Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ColdFusion 2025 — Vulnerabilities & Security Advisories 96

All 96 CVE vulnerabilities found in ColdFusion 2025, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumeration (CWE) vulnerabilities associated with Adobe ColdFusion 2025. It serves as a comprehensive resource for security researchers and administrators seeking to understand the specific threat landscape surrounding this enterprise application server platform. The content encompasses a wide spectrum of security flaws, including injection attacks, cross-site scripting, server-side request forgery, and improper access control issues that have been identified within the software. This collection covers vulnerability data reported from initial release through recent years, ensuring a historical perspective on the product's security evolution. By consulting this aggregated data, users can effectively track vendor advisories and patch releases issued by Adobe to address critical flaws. Furthermore, individuals can analyze trends related to specific weakness classes to better comprehend the nature of defects in this environment. The page also allows for a detailed lookup of the product’s vulnerability history, providing context on recurring issues and the effectiveness of long-term security fixes. This structured approach facilitates informed decision-making regarding system hardening and upgrade paths. Users interested in the specific technical details of how these weaknesses manifest in ColdFusion 2025 will find relevant categorizations and references here. The goal is to provide a clear, non-promotional overview of known security issues to support proactive defense strategies and compliance monitoring.

Vendor: Adobe

CVE ID Title CVSS Severity Published
CVE-2026-105897 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 8.6 High 2026-10-13
CVE-2026-106616 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) CWE-611 8.6 High 2026-10-13
CVE-2026-34633 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 7.7 High 2026-10-13
CVE-2026-106618 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 8.8 High 2026-10-13
CVE-2026-105994 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 7.7 High 2026-10-13
CVE-2026-106622 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 10.0 Critical 2026-10-13
CVE-2026-106619 ColdFusion | Improper Input Validation (CWE-20) CWE-20 9.0 Critical 2026-10-13
CVE-2026-106089 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 8.8 High 2026-10-13
CVE-2026-106613 ColdFusion | Improper Input Validation (CWE-20) CWE-20 8.8 High 2026-10-13
CVE-2026-106614 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 7.8 High 2026-10-13
CVE-2026-106624 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) CWE-94 10.0 Critical 2026-10-13
CVE-2026-75996 ColdFusion | Uncontrolled Resource Consumption (CWE-400) CWE-400 7.5 High 2026-10-13
CVE-2026-106621 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) CWE-94 9.1 Critical 2026-10-13
CVE-2026-90530 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 9.3 Critical 2026-10-13
CVE-2026-105898 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 8.2 High 2026-10-13
CVE-2026-75994 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 9.6 Critical 2026-10-13
CVE-2026-105903 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) CWE-94 9.9 Critical 2026-10-13
CVE-2026-106090 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 8.8 High 2026-10-13
CVE-2026-106620 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 9.6 Critical 2026-10-13
CVE-2026-34634 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 8.6 High 2026-10-13
CVE-2026-76001 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 7.1 High 2026-10-13
CVE-2026-106612 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 9.9 Critical 2026-10-13
CVE-2026-106615 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 8.8 High 2026-10-13
CVE-2026-75995 ColdFusion | Improper Input Validation (CWE-20) CWE-20 8.4 High 2026-10-13
CVE-2026-75748 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 7.6 High 2026-10-13
CVE-2026-105900 ColdFusion | Improper Input Validation (CWE-20) CWE-20 7.5 High 2026-10-13
CVE-2026-105901 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 8.8 High 2026-10-13
CVE-2026-71385 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 8.4 High 2026-10-13
CVE-2026-105899 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) CWE-434 10.0 Critical 2026-10-13
CVE-2026-106623 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 7.5 High 2026-10-13

All 96 known CVE vulnerabilities affecting ColdFusion 2025 with full Chinese analysis, references, and POCs where available.