CVE-2026-93952 Security Advisory 0183

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

EUVD-2026-84282

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user w...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

PT-2026-96906

Adobe Campaign Classic ACC is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the...

CVE-2026-82003: Improper Input Validation

Adobe Campaign Classic ACC is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the...

CVE-2026-82010: Improper Neutralization of Special Elements used in an SQL Command

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-93952: Improper Input Validation

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

CVE-2026-88419

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

In OpenSSH before 10.3, a file downloaded by scp -0 as root can lead to privileged escalation

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and without -p preserve mode...

PT-2026-96911

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic ACC affected versions not specified Description Adobe Campaign Classic ACC contains a Server-Side Request Forgery SSRF flaw, which occurs when a server is tricked into making requests to an unintended location. This issu...

PT-2026-96910

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic ACC affected versions not specified Description An Improper Neutralization of Special Elements used in an SQL Command, known as SQL Injection, allows a low-privileged attacker to bypass security features. This issue...

PT-2026-96909

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-82008: Improper Input Validation

Adobe Campaign Classic ACC is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...

PT-2026-96680

Name of the Vulnerable Software and Affected Versions VeloCloud Orchestrator versions 5.2.0 through 5.2.3.15 VeloCloud Orchestrator versions 6.1.0 through 6.1.3.7 VeloCloud Orchestrator versions 6.4.0 through 6.4.2.7 VeloCloud Orchestrator versions 7.0.0 through 7.0.0.2 Description An improper...

CVE-2026-89276: Improper Control of Generation of Code

Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation o...

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

Arista VeloCloud Orchestrator VCO on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...

CVE-2026-82443: Server-Side Request Forgery (SSRF)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...

VulnCheck KEV: CVE-2026-93952

Arista VeloCloud Orchestrator VCO on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...

Security Advisory 0183

Security Advisory 0183 . CSAF PDF Date: September 22, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 22, 2026 | Initial release 1.1 | September 23, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-93952 CVSSv3.1 Base Score: 10.0...

GHSA-JHJP-4C2Q-XMX4 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

The k8saudit plugin's per-container fields ka.req.pod.containers. and the shipped k8sauditrules.yaml evaluated only requestObject.spec.containers. Security-relevant settings on a pod's initContainers or ephemeralContainers were not inspected, so the shipped Create Privileged Pod rule did not fire...