Vendor hub
Unauthenticated polyglot file upload via the Magento guest-cart REST API leads to webshells; mass-exploited since 2026-03 and added to CISA KEV on 2026-10-27.
Updated 2026-11-09
| CVE | Product | Added to KEV | Status | Dossier |
|---|---|---|---|---|
| CVE-2026-48356 | Adobe Commerce and Magento | 2026-10-27 | Active exploitation | Read → |
| CVE-2026-71362 | Adobe Commerce and Magento | 2026-09-24 | Active exploitation | Planned |
| CVE-2026-75650 | Adobe Commerce and Magento | 2026-09-08 | Active exploitation | Planned |
| CVE-2026-48282 | Adobe ColdFusion | 2026-07-07 | Active exploitation | Planned |
| CVE-2009-3459 | Adobe Acrobat and Reader | 2026-05-20 | Active exploitation | Planned |
| CVE-2026-34621 | Adobe Acrobat and Reader | 2026-04-13 | Active exploitation | Planned |
| CVE-2020-9715 | Adobe Acrobat | 2026-04-13 | Active exploitation | Planned |
| CVE-2025-54236 | Adobe Commerce and Magento | 2025-10-24 | Active exploitation | Planned |
| CVE-2025-54253 | Adobe Experience Manager (AEM) Forms | 2025-10-15 | Active exploitation | Planned |
| CVE-2017-3066 | Adobe ColdFusion | 2025-02-24 | Active exploitation | Planned |
| CVE-2024-20767 | Adobe ColdFusion | 2024-12-16 | Active exploitation | Planned |
| CVE-2013-0648 | Adobe Flash Player | 2024-09-17 | Active exploitation | Planned |
| CVE-2014-0502 | Adobe Flash Player | 2024-09-17 | Active exploitation | Planned |
| CVE-2014-0497 | Adobe Flash Player | 2024-09-17 | Active exploitation | Planned |
| CVE-2013-0643 | Adobe Flash Player | 2024-09-17 | Active exploitation | Planned |
| CVE-2024-34102 | Adobe Commerce and Magento Open Source | 2024-07-17 | Active exploitation | Planned |
| CVE-2023-29300 | Adobe ColdFusion | 2024-01-08 | Active exploitation | Planned |
| CVE-2023-38203 | Adobe ColdFusion | 2024-01-08 | Active exploitation | Planned |
| CVE-2023-21608 | Adobe Acrobat and Reader | 2023-10-10 | Active exploitation | Planned |
| CVE-2023-26369 | Adobe Acrobat and Reader | 2023-09-14 | Active exploitation | Planned |
| CVE-2023-26359 | Adobe ColdFusion | 2023-08-21 | Active exploitation | Planned |
| CVE-2023-29298 | Adobe ColdFusion | 2023-07-20 | Active exploitation | Planned |
| CVE-2023-38205 | Adobe ColdFusion | 2023-07-20 | Active exploitation | Planned |
| CVE-2023-26360 | Adobe ColdFusion | 2023-03-15 | Active exploitation | Planned |
| CVE-2012-5054 | Adobe Flash Player | 2022-06-08 | Active exploitation | Planned |