Advisories · Technology

Lucee.

Every CVE that names Lucee among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-29519 CVE record

CVSS 6.2 Medium

Lucee CFML Server Reflected XSS via URL Path Parsing
- Lucee
- Cross-site scripting (XSS)
Not analysed yet 10 Jul 2026
CVE-2023-53880 CVE record

CVSS 4.8 Medium

Lucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces
- Lucee
- Cross-site scripting (XSS)
Not analysed yet 15 Dec 2025
CVE-2025-34074 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write
- Lucee
- Code injection
- CWE-829
Not analysed yet 2 Jul 2025
CVE-2021-21307 CVE record

CVSS 8.6 HighCritical · CVSS 7+ and EPSS

Remote Code Exploit in Lucee Admin
- Lucee
- Broken access control
Not analysed yet 11 Feb 2021