Threat database

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to execute arbitrary code with the privileges of the current user. The vulnerable component is by default restricted to an administrative network zone. Exploitation does not require user interaction and changes the security scope. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The CVSS score is 9.6, indicating critical severity.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34634) that can lead to privilege escalation without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS score is 8.6, reflecting a high severity issue with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security controls and gain unauthorized write access without user interaction. This vulnerability affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and has a critical severity with a CVSS score of 9.6.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-76001) that allows a low-privileged attacker to potentially escalate privileges by accessing internal resources. The vulnerability does not require user interaction but depends on conditions outside the attacker's control. It affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and has a high severity rating.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerable component is typically restricted to an administrative network zone. This vulnerability changes the security scope and can lead to full compromise of confidentiality, integrity, and availability.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-75748) that allows an attacker with high privileges to escalate access to internal resources without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and has a high severity rating with a CVSS score of 7.6.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that can be exploited to cause an application denial-of-service (DoS). This vulnerability allows an attacker to crash the application without requiring any user interaction. The issue affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity rating with a CVSS score of 7.5.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerable component is by default restricted to an administrative network zone. This vulnerability changes the security scope and can lead to full compromise of the affected system.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that may allow an attacker to disclose sensitive memory information without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue has a high severity with a CVSS score of 7.5, indicating a significant confidentiality impact but no integrity or availability impact.

ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Xorbits Xoscar versions 0.1.0 through 0.11.2 contain an unauthenticated deserialization vulnerability. This flaw allows remote attackers to execute arbitrary code by sending specially crafted data over the actor-pool TCP channel. The vulnerability arises because the server uses cloudpickle.loads() on unvalidated data received via SocketChannel.recv(), triggering execution of pickle __reduce__ gadgets before message type validation. This can lead to remote code execution with the privileges of the server process, which often runs as root on GPU nodes.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 contain a vulnerability related to deserialization of untrusted data. This flaw allows an unauthenticated remote attacker to corrupt the persisted status of batch job instances. The vulnerability has a high severity with a CVSS score of 8.2, indicating significant impact on integrity and some impact on availability.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 contain a critical authentication bypass vulnerability related to session fixation when the samlWeb-2.0 feature is enabled. This flaw allows an attacker to bypass authentication, potentially leading to full compromise of confidentiality and integrity without requiring user interaction.

CVE-2026-93895 is a critical vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It allows an unauthenticated remote attacker to bypass access controls configured on gRPC service methods, potentially leading to unauthorized access to sensitive operations. The vulnerability has a high CVSS score of 9.1, indicating severe confidentiality and integrity impacts without requiring user interaction or privileges.