203
CVEs
9
Critical
68
High
1
KEV
2
PoC
77
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
9
HIGH
68
MEDIUM
125
LOW
1
Monthly CVE Trend
Affected Products (30)
Acrobat Reader Dc
1644
Acrobat Dc
1644
Acrobat
1117
Experience Manager
1109
Flash Player
895
Acrobat Reader
814
Air Sdk
407
Magento
372
Air
365
Air Sdk Compiler
363
Reader
351
Flash Player Desktop Runtime
292
Coldfusion
179
Experience Manager Cloud Service
175
Commerce
168
Indesign
154
Illustrator
138
Bridge
121
Enterprise Linux Workstation
121
Enterprise Linux Desktop
121
After Effects
116
Framemaker
115
Enterprise Linux Server
112
Dimension
112
Opensuse
107
Adobe Air
104
Animate
98
Commerce B2b
97
Adobe Air Sdk
96
Air Desktop Runtime
87
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75650 | Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators. | CRITICAL | 10.0 | 0.7% | 126 |
KEV
PoC
No patch
|
| CVE-2026-76197 | OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands, achieving code execution in the context of the current user with a scope change that extends impact beyond the vulnerable component. Adobe (the reporting vendor) rates this maximum severity CVSS 10.0 (CWE-78), and exploitation requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a vendor-disclosed, not-yet-actively-exploited critical flaw. | CRITICAL | 10.0 | 1.5% | 51 |
No patch
|
| CVE-2026-76195 | Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker run arbitrary commands in the context of the running user. The flaw is rated CVSS 10.0 with a network attack vector, no privileges, no user interaction, and a scope change reaching the underlying host. No public exploit identified at time of analysis, but the maximal score and unauthenticated network reach make it a top-tier patching priority. | CRITICAL | 10.0 | 1.5% | 51 |
No patch
|
| CVE-2026-82004 | OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to execute arbitrary code in the context of the running user with no user interaction. Adobe PSIRT rates this a maximum-severity CVSS 10.0 issue with a changed scope, meaning a successful exploit can affect resources beyond the vulnerable component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 10.0 | 1.4% | 51 |
No patch
|
| CVE-2026-76193 | Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the only reference is an Adobe advisory (APSB26-134) served from an internal, non-public host and could not be independently verified. | CRITICAL | 10.0 | 0.6% | 51 |
No patch
|
| CVE-2026-19232 | Privilege escalation to arbitrary code execution in Adobe Experience Manager (AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2) lets a low-privileged authenticated attacker abuse an incorrect-authorization flaw to execute code and take over a victim's account or session without any user interaction. Because the CVSS scope is changed, the impact extends beyond the vulnerable component. Adobe (PSIRT) rated it 9.9 critical and shipped a fix in APSB26-98; no public exploit is identified at time of analysis. | CRITICAL | 9.9 | 0.6% | 50 |
No patch
|
| CVE-2026-48273 | Remote code execution in Adobe ColdFusion 2023 (update ≤23) and ColdFusion 2025 (update ≤12) allows a low-privileged, authenticated attacker to inject directives into dynamically evaluated code (CWE-95, 'Eval Injection') and execute arbitrary code in the context of the current user without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 9.9) reflects a network-reachable, low-complexity flaw with a scope change, meaning code executes beyond the initially authorized security context. No public exploit is identified at time of analysis, but ColdFusion RCE flaws are historically high-value targets and are frequently weaponized quickly after disclosure. | CRITICAL | 9.9 | 1.7% | 50 |
No patch
|
| CVE-2026-79622 | Path traversal in dekdee's adobe-xd-mcp 1.0.0 exposes the server filesystem to remote unauthenticated attackers via unsanitized `outputFile` and `outputDir` parameters in the `file-access-from-request` endpoint of `src/parsers/xd-parser.ts`. A public proof-of-concept exploit is available through the project's GitHub issue tracker, and no patch has been released - the vendor has not responded to the disclosure. With a CVSS 4.0 score of 6.9, public exploit code (E:P), and no mitigating authentication requirement, any network-exposed instance is immediately at risk. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-76200 | Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B (versions through the August 2026 builds of 2.4.4-2.4.9 / B2B 1.3.3-1.5.3) lets an attacker persist malicious JavaScript into vulnerable form fields that later executes in a victim's browser. Because the CVSS scope is changed, the injected script runs beyond the injection context and can hijack the victim's session or account, and CVSS:3.1 PR:N indicates the injection requires no attacker authentication while UI:R means a victim must load the affected page. No public exploit is identified at time of analysis, and the flaw was reported privately by Adobe PSIRT under APSB26-138. | CRITICAL | 9.3 | 0.8% | 46 |
No patch
|
| CVE-2026-76201 | Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B lets a remote attacker persist malicious JavaScript in vulnerable form fields that later executes in a victim's browser when they view the affected page. Successful exploitation can hijack the victim's session or account, and because scope is changed (S:C) the payload can affect resources beyond the vulnerable component - for example an admin session viewing attacker-supplied content. Adobe PSIRT rates it 9.3 Critical; no public exploit identified at time of analysis and it is not in CISA KEV. | CRITICAL | 9.3 | 0.8% | 46 |
No patch
|
| CVE-2026-81996 | Privilege escalation in Adobe Acrobat Reader and Adobe Acrobat (all editions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows a low-privileged local attacker to gain full elevated access via an Incorrect Authorization flaw (CWE-863). The CVSS scope-change indicator (S:C) with C:H/I:H/A:H confirms the vulnerability crosses a privilege boundary beyond Acrobat's own security domain - almost certainly compromising the underlying OS context. No user interaction is required, enabling silent exploitation once a foothold is established. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-77111 | Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows a high-privileged attacker to bypass access control boundaries and perform unauthorized writes to resources outside their intended scope, with the scope change (S:C) amplifying impact to components beyond the directly vulnerable module. All supported branches of Adobe Commerce (2.4.4-2.4.9), Magento Open Source (2.4.6-2.4.9), and Commerce B2B (1.3.3-1.5.3) prior to the August 2026 security patch cycle are affected. No public exploit or CISA KEV listing is identified at time of analysis; exploitation requires an already-authenticated admin-level session. | HIGH | 8.7 | 0.5% | 44 |
No patch
|
| CVE-2026-76190 | Eval injection (CWE-95) in Adobe ColdFusion 2023 (≤Update 23) and ColdFusion 2025 (≤Update 12) enables unauthenticated, network-based arbitrary code execution without user interaction. User-supplied input reaching a dynamic code evaluation function is processed without sanitization, allowing injected CFML or Java expressions to execute server-side as the application user. The CVSS scope-change metric (S:C) indicates the impact can extend beyond the ColdFusion process itself; Adobe PSIRT issued formal advisory APSB26-119. No public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.6 | 1.0% | 44 |
No patch
|
| CVE-2026-76199 | Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution when a victim opens a maliciously crafted file. The vulnerability affects Photoshop 2026 versions up to and including 27.6 and Photoshop 2025 versions up to and including 26.11.6, with scope change indicating code execution can escape the Photoshop process boundary. No public exploit identified at time of analysis; Adobe has released patches via APSB26-130. | HIGH | 8.6 | 0.2% | 43 |
No patch
|
| CVE-2026-77109 | Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows unauthenticated remote attackers to escalate privileges and gain write access to restricted platform resources without user interaction. Scope change is confirmed: successful exploitation crosses privilege boundaries within the Commerce platform, granting access to administrative or otherwise protected functionality. SSVC classifies technical impact as total and the attack as automatable, elevating operational priority despite no active exploitation currently recorded in CISA KEV. | HIGH | 8.6 | 0.4% | 43 |
No patch
|