KEV category
PDF tool KEV entries — Adobe Acrobat and Reader
Vulnerabilities being actively exploited in Adobe Acrobat and Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF can run attacker code in the user's session and pivot to file shares or email. Updated daily from the CISA KEV catalog.
CVE-2026-48282 · Adobe ColdFusionPath Traversal VulnerabilityPatch this weekAdded to KEV Jul 7, 2026
Adobe ColdFusion Path Traversal Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
CVE-2009-3459 · Adobe Acrobat and ReaderHeap-Based Buffer Overflow VulnerabilityPlan to patchAdded to KEV May 20, 2026
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
CVE-2026-34621 · Adobe Acrobat and ReaderPrototype Pollution VulnerabilityPlan to patchAdded to KEV Apr 13, 2026
Adobe Acrobat and Reader Prototype Pollution Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
CVE-2020-9715 · Adobe AcrobatUse-After-Free VulnerabilityPlan to patchAdded to KEV Apr 13, 2026
Adobe Acrobat Use-After-Free Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
CVE-2025-54236 · Adobe Commerce and MagentoImproper Input Validation VulnerabilityPatch this weekAdded to KEV Oct 24, 2025
Adobe Commerce and Magento Improper Input Validation Vulnerability
Affects anyone running Adobe Commerce and Magento. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
CVE-2025-54253 · Adobe Experience Manager (AEM) FormsExperience Manager Forms Code Execution VulnerabilityPatch this weekAdded to KEV Oct 15, 2025
Adobe Experience Manager Forms Code Execution Vulnerability
Affects anyone running Adobe Experience Manager (AEM) Forms. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
CVE-2017-3066 · Adobe ColdFusionDeserialization VulnerabilityPatch this weekAdded to KEV Feb 24, 2025
Adobe ColdFusion Deserialization Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
CVE-2024-20767 · Adobe ColdFusionImproper Access Control VulnerabilityPlan to patchAdded to KEV Dec 16, 2024
Adobe ColdFusion Improper Access Control Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
Adobe Flash Player: 4 CVEsPatch this weekadded Sep 17, 2024
Adobe Flash Player Incorrect Default Permissions Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.
Adobe Flash Player Integer Underflow Vulnerablity
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.
Adobe Flash Player Double Free Vulnerablity
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.
Adobe Flash Player Code Execution Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.
CVE-2024-34102 · Adobe Commerce and Magento Open SourceImproper Restriction of XML External Entity Reference (XXE) VulnerabilityPatch this weekAdded to KEV Jul 17, 2024
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
Affects anyone running Adobe Commerce and Magento Open Source. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Adobe ColdFusion: 2 CVEsPatch nowadded Jan 8, 2024
- CVE-2023-38203Known ransomware use
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
- CVE-2023-29300Known ransomware use
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
CVE-2023-21608 · Adobe Acrobat and ReaderUse-After-Free VulnerabilityPlan to patchAdded to KEV Oct 10, 2023
Adobe Acrobat and Reader Use-After-Free Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
CVE-2023-26369 · Adobe Acrobat and ReaderOut-of-Bounds Write VulnerabilityPlan to patchAdded to KEV Sep 14, 2023
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.
CVE-2023-26359 · Adobe ColdFusionDeserialization of Untrusted Data VulnerabilityPatch this weekAdded to KEV Aug 21, 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
Adobe ColdFusion: 2 CVEsPlan to patchadded Jul 20, 2023
Adobe ColdFusion Improper Access Control Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Adobe ColdFusion Improper Access Control Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
CVE-2023-26360 · Adobe ColdFusionDeserialization of Untrusted Data VulnerabilityPlan to patchAdded to KEV Mar 15, 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
Adobe Acrobat and Reader: 6 CVEsPlan to patchadded Jun 8, 2022
Adobe Acrobat and Reader Double Free Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.
Adobe Acrobat and Reader Unspecified Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.
Adobe Acrobat and Reader Buffer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.
Adobe Acrobat and Reader Use-After-Free Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
CVE-2009-1862 · Adobe Acrobat and Reader, Flash PlayerUnspecified VulnerabilityPlan to patchAdded to KEV Jun 8, 2022
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).
CVE-2011-2462 · Adobe Reader and AcrobatUniversal 3D Memory Corruption VulnerabilityPatch this weekAdded to KEV Jun 8, 2022
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).
Adobe Flash Player: 5 CVEsPlan to patchadded Jun 8, 2022
Adobe Flash Player Unspecified Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Adobe Flash Player Memory Corruption Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Adobe Flash Player Memory Corruption Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Adobe Flash Player Integer Overflow Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
Adobe Flash Player and AIR: 2 CVEsPlan to patchadded May 25, 2022
Adobe Flash Player and AIR Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player and AIR. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.
Adobe Flash Player and AIR Integer Overflow Vulnerability
Affects anyone running Adobe Flash Player and AIR. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.
Adobe Flash Player: 3 CVEsPlan to patchadded May 25, 2022
Adobe Flash Player Integer Overflow Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Integer overflow in Adobe Flash Player allows attackers to execute code.
Adobe Flash Player ASLR Bypass Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.
Adobe Flash Player Dereferenced Pointer Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.
CVE-2014-0546 · Adobe Reader and AcrobatSandbox Bypass VulnerabilityPatch this weekAdded to KEV May 25, 2022
Adobe Reader and Acrobat Sandbox Bypass Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.
CVE-2018-5002 · Adobe Flash PlayerStack-based Buffer Overflow VulnerabilityPlan to patchAdded to KEV May 23, 2022
Adobe Flash Player Stack-based Buffer Overflow Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
Adobe Flash Player: 6 CVEsPatch this weekadded Apr 13, 2022
Adobe Flash Player Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
Adobe Flash Player Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Adobe Flash Player Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
Adobe Flash Player Remote Code Execution Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.
CVE-2013-2729 · Adobe Reader and AcrobatArbitrary Integer Overflow VulnerabilityPatch this weekAdded to KEV Mar 28, 2022
Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
CVE-2012-2034 · Adobe Flash PlayerMemory Corruption VulnerabilityPlan to patchAdded to KEV Mar 28, 2022
Adobe Flash Player Memory Corruption Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).
Adobe Flash Player: 2 CVEsPatch this weekadded Mar 25, 2022
Adobe Flash Player Remote Code Execution Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Unspecified vulnerability in Adobe Flash Player allows for remote code execution.
Adobe Flash Player Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.
CVE-2010-2861 · Adobe ColdFusionDirectory Traversal VulnerabilityKnown ransomware usePatch nowAdded to KEV Mar 25, 2022
Adobe ColdFusion Directory Traversal Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
CVE-2009-0927 · Adobe Reader and AcrobatReader and Adobe Acrobat Stack-Based Buffer Overflow VulnerabilityPlan to patchAdded to KEV Mar 25, 2022
Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.
Adobe ColdFusion: 3 CVEsPatch this weekadded Mar 7, 2022
Adobe ColdFusion Directory Traversal Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.
Adobe ColdFusion Authentication Bypass Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
Adobe ColdFusion Information Disclosure Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.
CVE-2009-3960 · Adobe BlazeDSInformation Disclosure VulnerabilityKnown ransomware usePatch nowAdded to KEV Mar 7, 2022
Adobe BlazeDS Information Disclosure Vulnerability
Affects anyone running Adobe BlazeDS. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
Adobe Reader and Acrobat: 4 CVEsPatch nowadded Mar 3, 2022
Adobe Reader and Acrobat Memory Corruption Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.
Adobe Reader and Acrobat Memory Corruption Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.
- CVE-2010-0188Known ransomware use
Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.
Adobe Reader and Acrobat Use-After-Free Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.
Adobe Flash Player: 9 CVEsPatch nowadded Mar 3, 2022
Adobe Flash Player Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.
Adobe Flash Player Arbitrary Code Execution Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
- CVE-2016-1019Known ransomware use
Adobe Flash Player Arbitrary Code Execution Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.
Adobe Flash Player Arbitrary Code Execution Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.
Adobe Flash Player Remote Code Execution Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.
Adobe Flash Player Type Confusion Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.
Adobe Flash Player Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.
Adobe Flash Player Memory Corruption Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.
- CVE-2015-7645Known ransomware use
Adobe Flash Player Arbitrary Code Execution Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
CVE-2013-0641 · Adobe ReaderBuffer Overflow VulnerabilityPlan to patchAdded to KEV Mar 3, 2022
Adobe Reader Buffer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.
CVE-2013-0632 · Adobe ColdFusionAuthentication Bypass VulnerabilityPatch this weekAdded to KEV Mar 3, 2022
Adobe ColdFusion Authentication Bypass Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.
CVE-2008-2992 · Adobe Acrobat and ReaderReader and Acrobat Input Validation VulnerabilityKnown ransomware usePatch nowAdded to KEV Mar 3, 2022
Adobe Reader and Acrobat Input Validation Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.
CVE-2018-15982 · Adobe Flash PlayerUse-After-Free VulnerabilityKnown ransomware usePatch nowAdded to KEV Feb 15, 2022
Adobe Flash Player Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
CVE-2022-24086 · Adobe Commerce and Magento Open SourceImproper Input Validation VulnerabilityPatch this weekAdded to KEV Feb 15, 2022
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
Affects anyone running Adobe Commerce and Magento Open Source. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
Adobe Acrobat and Reader: 2 CVEsPlan to patchadded Nov 3, 2021
Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
Adobe Acrobat and Reader Use-After-Free Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
Adobe ColdFusion: 2 CVEsPatch this weekadded Nov 3, 2021
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
Adobe ColdFusion Unrestricted File Upload Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
CVE-2018-4878 · Adobe Flash PlayerUse-After-Free VulnerabilityKnown ransomware usePatch nowAdded to KEV Nov 3, 2021
Adobe Flash Player Use-After-Free Vulnerability
Affects anyone running Adobe Flash Player. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.