CVE-2016-1019Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC availableAdobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 53.9 · likelihood 4.5 · exploitation 25 · ransomware 5
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Mar 24, 2022
22%
Last analysed / modified upstream
Exploit / PoC code exists
Added to the CISA catalog on Mar 3, 2022. Federal remediation due Mar 24, 2022. View catalog ↗
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
flash_player_desktop_runtime <= 21.0.0.197flash_player <= 18.0.0.333flash_player <= 21.0.0.197flash_player <= 11.2.202.577air_desktop_runtime <= 21.0.0.176air_sdk <= 21.0.0.176air_sdk_&_compiler <= 21.0.0.176Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104349High· 7.3Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)
CVE-2026-48380Medium· 5.5Substance3D - Painter | Out-of-bounds Read (CWE-125)
CVE-2026-48379High· 7.8Substance3D - Painter | Stack-based Buffer Overflow (CWE-121)
CVE-2026-48360Critical· 9.6Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
CVE-2026-105780Critical· 9.9Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
CVE-2026-105779Critical· 9.1Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)