Adobe has 802 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 428 in the last 90 days against 67 in the 90 before. The busiest recent month was September 2026 with 224. The median CVSS is 7.4 (high), with 90 rated critical. 1% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 1623 days (10 cases). The dominant weakness classes are CWE-79 (285) and CWE-787 (89). Most affected products: experience_manager (239), coldfusion (53), c2pa (45).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 1% vs 1% corpus
Median CVSS: 7.4
Publish → KEV: 1623 d median(10)
Last 90 days: 428 prev 67

Weakness classes

Products

experience_manager 239
coldfusion 53
c2pa 45
acrobat 37
commerce 33
Photoshop 27

Follow Adobe:RSS feed Save a search →Embed badge ↗

802

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

adobe vulnerabilities

CVEs affecting adobe, newest first. Open any entry for full detail, references, and exploit status.

802 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

adobe vulnerabilities

Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory

Acrobat Reader is affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory

Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory

Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user

Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user

Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Photoshop Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability

ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service

ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability

Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability