adobe has 802 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 428 in the last 90 days against 67 in the 90 before. The busiest recent month was September 2026 with 224. The median CVSS is 7.4 (high), with 90 rated critical. 1% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 1623 days (10 cases). The dominant weakness classes are CWE-79 (285) and CWE-787 (89). Most affected products: experience_manager (239), coldfusion (53), c2pa (45).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 1% vs 1% corpus
Median CVSS: 7.4
Publish → KEV: 1623 d median(10)
Last 90 days: 428 prev 67

Weakness classes

Products

experience_manager 239
coldfusion 53
c2pa 45
acrobat 37
commerce 33
Photoshop 27

Follow adobe:RSS feed Save a search →Embed badge ↗

802

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

adobe vulnerabilities

CVEs affecting adobe, newest first. Open any entry for full detail, references, and exploit status.

802 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

adobe vulnerabilities

Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service

Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user

Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user

Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user

Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user

Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user

Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields