{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Adobe vulnerabilities","home_page_url":"https://patchfirst.co/vendor/adobe/","feed_url":"https://patchfirst.co/feed/vendor/adobe.json","description":"New and newly exploited Adobe CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-48356#kev","url":"https://patchfirst.co/cve/CVE-2026-48356/","title":"[KEV] CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","content_text":"Adobe · Commerce and Magento. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 44.6% (higher than 98.8% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter. Priority 78.3 of 100.","summary":"Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T13:34:50.000Z","tags":["kev","public-exploit","T1189","T1059"],"_patchfirst":{"reason":"kev","priority":78.3,"kev":{"dateAdded":"2026-10-27","ransomware":false},"epss":{"score":0.44579,"percentile":0.98767},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento","techniqueIds":["T1189","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-104353","url":"https://patchfirst.co/cve/CVE-2026-104353/","title":"CVE-2026-104353: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…","content_text":"Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 1.3% (higher than 70.4% of CVEs). CVSS 9.9 CRITICAL. Priority 22.1 of 100.","summary":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":22.1,"kev":null,"epss":{"score":0.013,"percentile":0.70416},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Campaign Classic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-104351","url":"https://patchfirst.co/cve/CVE-2026-104351/","title":"CVE-2026-104351: Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability…","content_text":"Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.6% (higher than 47.3% of CVEs). CVSS 9.9 CRITICAL. Priority 17.5 of 100.","summary":"Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.5,"kev":null,"epss":{"score":0.00573,"percentile":0.47334},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Campaign Classic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-104350","url":"https://patchfirst.co/cve/CVE-2026-104350/","title":"CVE-2026-104350: Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability","content_text":"Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.6% (higher than 48.9% of CVEs). CVSS 9.3 CRITICAL. Priority 17.4 of 100.","summary":"Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.4,"kev":null,"epss":{"score":0.00605,"percentile":0.48933},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Campaign Classic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105781","url":"https://patchfirst.co/cve/CVE-2026-105781/","title":"CVE-2026-105781: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","content_text":"Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.5% (higher than 44% of CVEs). CVSS 10.0 CRITICAL. Priority 16.9 of 100.","summary":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.9,"kev":null,"epss":{"score":0.00518,"percentile":0.44037},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Campaign Classic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105780","url":"https://patchfirst.co/cve/CVE-2026-105780/","title":"CVE-2026-105780: Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…","content_text":"Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.5% (higher than 42.1% of CVEs). CVSS 9.9 CRITICAL. Priority 16.4 of 100.","summary":"Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.4,"kev":null,"epss":{"score":0.0049,"percentile":0.42106},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Campaign Classic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105489","url":"https://patchfirst.co/cve/CVE-2026-105489/","title":"CVE-2026-105489: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","content_text":"Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.9 CRITICAL. Priority 16.2 of 100.","summary":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:16:56.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.2,"kev":null,"epss":{"score":0.00476,"percentile":0.41088},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Campaign Classic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-48360","url":"https://patchfirst.co/cve/CVE-2026-48360/","title":"CVE-2026-48360: Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could…","content_text":"Adobe · Adobe Connect Desktop App. Not in CISA KEV. EPSS 0.4% (higher than 39.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.1 of 100.","summary":"Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-29T04:18:38.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.1,"kev":null,"epss":{"score":0.0045,"percentile":0.39121},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Connect Desktop App","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-104354","url":"https://patchfirst.co/cve/CVE-2026-104354/","title":"CVE-2026-104354: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","content_text":"Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.1 CRITICAL. Priority 16.0 of 100.","summary":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T17:17:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16,"kev":null,"epss":{"score":0.00496,"percentile":0.42525},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Campaign Classic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105779","url":"https://patchfirst.co/cve/CVE-2026-105779/","title":"CVE-2026-105779: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","content_text":"Adobe · Adobe Campaign Classic. Not in CISA KEV. EPSS 0.3% (higher than 22.2% of CVEs). CVSS 9.1 CRITICAL. Priority 11.9 of 100.","summary":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command…","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:10:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":11.9,"kev":null,"epss":{"score":0.00295,"percentile":0.22168},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Campaign Classic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-103849","url":"https://patchfirst.co/cve/CVE-2026-103849/","title":"CVE-2026-103849: Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…","content_text":"Adobe · Adobe Commerce. Not in CISA KEV. EPSS 1.2% (higher than 67.4% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 27.6 of 100.","summary":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-20T04:16:50.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":27.6,"kev":null,"epss":{"score":0.0117,"percentile":0.67376},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Commerce","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-103848","url":"https://patchfirst.co/cve/CVE-2026-103848/","title":"CVE-2026-103848: Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…","content_text":"Adobe · Adobe Experience Manager 6.5 LTS. Not in CISA KEV. EPSS 1.4% (higher than 72.6% of CVEs). CVSS 9.9 CRITICAL. Priority 23.6 of 100.","summary":"Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-14T15:50:50.000Z","tags":[],"_patchfirst":{"reason":"published","priority":23.6,"kev":null,"epss":{"score":0.01408,"percentile":0.72597},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager 6.5 LTS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-90531","url":"https://patchfirst.co/cve/CVE-2026-90531/","title":"CVE-2026-90531: Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability…","content_text":"Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 1.4% (higher than 72.5% of CVEs). CVSS 9.6 CRITICAL. Priority 23.4 of 100.","summary":"Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-29T19:02:42.000Z","tags":[],"_patchfirst":{"reason":"published","priority":23.4,"kev":null,"epss":{"score":0.014,"percentile":0.72471},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager as a Cloud Service","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106624","url":"https://patchfirst.co/cve/CVE-2026-106624/","title":"CVE-2026-106624: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result…","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 1.1% (higher than 65.9% of CVEs). CVSS 10.0 CRITICAL. Priority 22.4 of 100.","summary":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T18:29:41.000Z","tags":[],"_patchfirst":{"reason":"published","priority":22.4,"kev":null,"epss":{"score":0.01112,"percentile":0.65948},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105899","url":"https://patchfirst.co/cve/CVE-2026-105899/","title":"CVE-2026-105899: ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 1.0% (higher than 64.1% of CVEs). CVSS 10.0 CRITICAL. Priority 22.0 of 100.","summary":"ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-20T00:12:45.000Z","tags":[],"_patchfirst":{"reason":"published","priority":22,"kev":null,"epss":{"score":0.01044,"percentile":0.6411},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-48383","url":"https://patchfirst.co/cve/CVE-2026-48383/","title":"CVE-2026-48383: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…","content_text":"Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 1.0% (higher than 61.9% of CVEs). CVSS 10.0 CRITICAL. Priority 21.6 of 100.","summary":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-31T00:59:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":21.6,"kev":null,"epss":{"score":0.00972,"percentile":0.61942},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager as a Cloud Service","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-48382","url":"https://patchfirst.co/cve/CVE-2026-48382/","title":"CVE-2026-48382: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…","content_text":"Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 1.0% (higher than 61.9% of CVEs). CVSS 10.0 CRITICAL. Priority 21.6 of 100.","summary":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-30T18:47:22.000Z","tags":[],"_patchfirst":{"reason":"published","priority":21.6,"kev":null,"epss":{"score":0.00972,"percentile":0.61942},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager as a Cloud Service","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-100133","url":"https://patchfirst.co/cve/CVE-2026-100133/","title":"CVE-2026-100133: Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…","content_text":"Adobe · Adobe Commerce. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 9.3 CRITICAL. Priority 21.5 of 100.","summary":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-16T23:16:57.000Z","tags":[],"_patchfirst":{"reason":"published","priority":21.5,"kev":null,"epss":{"score":0.01049,"percentile":0.64227},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Commerce","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-83662","url":"https://patchfirst.co/cve/CVE-2026-83662/","title":"CVE-2026-83662: Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability","content_text":"Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 1.0% (higher than 63.6% of CVEs). CVSS 9.3 CRITICAL. Priority 21.4 of 100.","summary":"Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-31T00:57:03.000Z","tags":[],"_patchfirst":{"reason":"published","priority":21.4,"kev":null,"epss":{"score":0.01026,"percentile":0.63566},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager as a Cloud Service","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106621","url":"https://patchfirst.co/cve/CVE-2026-106621/","title":"CVE-2026-106621: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result…","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.9% (higher than 60.4% of CVEs). CVSS 9.1 CRITICAL. Priority 20.6 of 100.","summary":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T18:30:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.6,"kev":null,"epss":{"score":0.00923,"percentile":0.60364},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-90532","url":"https://patchfirst.co/cve/CVE-2026-90532/","title":"CVE-2026-90532: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…","content_text":"Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 0.8% (higher than 57.4% of CVEs). CVSS 10.0 CRITICAL. Priority 20.6 of 100.","summary":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-29T19:18:57.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.6,"kev":null,"epss":{"score":0.00825,"percentile":0.57363},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager as a Cloud Service","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-91013","url":"https://patchfirst.co/cve/CVE-2026-91013/","title":"CVE-2026-91013: Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…","content_text":"Adobe · Adobe Commerce. Not in CISA KEV. EPSS 0.9% (higher than 59.3% of CVEs). CVSS 9.3 CRITICAL. Priority 20.5 of 100.","summary":"Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-14T19:17:22.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.5,"kev":null,"epss":{"score":0.00888,"percentile":0.59293},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Commerce","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106622","url":"https://patchfirst.co/cve/CVE-2026-106622/","title":"CVE-2026-106622: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.8% (higher than 56.4% of CVEs). CVSS 10.0 CRITICAL. Priority 20.4 of 100.","summary":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T18:30:37.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.4,"kev":null,"epss":{"score":0.00796,"percentile":0.56414},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106630","url":"https://patchfirst.co/cve/CVE-2026-106630/","title":"CVE-2026-106630: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an…","content_text":"Adobe · Adobe Experience Manager 6.5 LTS. Not in CISA KEV. EPSS 0.9% (higher than 58.9% of CVEs). CVSS 9.3 CRITICAL. Priority 20.4 of 100.","summary":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-26T14:28:29.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.4,"kev":null,"epss":{"score":0.00873,"percentile":0.58865},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager 6.5 LTS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106629","url":"https://patchfirst.co/cve/CVE-2026-106629/","title":"CVE-2026-106629: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an…","content_text":"Adobe · Adobe Experience Manager 6.5 LTS. Not in CISA KEV. EPSS 0.9% (higher than 58.9% of CVEs). CVSS 9.3 CRITICAL. Priority 20.4 of 100.","summary":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-26T14:29:04.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.4,"kev":null,"epss":{"score":0.00873,"percentile":0.58865},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager 6.5 LTS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-92909","url":"https://patchfirst.co/cve/CVE-2026-92909/","title":"CVE-2026-92909: Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution…","content_text":"Adobe · Adobe Commerce. Not in CISA KEV. EPSS 0.8% (higher than 56.4% of CVEs). CVSS 9.8 CRITICAL. Priority 20.3 of 100.","summary":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T11:18:04.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.3,"kev":null,"epss":{"score":0.00794,"percentile":0.56372},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Commerce","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-92464","url":"https://patchfirst.co/cve/CVE-2026-92464/","title":"CVE-2026-92464: Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution…","content_text":"Adobe · Adobe Commerce. Not in CISA KEV. EPSS 0.9% (higher than 58.7% of CVEs). CVSS 9.1 CRITICAL. Priority 20.3 of 100.","summary":"Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T11:18:04.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.3,"kev":null,"epss":{"score":0.00867,"percentile":0.58685},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Commerce","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-75732","url":"https://patchfirst.co/cve/CVE-2026-75732/","title":"CVE-2026-75732: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…","content_text":"Adobe · Adobe Experience Manager 6.5 LTS. Not in CISA KEV. EPSS 0.7% (higher than 53.6% of CVEs). CVSS 9.9 CRITICAL. Priority 19.8 of 100.","summary":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-31T00:57:58.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.8,"kev":null,"epss":{"score":0.00713,"percentile":0.53623},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager 6.5 LTS","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105895","url":"https://patchfirst.co/cve/CVE-2026-105895/","title":"CVE-2026-105895: Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code…","content_text":"Adobe · Adobe Experience Manager 6.5. Not in CISA KEV. EPSS 0.7% (higher than 53.4% of CVEs). CVSS 9.9 CRITICAL. Priority 19.8 of 100.","summary":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-26T15:25:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.8,"kev":null,"epss":{"score":0.00707,"percentile":0.53407},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager 6.5","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106626","url":"https://patchfirst.co/cve/CVE-2026-106626/","title":"CVE-2026-106626: Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code…","content_text":"Adobe · Adobe Experience Manager as a Cloud Service. Not in CISA KEV. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 9.1 CRITICAL. Priority 19.4 of 100.","summary":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-26T15:12:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.4,"kev":null,"epss":{"score":0.00737,"percentile":0.54461},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager as a Cloud Service","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-105903","url":"https://patchfirst.co/cve/CVE-2026-105903/","title":"CVE-2026-105903: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result…","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.6% (higher than 50.4% of CVEs). CVSS 9.9 CRITICAL. Priority 19.2 of 100.","summary":"ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-16T20:56:53.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.2,"kev":null,"epss":{"score":0.00634,"percentile":0.50366},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106612","url":"https://patchfirst.co/cve/CVE-2026-106612/","title":"CVE-2026-106612: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in…","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.5% (higher than 44.3% of CVEs). CVSS 9.9 CRITICAL. Priority 18.0 of 100.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-16T17:40:08.000Z","tags":[],"_patchfirst":{"reason":"published","priority":18,"kev":null,"epss":{"score":0.00522,"percentile":0.44303},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106620","url":"https://patchfirst.co/cve/CVE-2026-106620/","title":"CVE-2026-106620: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.4% (higher than 36.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.1 of 100.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T18:42:40.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.1,"kev":null,"epss":{"score":0.00417,"percentile":0.36072},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-90530","url":"https://patchfirst.co/cve/CVE-2026-90530/","title":"CVE-2026-90530: ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.3% (higher than 27.4% of CVEs). CVSS 9.3 CRITICAL. Priority 14.2 of 100.","summary":"ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-14T15:50:50.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.2,"kev":null,"epss":{"score":0.0034,"percentile":0.27436},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-75994","url":"https://patchfirst.co/cve/CVE-2026-75994/","title":"CVE-2026-75994: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in…","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 0.3% (higher than 25.4% of CVEs). CVSS 9.6 CRITICAL. Priority 14.0 of 100.","summary":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-20T19:06:18.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14,"kev":null,"epss":{"score":0.00323,"percentile":0.254},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-71362#kev","url":"https://patchfirst.co/cve/CVE-2026-71362/","title":"[KEV] CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability","content_text":"Adobe · Commerce and Magento . In CISA KEV since 2026-09-24. ENISA EUVD lists it as exploited. EPSS 90.5% (higher than 99.8% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 79.3 of 100.","summary":"Adobe Commerce and Magento Incorrect Authorization Vulnerability","date_published":"2026-09-24T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2026-09-24","ransomware":false},"epss":{"score":0.90491,"percentile":0.99801},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento ","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-75650#kev","url":"https://patchfirst.co/cve/CVE-2026-75650/","title":"[KEV] CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","content_text":"Adobe · Commerce and Magento. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 3.9% (higher than 90.4% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.1 of 100.","summary":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","date_published":"2026-09-08T00:00:00.000Z","date_modified":"2026-09-09T05:18:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.1,"kev":{"dateAdded":"2026-09-08","ransomware":false},"epss":{"score":0.03949,"percentile":0.90401},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-48282#kev","url":"https://patchfirst.co/cve/CVE-2026-48282/","title":"[KEV] CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability","content_text":"Adobe · ColdFusion. In CISA KEV since 2026-07-07. ENISA EUVD lists it as exploited. EPSS 42.4% (higher than 98.7% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.7 of 100.","summary":"Adobe ColdFusion Path Traversal Vulnerability","date_published":"2026-07-07T00:00:00.000Z","date_modified":"2026-10-25T21:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.7,"kev":{"dateAdded":"2026-07-07","ransomware":false},"epss":{"score":0.42388,"percentile":0.98701},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-48313","url":"https://patchfirst.co/cve/CVE-2026-48313/","title":"CVE-2026-48313: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)","content_text":"Adobe · ColdFusion 2025. Not in CISA KEV. EPSS 3.0% (higher than 87.2% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 70.5 of 100.","summary":"ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)","date_published":"2026-06-30T00:00:00.000Z","date_modified":"2026-08-27T22:32:59.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":70.5,"kev":null,"epss":{"score":0.02954,"percentile":0.87165},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"ColdFusion 2025","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-48294","url":"https://patchfirst.co/cve/CVE-2026-48294/","title":"CVE-2026-48294: Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data…","content_text":"Adobe · Adobe Acrobat PDF Extension (Chrome). Not in CISA KEV. EPSS 1.9% (higher than 79.7% of CVEs). CVSS 7.4 HIGH. Priority 68.7 of 100.","summary":"Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data…","date_published":"2026-06-16T00:00:00.000Z","date_modified":"2026-06-16T20:59:39.000Z","tags":[],"_patchfirst":{"reason":"published","priority":68.7,"kev":null,"epss":{"score":0.01906,"percentile":0.79717},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Adobe Acrobat PDF Extension (Chrome)","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2009-3459#kev","url":"https://patchfirst.co/cve/CVE-2009-3459/","title":"[KEV] CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability","content_text":"Adobe · Acrobat and Reader. In CISA KEV since 2026-05-20. ENISA EUVD lists it as exploited. EPSS 86.6% (higher than 99.74% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1203 Exploitation for Client Execution; T1204.002 Malicious File. Priority 69.1 of 100.","summary":"Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability","date_published":"2026-05-20T00:00:00.000Z","date_modified":"2026-06-16T23:11:38.000Z","tags":["kev","public-exploit","T1203","T1204.002"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2026-05-20","ransomware":false},"epss":{"score":0.86646,"percentile":0.9974},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Acrobat and Reader","techniqueIds":["T1203","T1204.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-9715#kev","url":"https://patchfirst.co/cve/CVE-2020-9715/","title":"[KEV] CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability","content_text":"Adobe · Acrobat. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 33.5% (higher than 98.4% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 73.1 of 100.","summary":"Adobe Acrobat Use-After-Free Vulnerability","date_published":"2026-04-13T00:00:00.000Z","date_modified":"2026-06-17T03:28:26.000Z","tags":["kev","public-exploit","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":73.1,"kev":{"dateAdded":"2026-04-13","ransomware":false},"epss":{"score":0.33491,"percentile":0.98377},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Acrobat","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-34621#kev","url":"https://patchfirst.co/cve/CVE-2026-34621/","title":"[KEV] CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability","content_text":"Adobe · Acrobat and Reader. In CISA KEV since 2026-04-13. ENISA EUVD lists it as exploited. EPSS 7.2% (higher than 94.3% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1203 Exploitation for Client Execution. Priority 72.9 of 100.","summary":"Adobe Acrobat and Reader Prototype Pollution Vulnerability","date_published":"2026-04-13T00:00:00.000Z","date_modified":"2026-10-26T21:10:00.000Z","tags":["kev","public-exploit","T1204.002","T1203"],"_patchfirst":{"reason":"kev","priority":72.9,"kev":{"dateAdded":"2026-04-13","ransomware":false},"epss":{"score":0.0723,"percentile":0.94317},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Acrobat and Reader","techniqueIds":["T1204.002","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-54236#kev","url":"https://patchfirst.co/cve/CVE-2025-54236/","title":"[KEV] CVE-2025-54236: Adobe Commerce and Magento Improper Input Validation Vulnerability","content_text":"Adobe · Commerce and Magento. In CISA KEV since 2025-10-24. ENISA EUVD lists it as exploited. EPSS 95.4% (higher than 99.87% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1550 Use Alternate Authentication Material. Priority 69.3 of 100.","summary":"Adobe Commerce and Magento Improper Input Validation Vulnerability","date_published":"2025-10-24T00:00:00.000Z","date_modified":"2026-06-17T09:39:41.000Z","tags":["kev","public-exploit","T1190","T1550"],"_patchfirst":{"reason":"kev","priority":69.3,"kev":{"dateAdded":"2025-10-24","ransomware":false},"epss":{"score":0.95353,"percentile":0.99867},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Commerce and Magento","techniqueIds":["T1190","T1550"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-54253#kev","url":"https://patchfirst.co/cve/CVE-2025-54253/","title":"[KEV] CVE-2025-54253: Adobe Experience Manager Forms Code Execution Vulnerability","content_text":"Adobe · Experience Manager (AEM) Forms. In CISA KEV since 2025-10-15. ENISA EUVD lists it as exploited. EPSS 88.8% (higher than 99.78% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 70.0 of 100.","summary":"Adobe Experience Manager Forms Code Execution Vulnerability","date_published":"2025-10-15T00:00:00.000Z","date_modified":"2026-06-17T09:39:43.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":70,"kev":{"dateAdded":"2025-10-15","ransomware":false},"epss":{"score":0.8877,"percentile":0.99775},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Experience Manager (AEM) Forms","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-54249","url":"https://patchfirst.co/cve/CVE-2025-54249/","title":"CVE-2025-54249: Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)","content_text":"Adobe · Adobe Experience Manager. Not in CISA KEV. EPSS 1.9% (higher than 79.9% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. Priority 60.5 of 100.","summary":"Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)","date_published":"2025-09-09T00:00:00.000Z","date_modified":"2025-09-09T17:09:21.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":60.5,"kev":null,"epss":{"score":0.01923,"percentile":0.79904},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-54251","url":"https://patchfirst.co/cve/CVE-2025-54251/","title":"CVE-2025-54251: Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)","content_text":"Adobe · Adobe Experience Manager. Not in CISA KEV. EPSS 1.7% (higher than 77.3% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. Priority 58.5 of 100.","summary":"Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)","date_published":"2025-09-09T00:00:00.000Z","date_modified":"2025-09-30T22:19:30.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":58.5,"kev":null,"epss":{"score":0.01709,"percentile":0.773},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-54254","url":"https://patchfirst.co/cve/CVE-2025-54254/","title":"CVE-2025-54254: Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)","content_text":"Adobe · Adobe Experience Manager. Not in CISA KEV. EPSS 70.1% (higher than 99.38% of CVEs). CVSS 8.6 HIGH. Priority 63.2 of 100.","summary":"Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)","date_published":"2025-08-05T00:00:00.000Z","date_modified":"2025-08-22T16:33:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":63.2,"kev":null,"epss":{"score":0.70112,"percentile":0.99377},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2025-49533","url":"https://patchfirst.co/cve/CVE-2025-49533/","title":"CVE-2025-49533: Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)","content_text":"Adobe · Adobe Experience Manager (MS). Not in CISA KEV. EPSS 51.7% (higher than 98.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 67.3 of 100.","summary":"Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)","date_published":"2025-07-08T00:00:00.000Z","date_modified":"2026-02-26T17:51:02.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.3,"kev":null,"epss":{"score":0.51682,"percentile":0.98945},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Adobe","product":"Adobe Experience Manager (MS)","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-43566","url":"https://patchfirst.co/cve/CVE-2025-43566/","title":"CVE-2025-43566: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)","content_text":"Adobe · ColdFusion. Not in CISA KEV. EPSS 58.2% (higher than 99.09% of CVEs). CVSS 6.8 MEDIUM. Priority 24.6 of 100.","summary":"ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)","date_published":"2025-05-13T00:00:00.000Z","date_modified":"2025-05-14T14:11:39.000Z","tags":[],"_patchfirst":{"reason":"published","priority":24.6,"kev":null,"epss":{"score":0.58199,"percentile":0.99091},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}