Vendor
Adobe vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 1,059 vulnerabilities in Adobe: 107 in the last 7 days and 454 in the last 90 days, 209 of them critical and 84 exploited in the wild. The most recent, CVE-2026-123341, was published on 10 November 2026. 190 vulnerabilities in the last four weeks, up 258% on the four before (53). 34 critical against 25. 80 technologies have a page of their own.
- Last 7 days
- 107
- Last 90 days
- 454
- Critical, all time
- 209
- Exploited in the wild
- 84
About Adobe
American software company that develops creative, document, and digital marketing applications.
Adobe technologies
- Adobe ColdFusion95
- Adobe Experience Manager74
- Adobe Commerce72
- Adobe Acrobat65
- Adobe Acrobat Reader60
- Adobe Flash Player56
- Adobe AIR55
- Adobe C2pa52
- Adobe C2pa-Web51
- Adobe Content Credentials Rust SDK44
- Adobe Content Credentials JS SDK42
- Adobe Acrobat DC41
- Adobe Connect41
- Adobe Acrobat Reader DC39
- Adobe C2patool38
- Adobe Substance 3d Stager38
- Adobe Campaign Classic37
- Adobe After Effects36
- Adobe C2PA Tool36
- Adobe Bridge34
- Adobe InDesign34
- Adobe Reader32
- Adobe Substance 3D Designer32
- Adobe Magento Open Source31
- Adobe Illustrator25
- Adobe Photoshop 202625
- Adobe Photoshop 202524
- Adobe Audition23
- Adobe Commerce B2B23
- Adobe Substance 3D Painter23
- Adobe Magento Enterprise Edition22
- Adobe Premiere Pro20
- Adobe Substance 3D Sampler20
- Adobe Substance3D Designer17
- Adobe Substance3D Painter15
- Adobe DNG SDK14
- Adobe Experience Manager Cloud Service14
- Adobe Photoshop14
- Adobe Commerce Webhooks Plugin13
- Adobe Content Credentials SDK13
- Adobe Dng Software Development Kit13
- Adobe FrameMaker13
- Adobe Magento13
- Adobe Media Encoder13
- Adobe Substance3D Sampler13
- Adobe Substance3D Stager13
- Adobe Dimension12
- Adobe Content Credentials Command-Line Tool12
- Adobe Experience Manager 6.512
- Adobe Experience Manager as a Cloud Service12
- Adobe Format Plugins12
- Adobe Substance 3d Modeler12
- Adobe C2pa-Rs11
- Adobe Content Credentials Rust SDK (c2pa)11
- Adobe Experience Manager 6.5 LTS11
- Adobe Substance3D Modeler11
- Adobe Connect For Mobile9
- Adobe Dreamweaver9
- Adobe Experience Manager Forms JEE9
- Adobe FrameMaker 20229
- Adobe FrameMaker 20269
- Adobe Lightroom9
- Adobe Lightroom Classic9
- Adobe InCopy8
- Adobe Photoshop Desktop8
- Adobe Animate7
- Adobe C2PA Tool (c2patool)7
- Adobe C2pa-Rust6
- Adobe ColdFusion 20236
- Adobe ColdFusion 20256
- Adobe Connect Desktop Application6
- Adobe Photoshop 20276
- Adobe Content Credentials5
- Adobe Illustrator On Ipad5
- Adobe Bridge (LTS)4
- Adobe Experience Manager Screens4
- Adobe Substance 3d Viewer4
- Adobe CAI Content Credentials3
- Adobe Content Authenticity SDK (c2pa-web)3
- Adobe Creative Cloud Desktop3
Latest Adobe vulnerabilities
- CVE-2026-123341: Adobe Experience Manager reflected XSSmediumCVSS 5.4
- CVE-2026-123267: Adobe Content Credentials SDK path traversal in file writemediumCVSS 5.5
- CVE-2026-123262: Adobe Content Credentials SDK improper verification of cryptographic signaturemediumCVSS 5.9
- CVE-2026-123261: Adobe Content Credentials SDK improper cryptographic signature verificationmediumCVSS 5.9
- CVE-2026-123260: Adobe Content Credentials SDK improper input validation in security featuremediumCVSS 4
- CVE-2026-123259: Adobe Experience Manager stored XSS in form fieldsmediumCVSS 5.4
- CVE-2026-123258: Adobe Experience Manager incorrect authorization leading to code executionmediumCVSS 5.4
- CVE-2026-122102: Adobe Connect stored cross-site scripting in form fieldshighCVSS 8.7
- CVE-2026-122100: Adobe Content Credentials SDK improper cryptographic signature verificationmediumCVSS 5.5
- CVE-2026-122098: Adobe Content Credentials SDK improper certificate validationmediumCVSS 5.1
- CVE-2026-122097: Adobe Content Credentials SDK uncontrolled resource consumption denial-of-servicemediumCVSS 6.5
- CVE-2026-121913: Adobe Connect incorrect authorization privilege escalationhighCVSS 8.8
- CVE-2026-121912: Adobe Connect cross-site scripting in form fieldsmediumCVSS 5.4
- CVE-2026-121910: Adobe Connect multiple critical vulnerabilitiesmediumCVSS 5.4
- CVE-2026-121908: Adobe Connect SQL injectioncriticalCVSS 9.9
- CVE-2026-121906: Adobe Connect path traversal vulnerabilitycriticalCVSS 9.9
- CVE-2026-121904: Adobe Connect stored cross-site scripting vulnerabilitycriticalCVSS 9.6
- CVE-2026-121902: Adobe Connect SQL injection in authenticationcriticalCVSS 9.4
- CVE-2026-121900: Adobe Connect SQL injection vulnerabilityhighCVSS 8.3
- CVE-2026-121898: Adobe Connect SQL injection in arbitrary code executioncriticalCVSS 9.9
- CVE-2026-121896: Adobe Connect SQL injection in database accesscriticalCVSS 9.9
- CVE-2026-121894: Adobe Connect SQL injectioncriticalCVSS 9.9
- CVE-2026-121892: Adobe Connect code injection vulnerabilitycriticalCVSS 9.9
- CVE-2026-121890: Adobe Connect XXE vulnerability leading to arbitrary file readhighCVSS 7.7
- CVE-2026-121889: Adobe Connect server-side request forgery privilege escalationcriticalCVSS 10
Most severe Adobe vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2008-4250: Microsoft Windows buffer overflow in Server servicecriticalexploited in the wildCVSS 10EPSS 93.5%
- CVE-2025-54253: Adobe Experience Manager Forms remote code executioncriticalexploited in the wildCVSS 10EPSS 19.7%
- CVE-2026-75650: Adobe Commerce and Magento improper neutralization in template enginecriticalexploited in the wildCVSS 10EPSS 4.0%
- CVE-2026-48282: Adobe ColdFusion path traversal in multiple versionscriticalexploited in the wildCVSS 10EPSS 1.0%
- CVE-2014-8439: Adobe Flash Player Dereferenced Pointer Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2014-9163: Adobe Flash Player Stack-Based Buffer Overflow Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2017-3066: Adobe ColdFusion Deserialization Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2014-0497: Adobe Flash Player Integer Underflow Vulnerablitycriticalexploited in the wildCVSS 9.8
- CVE-2023-38203: Adobe ColdFusion Deserialization of Untrusted Data Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2023-29300: Adobe ColdFusion Deserialization of Untrusted Data Vulnerabilitycriticalexploited in the wildCVSS 9.8
Vulnerabilities per week
190 vulnerabilities in the last four weeks, up 258% on the four before (53). 34 critical against 25. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 41 | 3 | |
| 31 Aug 2026 | 2 | 0 | |
| 7 Sep 2026 | 61 | 6 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 53 | 25 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 175 | 25 | |
| 19 Oct 2026 | 2 | 0 | |
| 26 Oct 2026 | 13 | 9 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 107 | 21 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Adobe vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/adobe)<a href="https://junglewise.ai/threats/vendors/adobe"><img src="https://junglewise.ai/threats/vendors/adobe/badge.svg" alt="Adobe vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/adobe.json, and this page as text at https://junglewise.ai/threats/vendors/adobe.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Adobe vulnerabilities", https://junglewise.ai/threats/vendors/adobe, 13 November 2026.