CVE Tools
Track your stack

Coldfusion

322 CVEs tracked. 17 of them are in CISA KEV.

This hub aggregates every CVE we track for Coldfusion, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Coldfusion CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Coldfusion CVEs per month
MonthCVEs
2024-110
2024-121
2025-010
2025-020
2025-030
2025-0415
2025-058
2025-060
2025-0713
2025-081
2025-091
2025-100
2025-110
2025-1211
2026-010
2026-020
2026-030
2026-047
2026-050
2026-0617
2026-0716
2026-0816
2026-099
2026-1030

Severity

How the 322 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical8627%
  • High11636%
  • Medium10834%
  • Low124%

Latest CVEs

The 15 most recently published vulnerabilities affecting Coldfusion.

  1. CVE-2026-105897ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)8.6
  2. CVE-2026-34633ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)7.7
  3. CVE-2026-106616ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)8.6
  4. CVE-2026-106618ColdFusion | Incorrect Authorization (CWE-863)8.8
  5. CVE-2026-105994ColdFusion | Incorrect Authorization (CWE-863)7.7
  6. CVE-2026-106622ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)10.0
  7. CVE-2026-106619ColdFusion | Improper Input Validation (CWE-20)9.0
  8. CVE-2026-106089ColdFusion | Incorrect Authorization (CWE-863)8.8
  9. CVE-2026-106613ColdFusion | Improper Input Validation (CWE-20)8.8
  10. CVE-2026-106624ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0
  11. CVE-2026-106614ColdFusion | Incorrect Authorization (CWE-863)7.8
  12. CVE-2026-75996ColdFusion | Uncontrolled Resource Consumption (CWE-400)7.5
  13. CVE-2026-106621ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.1
  14. CVE-2026-105898ColdFusion | Incorrect Authorization (CWE-863)8.2
  15. CVE-2026-105903ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.9

Product grouping is registry-driven, with AI assist and human review. How it works