Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe Photoshop Desktop contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS score is 5.5, indicating medium severity.
Adobe Photoshop Desktop contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The severity is rated medium with a CVSS score of 5.5.
Adobe Photoshop Desktop contains an out-of-bounds write vulnerability (CWE-787) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS 3.1 base score is 7.8, indicating high severity.
In October 2026, a large-scale cyberattack targeted French supermarket refrigeration systems, remotely raising temperatures to 50°C and causing food spoilage, fires, and sprinkler floods. The attack exploited legacy Danfoss refrigeration controllers (AK-SM800 and AK-SC355) that no longer receive security updates. These controllers were accessible via the internet, allowing attackers to force defrost cycles and disrupt food preservation across hundreds of stores. The incident caused significant financial losses and operational disruption. The exact attack vector remains undisclosed, but known vulnerabilities in unsupported firmware versions were previously documented. Recovery efforts are ongoing, with long-term impacts expected.
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe ColdFusion 2025 contains an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CVE-2026-106616) that allows an attacker to read arbitrary files on the system. This vulnerability can be exploited remotely without user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.6. Exploitation changes the security scope and could lead to disclosure of sensitive information. No official patch or remediation details are provided in the available data.
Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34633) that allows a low-privileged attacker to escalate privileges by making unauthorized internal requests. Exploitation does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and can lead to high confidentiality impact without affecting integrity or availability.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security features and gain unauthorized write access without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the impact is changed, indicating that the vulnerability affects resources beyond the initial security boundary.
Adobe ColdFusion 2025 contains a critical Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-106622) that allows an attacker to escalate privileges without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to full confidentiality, integrity, and availability compromise.
Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that could allow an attacker to execute arbitrary code with the privileges of the current user. The vulnerability does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control. The vulnerability has a critical severity with a CVSS score of 9.0.
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue could lead to full compromise of confidentiality, integrity, and availability in the context of the current user.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control and results in a changed scope. The issue has a high severity with a CVSS score of 7.8.
Adobe ColdFusion 2025 contains a critical code injection vulnerability (CVE-2026-106624) that allows an attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue results from improper control of code generation, enabling arbitrary code execution in the context of the current user. The vulnerability has a maximum CVSS score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability.
Adobe ColdFusion 2025 contains an Uncontrolled Resource Consumption vulnerability (CWE-400) that can lead to application denial-of-service. This vulnerability allows an attacker to exhaust system resources without requiring user interaction, causing the application to become unavailable. The issue affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability has a high severity rating with a CVSS score of 7.5.
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
Adobe ColdFusion 2025 contains a critical path traversal vulnerability (CVE-2026-90530) in its Remote Development Services (RDS) feature. This flaw allows an attacker to read arbitrary files on the file system outside the intended restricted directories without requiring user interaction. The vulnerability affects ColdFusion versions up to 2025.0.13 and 2023.0.25. RDS is intended only for development and is disabled when ColdFusion is set to Production Secure Profile. Disabling RDS or running ColdFusion in Production Secure Profile mitigates the risk.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to high impact on confidentiality, integrity, and availability.
