CVE-2026-76193 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-76197 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

APSB26-134 : Security update available for Adobe Campaign Classic

Adobe has released a security update for Adobe Campaign Classic. This update addresses critical vulnerabilities that could result in arbitrary code execution...

PT-2026-81455

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic affected versions not specified Description Adobe Campaign Classic is affected by a Server-Side Request Forgery SSRF issue, which occurs when a server is tricked into making requests to an unintended location. This flaw...

PT-2026-81457

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic affected versions not specified Description An Improper Neutralization of Special Elements used in an OS Command occurs, leading to an OS Command Injection. This allows an attacker to execute arbitrary code in the contex...

PT-2026-81456

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic versions prior to 7.4.4 build 9401 Description An Improper Neutralization of Special Elements used in an OS Command occurs, leading to an OS Command Injection. This allows an unauthenticated attacker to execute arbitrary...

CVE-2026-76074

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-76074 AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-76074

AutomatorWP – Automator (WordPress plugin) is vulnerable to an authorization bypass in all versions up to and including 5.8.4 . The automatorwp_campaign_monitor_get_lists AJAX action does not properly verify that the requesting user holds the plugin's manager capability. Because the required nonc...

EUVD-2026-64211

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

PT-2026-79505

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate and others executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios...

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit TRU, the backdoor is a compiled C/C++ implant delivered ...

Dissecting the JWR phishing framework

Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven...

Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362...

vulnerabilities in Adobe Campaign Classic

Adobe has identified vulnerabilities in Adobe Campaign Classic. These vulnerabilities allow attackers to execute arbitrary code without user interaction. One of the vulnerabilities involves incorrect authorization, allowing attackers to perform actions beyond the intended permissions. Another...

CVE-2026-14859 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14857

The WP Crowdfunding WordPress plugin is affected by an IDOR vulnerability in versions before 2.2.1. The issue arises because the plugin does not verify campaign ownership when allowing updates to a campaign’s history and sending notification emails to backers. As a result, any authenticated user ...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...