Adobe PSIRT, Security Bulletins

https://www.adobe.com/chimera-api/collection?originSelection=hawks&contentTypeTags=caas:content-type/documentation&collectionTags=caas:trust-center/security-bulletin&language=en&country=us&size=250&draft=false

Added 2026-08-07 to close a measured discovery-latency gap: Adobe has produced three separate waves of critical unauthenticated code-execution-class flaws in the Campaign/ColdFusion line since early July 2026 (APSB26-68/69, APSB26-114, APSB26-120), and this pipeline has been finding each one via NCSC-NL or CERT-FR relay rather than from the vendor. APSB26-120 published 2026-08-03 and reached this pipeline on 2026-08-07 through an NCSC-NL advisory dated 08-06. FETCH (probed 2026-08-07): https://helpx.adobe.com/security.html returns the 4 NEWEST bulletins with dates and is the right recency entry point; https://helpx.adobe.com/security/security-bulletin.html returns the full historical index (814 APSB ids in one fetch) and is the right target for a backfill or a specific-id lookup. Per-bulletin pages (helpx.adobe.com/security/products/<product>/<apsb-id>.html) carry an explicit per-CVE table of CWE / impact / severity / CVSS base score / CVSS vector, so CVE-to-score mapping is transcribable without positional guessing, prefer it over NVD, whose description text for CVE-2026-48331 characterises the impact as privilege escalation where Adobe's own table records arbitrary code execution. | 2026-08-08: promoted candidate -> active. The state digest counted 4 distinct contributing runs, past the 3-run promotion bar. | 2026-08-15: recipe repaired, health probe reported it unreachable on webfetch, but the bridge's url subcommand returned the full bulletin index this run; fetch_method switched webfetch -> bridge. | 2026-09-29: bulletins moved to Adobe Trust Center (helpx now archive-only through Dec 2025; old security-bulletin.html is a stub). Working listing recipe = bridge url on the Milo CaaS JSON endpoint https://www.adobe.com/chimera-api/collection?originSelection=hawks&contentTypeTags=caas:content-type/documentation&collectionTags=caas:trust-center/security-bulletin&language=en&country=us&size=250&draft=false (108 cards; fields title=APSB id, contentArea.url, description=Priority N, cardDate, search.search=CVE ids; sort client-side on cardDate, size< total truncates in ascending order). Drill per bulletin with `url <bulletin>.html --direct` (raw body has the CVSS table; `extract` drops tables). Human page https://www.adobe.com/trust/security/bulletins-and-advisories.html is a JS shell. (2026-09-29T2134Z-audit) | 2026-10-02 (2026-10-02T0404Z-intel): `extract` drops the div-based Affected-versions and Vulnerability-details tables of a bulletin; `python3 tools/fetch_source.py url <bulletin>.html` returns the raw body (each table is div.table > div row > div cell). Bulletin pages live at https://www.adobe.com/trust/security/products/<product>/<apsb-id>.html (the helpx.adobe.com alias returns an identical body). In the chimera-api JSON `cardDate` is the publication date; `modifiedDate` was bulk-rewritten on 2026-09-30 (about 100 cards) and must not be used for recency.