Coldfusion

This hub aggregates every CVE we track for Coldfusion, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Coldfusion.

• CVE-2026-48320ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)8.5Jul 14, 2026
• CVE-2026-48324ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.1Jul 14, 2026
• CVE-2026-48332ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)7.7Jul 14, 2026
• CVE-2026-48318ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)9.9Jul 14, 2026
• CVE-2026-48327ColdFusion | Incorrect Authorization (CWE-863)9.0Jul 14, 2026
• CVE-2026-48338ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)6.8Jul 14, 2026
• CVE-2026-48329ColdFusion | Insufficient Session Expiration (CWE-613)2.7Jul 14, 2026
• CVE-2026-48319ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)9.1Jul 14, 2026
• CVE-2026-48321ColdFusion | Incorrect Authorization (CWE-863)9.3Jul 14, 2026
• CVE-2026-48284ColdFusion | Improper Input Validation (CWE-20)9.6Jul 14, 2026
• CVE-2026-48322ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.6Jul 14, 2026
• CVE-2026-48328ColdFusion | Improper Input Validation (CWE-20)7.7Jul 14, 2026
• CVE-2026-48325ColdFusion | Missing Authentication for Critical Function (CWE-306)9.3Jul 14, 2026
• CVE-2026-48363ColdFusion | Uncontrolled Search Path Element (CWE-427)8.2Jul 13, 2026
• CVE-2026-48364ColdFusion | Uncontrolled Search Path Element (CWE-427)8.2Jul 13, 2026