Adobe I/o Events vulnerabilities

14 CVEs affecting Adobe I/o Events, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-48371, published 2026-07-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-48358, published 2026-07-14. Critical severity, CVSS 9.1. EPSS: 1.2% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high…
CVE-2026-48356, published 2026-07-14. Critical severity, CVSS 9.3. EPSS: 1% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining…
CVE-2026-47992, published 2026-07-14. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the…
CVE-2026-47996, published 2026-07-14. Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. A high-privileged attacker could exploit this vulnerability to access sensitive…
CVE-2026-47988, published 2026-07-14. High severity, CVSS 8.6. EPSS: 0.8% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and…
CVE-2026-47984, published 2026-07-14. High severity, CVSS 8.2. EPSS: 0.7% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and…
CVE-2026-47995, published 2026-07-14. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious…
CVE-2026-47998, published 2026-07-14. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and…
CVE-2026-47997, published 2026-07-14. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and…
CVE-2026-47994, published 2026-07-14. High severity, CVSS 8.7. EPSS: 0.7% chance of exploitation in the next 30 days. Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious…

Latest

CVE-2026-48371, published 2026-07-14. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious…
CVE-2026-48001, published 2026-07-14. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control.…
CVE-2026-48000, published 2026-07-14. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to…
CVE-2026-47999, published 2026-07-14. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious…