Adobe ColdFusion Coldfusion 2023 Update 18

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*

part: a version: 2023 update: update18

VendorAdobe (fb293c1b-cab3-5565-9184-186e4ece530b)
ProductColdfusion (db90b161-3a2c-5267-99af-6a14e5723f4c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-21269 vulnerable 2026-09-16 04:34:12.979387 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
MEDIUM (4.6)
ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Published: 2026-08-11T16:31:02.383Z
Updated: 2026-09-08T19:37:43.636Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-48338 vulnerable 2026-07-29 00:55:01.303206 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
MEDIUM (6.8)
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
Published: 2026-07-14T21:04:11.745Z
Updated: 2026-08-27T22:39:08.005Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-34619 vulnerable 2026-06-08 07:59:12.799884 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
HIGH (7.7)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:59.589Z
Updated: 2026-08-27T22:15:57.643Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27308 vulnerable 2026-06-08 07:53:22.194146 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
LOW (2.4)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:58.735Z
Updated: 2026-08-27T22:15:53.632Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27307 vulnerable 2026-06-08 07:53:22.192278 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
LOW (2.4)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:53.899Z
Updated: 2026-08-27T22:15:51.876Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27306 vulnerable 2026-06-08 07:53:22.186911 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27305 vulnerable 2026-06-08 07:53:22.184916 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27304 vulnerable 2026-06-08 07:53:22.183117 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27282 vulnerable 2026-06-08 07:53:22.150299 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.