{"schema_version":"1","data":[{"id":2976,"advisory_id":"643076d7-3edd-4606-afdd-2ebf4bd1d65c","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-15961","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:27:01.592047+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2018-15961"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Unrestricted File Upload Vulnerability","summary":"Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2018-15961","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-15961","aliases":["CVE-2018-15961"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-434"],"cveID":"CVE-2018-15961","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-15961","dueDate":"2022-05-03","product":"ColdFusion","dateAdded":"2021-11-03","vendorProject":"Adobe","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.","vulnerabilityName":"Adobe ColdFusion Unrestricted File Upload Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2018-15961","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2975,"advisory_id":"1fa67a11-0d70-45c4-abd2-521d4d92f76f","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-4939","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:27:00.986018+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2018-4939"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2018-4939","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-4939","aliases":["CVE-2018-4939"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2018-4939","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-4939","dueDate":"2022-05-03","product":"ColdFusion","dateAdded":"2021-11-03","vendorProject":"Adobe","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.","vulnerabilityName":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2018-4939","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2855,"advisory_id":"aa26f2d1-a9fd-41bb-bb4a-e09198070e97","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0632","source_published_at":"2022-03-03T00:00:00+00:00","published_at":"2026-10-24T21:25:47.367452+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2013-0632"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Authentication Bypass Vulnerability","summary":"An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2013-0632","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2013-0632","aliases":["CVE-2013-0632"],"affected":[],"modified":"2022-03-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-200"],"cveID":"CVE-2013-0632","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0632","dueDate":"2022-03-24","product":"ColdFusion","dateAdded":"2022-03-03","vendorProject":"Adobe","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.","vulnerabilityName":"Adobe ColdFusion Authentication Bypass Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2013-0632","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2777,"advisory_id":"e71587a3-a591-464b-8f93-53e5617a3652","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0629","source_published_at":"2022-03-07T00:00:00+00:00","published_at":"2026-10-24T21:24:06.055792+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2013-0629"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Directory Traversal Vulnerability","summary":"Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2013-0629","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2013-0629","aliases":["CVE-2013-0629"],"affected":[],"modified":"2022-03-07T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-264"],"cveID":"CVE-2013-0629","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0629","dueDate":"2022-09-07","product":"ColdFusion","dateAdded":"2022-03-07","vendorProject":"Adobe","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.","vulnerabilityName":"Adobe ColdFusion Directory Traversal Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2013-0629","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2776,"advisory_id":"8b449f13-1d8c-4f07-9c3d-873b20655a19","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0625","source_published_at":"2022-03-07T00:00:00+00:00","published_at":"2026-10-24T21:24:05.497234+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2013-0625"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Authentication Bypass Vulnerability","summary":"Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2013-0625","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2013-0625","aliases":["CVE-2013-0625"],"affected":[],"modified":"2022-03-07T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-255"],"cveID":"CVE-2013-0625","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0625","dueDate":"2022-09-07","product":"ColdFusion","dateAdded":"2022-03-07","vendorProject":"Adobe","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.","vulnerabilityName":"Adobe ColdFusion Authentication Bypass Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2013-0625","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2774,"advisory_id":"61871a72-312b-4387-a40a-e969391c70cf","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0631","source_published_at":"2022-03-07T00:00:00+00:00","published_at":"2026-10-24T21:24:04.339989+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2013-0631"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Information Disclosure Vulnerability","summary":"Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2013-0631","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2013-0631","aliases":["CVE-2013-0631"],"affected":[],"modified":"2022-03-07T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-200"],"cveID":"CVE-2013-0631","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0631","dueDate":"2022-09-07","product":"ColdFusion","dateAdded":"2022-03-07","vendorProject":"Adobe","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.","vulnerabilityName":"Adobe ColdFusion Information Disclosure Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2013-0631","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":2747,"advisory_id":"be3f959e-4661-4902-a5c8-eb29b6cd1540","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-2861","source_published_at":"2022-03-25T00:00:00+00:00","published_at":"2026-10-24T21:23:48.951277+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2010-2861"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Directory Traversal Vulnerability","summary":"A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2010-2861","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2010-2861","aliases":["CVE-2010-2861"],"affected":[],"modified":"2022-03-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-22"],"cveID":"CVE-2010-2861","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-2861","dueDate":"2022-04-15","product":"ColdFusion","dateAdded":"2022-03-25","vendorProject":"Adobe","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.","vulnerabilityName":"Adobe ColdFusion Directory Traversal Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2010-2861","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1362,"advisory_id":"67219529-14c1-4b8d-86bb-9b6614501593","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-26360","source_published_at":"2023-03-15T00:00:00+00:00","published_at":"2026-10-24T21:01:41.333043+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2023-26360"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2023-26360","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-26360","aliases":["CVE-2023-26360"],"affected":[],"modified":"2023-03-15T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-284"],"cveID":"CVE-2023-26360","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-26360","dueDate":"2023-04-05","product":"ColdFusion","dateAdded":"2023-03-15","vendorProject":"Adobe","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.","vulnerabilityName":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2023-26360","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1282,"advisory_id":"850b48e7-2b6e-4713-a7c5-9079b1f4e521","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-38205","source_published_at":"2023-07-20T00:00:00+00:00","published_at":"2026-10-24T20:59:10.518553+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2023-38205"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Improper Access Control Vulnerability","summary":"Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2023-38205","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-38205","aliases":["CVE-2023-38205"],"affected":[],"modified":"2023-07-20T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-284"],"cveID":"CVE-2023-38205","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html ;  https://nvd.nist.gov/vuln/detail/CVE-2023-38205","dueDate":"2023-08-10","product":"ColdFusion","dateAdded":"2023-07-20","vendorProject":"Adobe","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.","vulnerabilityName":"Adobe ColdFusion Improper Access Control Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2023-38205","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1281,"advisory_id":"30278202-5a25-45de-84a0-0ac0e06af7a1","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29298","source_published_at":"2023-07-20T00:00:00+00:00","published_at":"2026-10-24T20:59:09.947623+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2023-29298"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Improper Access Control Vulnerability","summary":"Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2023-29298","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-29298","aliases":["CVE-2023-29298"],"affected":[],"modified":"2023-07-20T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-284"],"cveID":"CVE-2023-29298","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://nvd.nist.gov/vuln/detail/CVE-2023-29298","dueDate":"2023-08-10","product":"ColdFusion","dateAdded":"2023-07-20","vendorProject":"Adobe","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.","vulnerabilityName":"Adobe ColdFusion Improper Access Control Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2023-29298","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1272,"advisory_id":"3849abb6-0e4b-431c-a5df-81bd94fbe864","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-26359","source_published_at":"2023-08-21T00:00:00+00:00","published_at":"2026-10-24T20:59:04.62309+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2023-26359"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2023-26359","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-26359","aliases":["CVE-2023-26359"],"affected":[],"modified":"2023-08-21T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2023-26359","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-26359","dueDate":"2023-09-11","product":"ColdFusion","dateAdded":"2023-08-21","vendorProject":"Adobe","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.","vulnerabilityName":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2023-26359","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1200,"advisory_id":"722cddba-cedc-4795-a45c-47681e9d3376","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-38203","source_published_at":"2024-01-08T00:00:00+00:00","published_at":"2026-10-24T20:58:19.133569+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2023-38203"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2023-38203","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-38203","aliases":["CVE-2023-38203"],"affected":[],"modified":"2024-01-08T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2023-38203","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html ;  https://nvd.nist.gov/vuln/detail/CVE-2023-38203","dueDate":"2024-01-29","product":"ColdFusion","dateAdded":"2024-01-08","vendorProject":"Adobe","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.","vulnerabilityName":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2023-38203","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1199,"advisory_id":"0fc2a00f-7221-4b7a-9aa0-fd1ded1f93ba","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29300","source_published_at":"2024-01-08T00:00:00+00:00","published_at":"2026-10-24T20:57:33.12197+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2023-29300"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","summary":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2023-29300","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-29300","aliases":["CVE-2023-29300"],"affected":[],"modified":"2024-01-08T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2023-29300","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://nvd.nist.gov/vuln/detail/CVE-2023-29300","dueDate":"2024-01-29","product":"ColdFusion","dateAdded":"2024-01-08","vendorProject":"Adobe","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.","vulnerabilityName":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2023-29300","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1026,"advisory_id":"9404395c-f627-4ec1-aafc-369e1873e40b","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-20767","source_published_at":"2024-12-16T00:00:00+00:00","published_at":"2026-10-24T20:55:00.165486+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2024-20767"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Improper Access Control Vulnerability","summary":"Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2024-20767","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2024-20767","aliases":["CVE-2024-20767"],"affected":[],"modified":"2024-12-16T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-284"],"cveID":"CVE-2024-20767","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-20767","dueDate":"2025-01-06","product":"ColdFusion","dateAdded":"2024-12-16","vendorProject":"Adobe","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.","vulnerabilityName":"Adobe ColdFusion Improper Access Control Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2024-20767","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":480,"advisory_id":"a81cfb32-86d9-45eb-bbd9-92b95a09ffb0","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-3066","source_published_at":"2025-02-24T00:00:00+00:00","published_at":"2026-10-24T20:46:39.417493+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2017-3066"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Deserialization Vulnerability","summary":"Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2017-3066","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-3066","aliases":["CVE-2017-3066"],"affected":[],"modified":"2025-02-24T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2017-3066","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html ; https://nvd.nist.gov/vuln/detail/CVE-2017-3066","dueDate":"2025-03-17","product":"ColdFusion","dateAdded":"2025-02-24","vendorProject":"Adobe","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.","vulnerabilityName":"Adobe ColdFusion Deserialization Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2017-3066","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":128,"advisory_id":"78479bc1-44b5-4337-81df-a6e8dd019df4","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48282","source_published_at":"2026-07-07T00:00:00+00:00","published_at":"2026-10-24T20:41:25.093209+00:00","extraction_method":"structured","technologies":["coldfusion","core-kev"],"cve_ids":["CVE-2026-48282"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Adobe ColdFusion Path Traversal Vulnerability","summary":"Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-48282","products":[{"name":{"value":"ColdFusion","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-48282","aliases":["CVE-2026-48282"],"affected":[],"modified":"2026-07-07T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-22"],"cveID":"CVE-2026-48282","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48282","dueDate":"2026-07-10","product":"ColdFusion","dateAdded":"2026-07-07","vendorProject":"Adobe","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.","vulnerabilityName":"Adobe ColdFusion Path Traversal Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-48282","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}}],"next_after":2976,"next_before":128}