pwn.watch: Adobe incident updates https://pwn.watch/t/adobe Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT [high] Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability : CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27). https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362 adobe-commerce-and-magento-cve-2026-71362:2026-09-24:CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27). Thu, 24 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability: CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11). https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650 adobe-commerce-and-magento-cve-2026-75650:2026-09-08:CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11). Tue, 08 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Adobe ColdFusion: Adobe ColdFusion Path Traversal Vulnerability: CISA added CVE-2026-48282 to the KEV catalog (due 2026-07-10). https://pwn.watch/i/adobe-coldfusion-cve-2026-48282 adobe-coldfusion-cve-2026-48282:2026-07-07:CISA added CVE-2026-48282 to the KEV catalog (due 2026-07-10). Tue, 07 Jul 2026 00:00:00 GMT high Status: closed, patched [high] Adobe Acrobat and Reader: Adobe Acrobat and Reader Prototype Pollution Vulnerability: CISA added CVE-2026-34621 to the KEV catalog (due 2026-04-27). https://pwn.watch/i/adobe-acrobat-and-reader-cve-2026-34621 adobe-acrobat-and-reader-cve-2026-34621:2026-04-13:CISA added CVE-2026-34621 to the KEV catalog (due 2026-04-27). Mon, 13 Apr 2026 00:00:00 GMT high Status: closed, patched [critical] Adobe Commerce and Magento: Commerce and Magento Improper Input Validation Vulnerability: CISA added CVE-2025-54236 to the KEV catalog (due 2025-11-14). https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236 adobe-commerce-and-magento-cve-2025-54236:2025-10-24:CISA added CVE-2025-54236 to the KEV catalog (due 2025-11-14). Fri, 24 Oct 2025 00:00:00 GMT critical Status: closed, patched [critical] Adobe Experience Manager (AEM) Forms: Experience Manager Forms Code Execution Vulnerability: CISA added CVE-2025-54253 to the KEV catalog (due 2025-11-05). https://pwn.watch/i/adobe-experience-manager-aem-forms-cve-2025-54253 adobe-experience-manager-aem-forms-cve-2025-54253:2025-10-15:CISA added CVE-2025-54253 to the KEV catalog (due 2025-11-05). Wed, 15 Oct 2025 00:00:00 GMT critical Status: closed, patched [critical] Adobe ColdFusion: ColdFusion Deserialization Vulnerability: CISA added CVE-2017-3066 to the KEV catalog (due 2025-03-17). https://pwn.watch/i/adobe-coldfusion-cve-2017-3066 adobe-coldfusion-cve-2017-3066:2025-02-24:CISA added CVE-2017-3066 to the KEV catalog (due 2025-03-17). Mon, 24 Feb 2025 00:00:00 GMT critical Status: closed, patched [high] Adobe ColdFusion Improper Access Control: CISA added CVE-2024-20767 to the KEV catalog (federal deadline 2025-01-06) https://pwn.watch/i/adobe-coldfusion-cve-2024-20767 adobe-coldfusion-cve-2024-20767:2024-12-16:CISA added CVE-2024-20767 to the KEV catalog (federal deadline 2025-01-06) Mon, 16 Dec 2024 00:00:00 GMT high Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [high] Adobe Flash Player: 4 actively exploited vulnerabilities: CISA added CVE-2013-0643 to the KEV catalog (federal deadline 2024-10-08) https://pwn.watch/i/adobe-flash-player-cve-2013-0643-cve-2013-0648 adobe-flash-player-cve-2013-0643-cve-2013-0648:2024-09-17:CISA added CVE-2013-0643 to the KEV catalog (federal deadline 2024-10-08) Tue, 17 Sep 2024 00:00:00 GMT high Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, unpatched [high] Adobe Flash Player: 4 actively exploited vulnerabilities: CISA added CVE-2013-0648 to the KEV catalog (federal deadline 2024-10-08) https://pwn.watch/i/adobe-flash-player-cve-2013-0643-cve-2013-0648 adobe-flash-player-cve-2013-0643-cve-2013-0648:2024-09-17:CISA added CVE-2013-0648 to the KEV catalog (federal deadline 2024-10-08) Tue, 17 Sep 2024 00:00:00 GMT high Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, unpatched [high] Adobe Flash Player: 4 actively exploited vulnerabilities: CISA added CVE-2014-0497 to the KEV catalog (federal deadline 2024-10-08) https://pwn.watch/i/adobe-flash-player-cve-2013-0643-cve-2013-0648 adobe-flash-player-cve-2013-0643-cve-2013-0648:2024-09-17:CISA added CVE-2014-0497 to the KEV catalog (federal deadline 2024-10-08) Tue, 17 Sep 2024 00:00:00 GMT high Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, unpatched [high] Adobe Flash Player: 4 actively exploited vulnerabilities: CISA added CVE-2014-0502 to the KEV catalog (federal deadline 2024-10-08) https://pwn.watch/i/adobe-flash-player-cve-2013-0643-cve-2013-0648 adobe-flash-player-cve-2013-0643-cve-2013-0648:2024-09-17:CISA added CVE-2014-0502 to the KEV catalog (federal deadline 2024-10-08) Tue, 17 Sep 2024 00:00:00 GMT high Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, unpatched [critical] Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE): CISA added CVE-2024-34102 to the KEV catalog (federal deadline 2024-08-07) https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102 adobe-commerce-and-magento-open-source-cve-2024-34102:2024-07-17:CISA added CVE-2024-34102 to the KEV catalog (federal deadline 2024-08-07) Wed, 17 Jul 2024 00:00:00 GMT critical Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [critical] Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE): CVE-2024-34102 published https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102 adobe-commerce-and-magento-open-source-cve-2024-34102:2024-06-13:CVE-2024-34102 published Thu, 13 Jun 2024 00:00:00 GMT critical Source: https://nvd.nist.gov/vuln/detail/CVE-2024-34102 Status: closed, patched [high] Adobe ColdFusion Improper Access Control: CVE-2024-20767 published https://pwn.watch/i/adobe-coldfusion-cve-2024-20767 adobe-coldfusion-cve-2024-20767:2024-03-18:CVE-2024-20767 published Mon, 18 Mar 2024 00:00:00 GMT high Source: https://nvd.nist.gov/vuln/detail/CVE-2024-20767 Status: closed, patched [critical] Adobe ColdFusion: 2 actively exploited vulnerabilities: CISA added CVE-2023-29300 to the KEV catalog (federal deadline 2024-01-29) https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203 adobe-coldfusion-cve-2023-29300-38203:2024-01-08:CISA added CVE-2023-29300 to the KEV catalog (federal deadline 2024-01-29) Mon, 08 Jan 2024 00:00:00 GMT critical Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [critical] Adobe ColdFusion: 2 actively exploited vulnerabilities: CISA added CVE-2023-38203 to the KEV catalog (federal deadline 2024-01-29) https://pwn.watch/i/adobe-coldfusion-cve-2023-29300-38203 adobe-coldfusion-cve-2023-29300-38203:2024-01-08:CISA added CVE-2023-38203 to the KEV catalog (federal deadline 2024-01-29) Mon, 08 Jan 2024 00:00:00 GMT critical Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [high] Adobe Acrobat and Reader: Use-After-Free (CVE-2023-21608): CISA added CVE-2023-21608 to the KEV catalog (due 2023-10-31). https://pwn.watch/i/adobe-acrobat-and-reader-cve-2023-21608 adobe-acrobat-and-reader-cve-2023-21608:2023-10-10:CISA added CVE-2023-21608 to the KEV catalog (due 2023-10-31). Tue, 10 Oct 2023 00:00:00 GMT high Status: closed, patched [high] Adobe Acrobat and Reader: Out-of-Bounds Write (CVE-2023-26369): CISA added CVE-2023-26369 to the KEV catalog (due 2023-10-05). https://pwn.watch/i/adobe-acrobat-and-reader-cve-2023-26369 adobe-acrobat-and-reader-cve-2023-26369:2023-09-14:CISA added CVE-2023-26369 to the KEV catalog (due 2023-10-05). Thu, 14 Sep 2023 00:00:00 GMT high Status: closed, patched [critical] Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26359): CISA added CVE-2023-26359 to the KEV catalog (due 2023-09-11). https://pwn.watch/i/adobe-coldfusion-cve-2023-26359 adobe-coldfusion-cve-2023-26359:2023-08-21:CISA added CVE-2023-26359 to the KEV catalog (due 2023-09-11). Mon, 21 Aug 2023 00:00:00 GMT critical Status: closed, patched [high] Adobe ColdFusion: 2 exploited vulnerabilities (CVE-2023-29298, CVE-2023-38205): CISA added CVE-2023-29298 to the KEV catalog (due 2023-08-10). https://pwn.watch/i/adobe-coldfusion-cve-2023-29298-38205 adobe-coldfusion-cve-2023-29298-38205:2023-07-20:CISA added CVE-2023-29298 to the KEV catalog (due 2023-08-10). Thu, 20 Jul 2023 00:00:00 GMT high Status: closed, patched [high] Adobe ColdFusion: 2 exploited vulnerabilities (CVE-2023-29298, CVE-2023-38205): CISA added CVE-2023-38205 to the KEV catalog (due 2023-08-10). https://pwn.watch/i/adobe-coldfusion-cve-2023-29298-38205 adobe-coldfusion-cve-2023-29298-38205:2023-07-20:CISA added CVE-2023-38205 to the KEV catalog (due 2023-08-10). Thu, 20 Jul 2023 00:00:00 GMT high Status: closed, patched [high] Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360): CISA added CVE-2023-26360 to the KEV catalog (due 2023-04-05). https://pwn.watch/i/adobe-coldfusion-cve-2023-26360 adobe-coldfusion-cve-2023-26360:2023-03-15:CISA added CVE-2023-26360 to the KEV catalog (due 2023-04-05). Wed, 15 Mar 2023 00:00:00 GMT high Status: closed, patched