# Adobe Experience Manager


- [CVE-2026-90532](https://insights.sbomify.com/CVE-2026-90532/): Adobe Experience Manager | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-105895](https://insights.sbomify.com/CVE-2026-105895/): Adobe Experience Manager | Improper Input Validation (CWE-20) (critical 9.9)
- [CVE-2026-19232](https://insights.sbomify.com/CVE-2026-19232/): Adobe Experience Manager | Incorrect Authorization (CWE-863) (critical 9.9)
- [CVE-2025-49533](https://insights.sbomify.com/CVE-2025-49533/): Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502) (critical 9.8)
- [CVE-2021-40722](https://insights.sbomify.com/CVE-2021-40722/): AEM Forms Improper Restriction of XML External Entity Reference (critical 9.8)
- [CVE-2019-8088](https://insights.sbomify.com/CVE-2019-8088/): Command injection in Adobe Experience Manager (critical 9.8)
- [CVE-2019-7964](https://insights.sbomify.com/CVE-2019-7964/): Auth bypass in Adobe Experience Manager (critical 9.8)
- [CVE-2017-3108](https://insights.sbomify.com/CVE-2017-3108/): File upload in Experience Manager (critical 9.8)
- [CVE-2026-90531](https://insights.sbomify.com/CVE-2026-90531/): Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (critical 9.6)
- [CVE-2026-48259](https://insights.sbomify.com/CVE-2026-48259/): Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918) (critical 9.6)
- [CVE-2026-48359](https://insights.sbomify.com/CVE-2026-48359/): Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (critical 9.6)
- [CVE-2026-106629](https://insights.sbomify.com/CVE-2026-106629/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/products/adobe/experience-manager/