CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation ...

EUVD-2026-99219

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation ...

CVE-2026-92464 Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-92464

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-92464 Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-92464

Adobe Commerce is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to arbitrary code execution in the context of the current user. An attacker with high privileges can exploit this issue without user interaction. No specific affected versions, root cause components,...

EUVD-2026-99216

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-92909

Adobe Commerce is affected by an Incorrect Authorization vulnerability (CWE-863 ) that could lead to arbitrary code execution in the context of the current user. An attacker could exploit this issue without requiring any user interaction. While the vulnerability details are provided, no specific ...

EUVD-2026-99212

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-92909 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-92909 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

rpm: rpmbuild getTarSpec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-108384

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

CVE-2026-108384

The dataclasses-avroschema library (versions 0.38.0 through 0.70.5 ) contains a code injection vulnerability in the BaseGenerator.parse_fixed function. The root cause is the direct interpolation of a fixed type's aliases value into a generated types.confixed annotation. While lists are correctly ...

CVE-2026-108384 dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

CVE-2026-108384 dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

EUVD-2026-98981

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

CVE-2026-92892 Potential command execution on the host running JFrog CLI.

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later...

CVE-2026-92892 Potential command execution on the host running JFrog CLI.

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later...

CVE-2026-92892 Potential command execution on the host running JFrog CLI.

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later...