829
CVEs
60
Critical
371
High
4
KEV
12
PoC
423
Unpatched C/H
1.4%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
60
HIGH
371
MEDIUM
386
LOW
12
Monthly CVE Trend
Affected Products (30)
Acrobat Reader Dc
1644
Acrobat Dc
1644
Acrobat
1117
Experience Manager
1109
Flash Player
895
Acrobat Reader
814
Air Sdk
407
Magento
373
Air
365
Air Sdk Compiler
363
Reader
351
Flash Player Desktop Runtime
292
Coldfusion
180
Experience Manager Cloud Service
175
Commerce
169
Indesign
154
Illustrator
138
Bridge
121
Enterprise Linux Desktop
121
Enterprise Linux Workstation
121
After Effects
116
Framemaker
115
Enterprise Linux Server
112
Dimension
112
Opensuse
107
Adobe Air
104
Animate
99
Commerce B2b
98
Adobe Air Sdk
96
Photoshop
88
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75650 | Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators. | CRITICAL | 10.0 | 0.7% | 126 |
KEV
PoC
No patch
|
| CVE-2026-48282 | Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or access files outside intended directories and achieve arbitrary code execution in the context of the current user. Rated CVSS 10.0 with a changed scope and no user interaction required, this is among the most severe ColdFusion flaws possible. No public exploit identified at time of analysis, but the impact and trivial attack complexity make it a top patching priority. | CRITICAL | 10.0 | 1.0% | 121 |
KEV
PoC
No patch
|
| CVE-2026-34621 | Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execution in user context via malicious PDF files. Attack requires user interaction to open a crafted document. CVSS 9.6 (Critical) reflects network-deliverable code execution with scope change, though EPSS 0.24% (46th percentile) suggests moderate real-world exploitation probability. No public exploit identified at time of analysis. | HIGH | 8.6 | 0.2% | 118 |
KEV
PoC
No patch
|
| CVE-2026-45247 | Remote code execution in Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 allows unauthenticated attackers to execute arbitrary code by sending a crafted serialized PHP object in the CacheWarmer cookie. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and successful exploitation chains Magento and dependency gadget chains via an unsafe call to unserialize(). Despite a low EPSS score (0.10%), KEV listing and CVSS 9.3 indicate this is a high-priority patch for any Magento 2 store running the module. | CRITICAL | 9.3 | 0.1% | 117 |
KEV
PoC
|
| CVE-2026-48356 | Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin lets a remote attacker run script in the context of a victim's authenticated session by abusing an unrestricted file-upload flaw (CWE-434). Because the impact executes in the current user's browser/session context and requires the victim to visit a crafted URL or compromised page, the outcome is account/session takeover and privilege escalation rather than direct server compromise. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the EPSS score of 28.32% (98th percentile) signals meaningfully elevated exploitation likelihood for a newly disclosed flaw. | CRITICAL | 9.3 | 28.3% | 75 |
No patch
|
| CVE-2026-48276 | Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a file of a dangerous type (e.g., a CFML/JSP payload) and execute it in the context of the current user, with no user interaction required. The CVSS 3.1 base score is the maximum 10.0 with a changed scope, reflecting that successful exploitation breaches the ColdFusion process boundary. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but ColdFusion's history of weaponized file-upload/RCE bugs makes this a high-priority patch. | CRITICAL | 10.0 | 0.9% | 71 |
PoC
No patch
|
| CVE-2026-48313 | Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary files outside the intended web scope and perform limited writes, with no user interaction required. The scope-change (S:C) and high confidentiality impact drive a 9.3 critical rating, meaning a successful read can expose secrets - configuration, credentials, and source - that compromise components beyond ColdFusion itself. No public exploit is identified at time of analysis and the issue is not in CISA KEV, but ColdFusion's history of weaponized path-traversal and file-disclosure bugs makes prompt patching prudent. | CRITICAL | 9.3 | 0.5% | 67 |
PoC
No patch
|
| CVE-2026-53787 | Unauthenticated arbitrary file upload in Amasty Order Attributes for Magento 2 before 4.0.0 lets remote attackers drop arbitrary files into the store's media directory without authentication, session validation, or cart context. Where the media directory permits PHP execution, this escalates to unauthenticated remote code execution; otherwise it enables stored XSS via HTML/SVG, malware hosting, and path-traversal writes outside the intended directory. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and trivial preconditions make this a high-priority issue for any Magento 2 store running the extension. | CRITICAL | 9.3 | 0.2% | 67 |
PoC
|
| CVE-2026-71362 | Privilege escalation in Adobe Commerce and Magento Open Source (including Adobe Commerce B2B) lets a remote attacker gain elevated access to sensitive resources through an incorrect authorization flaw, with no user interaction required. All supported branches from 2.4.4 through 2.4.9 (and B2B 1.3.3-1.5.3) prior to the August 2026 patch set are affected, and the CVSS 9.1 rating reflects high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an unauthenticated, low-complexity authorization bypass in a widely deployed storefront platform it warrants urgent patching. | CRITICAL | 9.1 | 0.5% | 66 |
PoC
No patch
|
| CVE-2026-27809 | Integer overflow in psd-tools Python library before 1.12.2 when processing malformed RLE-compressed PSD files leads to heap overflow. PoC and patch available. | CRITICAL | 9.1 | 0.0% | 66 |
PoC
|
| CVE-2026-54071 | Arbitrary Python code execution in BabelDOC (funstory-ai, pip package `babeldoc`) prior to 0.6.3 allows an attacker to run code in the context of the translation process by having a victim process a crafted PDF. The vendored pdfminer CMap loader (`cmapdb.py::_load_data`) strips only NUL bytes from a PDF-controlled CMap/Encoding name and passes it to `pickle.loads()`, so a hex-encoded absolute path in the PDF's `/Encoding` name redirects deserialization to an attacker-planted `.pickle.gz` file. A detailed, working proof-of-concept exists (publicly available exploit code exists); there is no CISA KEV listing and no public evidence of active exploitation at time of analysis. | HIGH | 7.8 | 0.1% | 59 |
PoC
|
| CVE-2026-48318 | Path traversal in Adobe ColdFusion allows an authenticated remote attacker (PR:L) to read arbitrary files outside the intended web/application scope by manipulating pathname input, per Adobe advisory APSB26-82. The flaw carries a critical 9.9 CVSS with a changed scope, meaning a successful read can reach files belonging to other security contexts on the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided. | CRITICAL | 9.9 | 6.7% | 56 |
No patch
|
| CVE-2026-47992 | SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged authenticated attacker to inject malicious SQL that can escalate to arbitrary code execution in the context of the current user, enabling account/session takeover. The flaw (CWE-89) is network-reachable and requires no user interaction, but demands existing high privileges per the CVSS PR:H metric. No public exploit is identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided. | HIGH | 7.2 | 19.6% | 56 |
No patch
|
| CVE-2026-47996 | Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plugin allows a high-privileged, authenticated attacker to defeat an authorization check (CWE-863) and gain unauthorized read access to data that should be restricted. The flaw is network-reachable with low complexity, requires no user interaction, and changes scope, so the exposure can reach beyond the initially vulnerable component. There is no public exploit identified at time of analysis and no CISA KEV listing, making exploitation currently theoretical rather than observed. | MEDIUM | 6.8 | 18.5% | 53 |
No patch
|
| CVE-2026-48362 | OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential. | CRITICAL | 10.0 | 2.1% | 52 |
No patch
|