Adobe I/O Events vulnerabilities

14 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Exploited Adobe I/O Events vulnerabilities

CVE-2026-48356 — Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

CVE-2026-47984 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.2)
CVE-2026-47997 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.9)
CVE-2026-47988 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.6)
CVE-2026-47999 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8)
CVE-2026-48358 — Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) (CVSS 9.1)
CVE-2026-48356 — Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) (CVSS 9.3) — exploited
CVE-2026-47998 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.9)
CVE-2026-48000 — Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (CVSS 6.1)
CVE-2026-48001 — Adobe Commerce | Information Exposure (CWE-200) (CVSS 3.7)
CVE-2026-47995 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.1)
CVE-2026-48371 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4)
CVE-2026-47996 — Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 6.8)
CVE-2026-47994 — Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7)
CVE-2026-47992 — Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 7.2)