Macromedia published a new CF-related security bulletin tonight, which is available on http://www.macromedia.com/devnet/security/security_zone/mpsb04-10.html
The core issue is about the possibility of using CFOBJECT and CreateObject() in a so called "untrusted" or shared environment to gain access to internal system functionality.
Macromedia recommends setting up proper security sandboxes or at least reviewing the current settings.
