CVE-2026-106089

ColdFusion is affected by an Incorrect Authorization vulnerability (CWE-863) that could lead to arbitrary code execution within the context of the current user. A low-privileged attacker can exploit this issue without requiring any user interaction. The provided documents do not specify the exact...

CVE-2026-106613 ColdFusion | Improper Input Validation (CWE-20)

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-106613

Adobe ColdFusion is affected by an Improper Input Validation vulnerability (CWE-20). This flaw allows a low-privileged attacker to execute arbitrary code within the context of the current user. Exploitation does not require any user interaction. Specific technical details regarding the vulnerable...

EUVD-2026-100664

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...

CVE-2026-106624 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...

CVE-2026-106614 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control...

CVE-2026-106624

ColdFusion is affected by an Improper Control of Generation of Code (Code Injection) vulnerability (CWE-94). This flaw allows an attacker to execute arbitrary code within the context of the current user. The vulnerability can be exploited remotely without any user interaction. While the descripti...

CVE-2026-106621 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...

CVE-2026-106621

ColdFusion is affected by an Improper Control of Generation of Code (Code Injection) vulnerability (CWE-94). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Notably, the exploitation of this vulnerability does not require any user inte...

EUVD-2026-100517

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a...

CVE-2026-90530 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...

CVE-2026-90530 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...

CVE-2026-105898 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a...

EUVD-2026-100518

ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...

CVE-2026-90530

ColdFusion RDS is vulnerable to a path traversal vulnerability (CWE-22) due to improper limitation of pathnames to a restricted directory. This flaw could allow an attacker to perform arbitrary file system reads , accessing sensitive files and directories outside the intended scope. The vulnerabi...

CVE-2026-105898

ColdFusion is affected by an Incorrect Authorization vulnerability (CWE-863) that could lead to arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this issue, though the attack requires user interaction to open a malicious file. The impact is charac...

CVE-2026-105903 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue doe...

CVE-2026-105903

Adobe ColdFusion is affected by an Improper Control of Generation of Code (Code Injection) vulnerability (CWE-94). This flaw allows a low-privileged attacker to execute arbitrary code in the context of the current user without any user interaction. The vulnerability is reachable via the network a...

CVE-2026-75994 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by...

CVE-2026-106090

ColdFusion is affected by an Incorrect Authorization vulnerability (CWE-863). A low-privileged attacker could exploit this flaw to achieve arbitrary code execution within the context of the current user. This vulnerability does not require any user interaction. While the documentation confirms th...