CVE-2026-48260

Adobe Experience Manager is affected by a DOM-based XSS vulnerability (CVE-2026-48260). The issue allows an attacker to manipulate the DOM to execute malicious JavaScript in the victim’s browser. Exploitation requires user interaction (victim visits a crafted page). CVSS v3.1: AV:N/AC:L/PR:L/UI:R...

CVE-2026-48253

CVE-2026-48253 affects Adobe Experience Manager and describes a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could cause malicious JavaScript to execute in the victim’s browser by manipulating the DOM; exploitation requires user interaction (the victim visits a crafted page). T...

CVE-2026-48261

Adobe Experience Manager is affected by a DOM-based XSS vulnerability. An attacker could manipulate the DOM to execute JavaScript in the victim’s browser, with user interaction required (victim visits a crafted page). The vulnerability is scope-changed; CVSS 3.1 base score 5.4 (MEDIUM) with NETWO...

CVE-2026-48262 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-48262

Adobe Experience Manager is affected by a DOM-based XSS vulnerability (CVE-2026-48262). The issue involves manipulating the DOM to execute malicious JavaScript in the victim’s browser, with exploitation requiring user interaction (victim visits a crafted page). CVSS 3.1 base score 5.4 (Medium): A...

CVE-2026-48255 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-48255

CVE-2026-48255 affects Adobe Experience Manager with a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue arises from manipulating the DOM to execute malicious JavaScript in the victim’s browser, requiring user interaction (victim visits a crafted webpage). CVSS 3.1 metrics indicate Ne...

CVE-2026-48257

CVE-2026-48257 : Adobe Experience Manager is affected by a DOM-based XSS vulnerability. An attacker could manipulate the DOM to run malicious JavaScript in the victim’s browser, with exploitation requiring the user to visit a crafted webpage. The CVSS v3.1 base score is 5.4 (Medium) with network ...

CVE-2026-48254 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-15058

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier...

Authorization Bypass Through User-Controlled Key

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the appointments/store and appointments/update endpoints. An...

Authorization Bypass Through User-Controlled Key

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the oauthcallback process. An attacker can access and modify anoth...

EUVD-2026-43943

Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally...

CVE-2026-62658

A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router...

CVE-2026-62655

A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable...

CVE-2026-62656

A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation...

CVE-2026-50454

Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally...

CVE-2026-50425

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally...

CVE-2026-50421

Access of resource using incompatible type 'type confusion' in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

CVE-2026-48368

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...