Threat database

Adobe Photoshop Desktop contains an Incorrect Authorization vulnerability (CWE-863) that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 27.10 and 26.11.7. The vulnerability changes the security scope and has a high severity rating with a CVSS score of 8.6.

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Photoshop Desktop contains an Integer Overflow or Wraparound vulnerability (CWE-190) that may allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS 3.1 base score is 7.8, indicating high severity.

Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Photoshop Desktop contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS score is 5.5, indicating medium severity.

Adobe Photoshop Desktop contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The severity is rated medium with a CVSS score of 5.5.

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability (CWE-787) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS 3.1 base score is 7.8, indicating high severity.

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CVE-2026-106616) that allows an attacker to read arbitrary files on the system. This vulnerability can be exploited remotely without user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.6. Exploitation changes the security scope and could lead to disclosure of sensitive information. No official patch or remediation details are provided in the available data.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34633) that allows a low-privileged attacker to escalate privileges by making unauthorized internal requests. Exploitation does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and can lead to high confidentiality impact without affecting integrity or availability.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security features and gain unauthorized write access without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the impact is changed, indicating that the vulnerability affects resources beyond the initial security boundary.

Adobe ColdFusion 2025 contains a critical Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-106622) that allows an attacker to escalate privileges without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to full confidentiality, integrity, and availability compromise.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that could allow an attacker to execute arbitrary code with the privileges of the current user. The vulnerability does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control. The vulnerability has a critical severity with a CVSS score of 9.0.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue could lead to full compromise of confidentiality, integrity, and availability in the context of the current user.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control and results in a changed scope. The issue has a high severity with a CVSS score of 7.8.

Adobe ColdFusion 2025 contains a critical code injection vulnerability (CVE-2026-106624) that allows an attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue results from improper control of code generation, enabling arbitrary code execution in the context of the current user. The vulnerability has a maximum CVSS score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability.