209096 matches found
EUVD-2026-74074
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...
CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...
CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...
CVE-2026-75999 ColdFusion | Improper Input Validation (CWE-20)
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative...
CVE-2026-75999 ColdFusion | Improper Input Validation (CWE-20)
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative...
EUVD-2026-74067
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative...
CVE-2026-75999
Adobe ColdFusion is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default, requiring a low-privileged attacker with adjacen...
CVE-2026-75991 Illustrator | Improper Input Validation (CWE-20)
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim mus...
EUVD-2026-74056
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim mus...
CVE-2026-75991 Illustrator | Improper Input Validation (CWE-20)
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim mus...
CVE-2026-75991
Adobe Illustrator is affected by an Improper Input Validation (CWE-20) vulnerability that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction : a victim must open a malicious file . The CVSS 3.1 score is 8.6 (HIGH) , with a local attack ...
CVE-2026-69642
Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-63523
Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-58941
In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-55273
In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-55256
In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28613
In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
HIGH Arbitrary local file content disclosure via include directive in untrusted .gitmodules SubmoduleConfigParser never disables mergeincludes - CWE: CWE-200 Exposure of Sensitive Information / CWE-73 External Control of File Name or Path - Affected component: git/objects/submodule/base.py,...
CVE-2026-69642
CVE-2026-69642 is a cross-site scripting (XSS) vulnerability in Skype for Business Server (Subscription Edition, 2019, and 2015), caused by improper input neutralization during web page generation. An unauthorized attacker can perform spoofing over a network with no user interaction or privileges...