash Player and AIR Use-After-Free Vulnerability | 2022-05-25 | Unknown |
| CVE-2016-1010 | Flash Player and AIR | Adobe Flash Player and AIR Integer Overflow Vulnerability | 2022-05-25 | Unknown |
| CVE-2018-5002 | Flash Player | Adobe Flash Player Stack-based Buffer Overflow Vulnerability | 2022-05-23 | Unknown |
| CVE-2014-9163 | Flash Player | Adobe Flash Player Stack-Based Buffer Overflow Vulnerability | 2022-04-13 | Unknown |
| CVE-2015-0311 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 2022-04-13 | Unknown |
| CVE-2015-0313 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | Unknown |
| CVE-2015-3113 | Flash Player | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | 2022-04-13 | Unknown |
| CVE-2015-5122 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | Unknown |
| CVE-2015-5123 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | Unknown |
| CVE-2012-2034 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-03-28 | Unknown |
| CVE-2013-2729 | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability | 2022-03-28 | Unknown |
| CVE-2009-0927 | Reader and Acrobat | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability | 2022-03-25 | Unknown |
| CVE-2010-2861 | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 2022-03-25 | Known |
| CVE-2016-4171 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 2022-03-25 | Unknown |
| CVE-2016-7892 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-03-25 | Unknown |
| CVE-2009-3960 | BlazeDS | Adobe BlazeDS Information Disclosure Vulnerability | 2022-03-07 | Known |
| CVE-2013-0625 | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 2022-03-07 | Unknown |
| CVE-2013-0629 | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 2022-03-07 | Unknown |
| CVE-2013-0631 | ColdFusion | Adobe ColdFusion Information Disclosure Vulnerability | 2022-03-07 | Unknown |
| CVE-2008-2992 | Acrobat and Reader | Adobe Reader and Acrobat Input Validation Vulnerability | 2022-03-03 | Known |
| CVE-2010-0188 | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability | 2022-03-03 | Known |
| CVE-2011-0611 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2012-1535 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 | Unknown |
| CVE-2013-0632 | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 2022-03-03 | Unknown |
| CVE-2013-0640 | Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | 2022-03-03 | Unknown |
| CVE-2013-0641 | Reader | Adobe Reader Buffer Overflow Vulnerability | 2022-03-03 | Unknown |
| CVE-2013-3346 | Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | 2022-03-03 | Unknown |
| CVE-2014-0496 | Reader and Acrobat | Adobe Reader and Acrobat Use-After-Free Vulnerability | 2022-03-03 | Unknown |
| CVE-2015-3043 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-03-03 | Unknown |
| CVE-2015-5119 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-03-03 | Unknown |
| CVE-2015-7645 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 | Known |
| CVE-2016-1019 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 | Known |
| CVE-2016-4117 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 | Known |
| CVE-2016-7855 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-03-03 | Unknown |
| CVE-2017-11292 | Flash Player | Adobe Flash Player Type Confusion Vulnerability | 2022-03-03 | Unknown |
| CVE-2018-15982 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-02-15 | Known |
| CVE-2022-24086 | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | 2022-02-15 | Unknown |
| CVE-2018-15961 | ColdFusion | Adobe ColdFusion Unrestricted File Upload Vulnerability | 2021-11-03 | Unknown |
| CVE-2018-4878 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2021-11-03 | Known |
| CVE-2018-4939 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-21017 | Acrobat and Reader | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-28550 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2021-11-03 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Adobe records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2024-34102 | 100% | 100% | Critical | Yes |
| CVE-2023-29300 | 100% | 100% | Critical | Yes |
| CVE-2018-15961 | 100% | 100% | Critical | Yes |
| CVE-2014-0497 | 99.9% | 100% | High | Yes |
| CVE-2015-3113 | 99.8% | 100% | High | Yes |
| CVE-2008-2992 | 99.8% | 100% | High | Yes |
| CVE-2023-29298 | 99.8% | 100% | High | Yes |
| CVE-2023-38205 | 99.8% | 100% | High | Yes |
| CVE-2010-2861 | 99.7% | 100% | High | Yes |
| CVE-2011-0611 | 99.4% | 99.9% | High | Yes |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.