2004 matches found
EUVD-2026-98753
Gotify: Insufficiently Protected Password Change endpoint...
GHSA-3HCJ-9M7P-WWM9 Gotify: Insufficiently Protected Password Change endpoint
The password change endpoint POST /current/user/password in Gotify versions = 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or...
CVE-2026-104346
Photoshop Desktop is affected by an out-of-bounds write vulnerability (CWE-787 ) that could lead to arbitrary code execution within the context of the current user. Exploitation requires user interaction, specifically for a victim to open a malicious file . Adobe has released a priority 3 securit...
CVE-2026-95637 Photoshop Desktop | Out-of-bounds Write (CWE-787)
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-100111 Photoshop Desktop | Out-of-bounds Write (CWE-787)
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-103836 Substance3D - Stager | Out-of-bounds Write (CWE-787)
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-103839
Substance3D - Stager is affected by an out-of-bounds write vulnerability (CWE-787). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Successful exploitation requires user interaction , specifically when a victim opens a malicious file. ...
CVE-2026-103830 Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-104340 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-104341
Adobe FrameMaker is affected by an out-of-bounds write vulnerability (CWE-787) that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically when a victim opens a malicious file . Adobe has released a priority 3 security updat...
CVE-2026-102603
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...
CVE-2026-102603
The Gotify server is vulnerable to an insufficiently protected password change endpoint (POST /current/user/password) in versions prior to 3.0.0 . The software fails to require the account's current password or an elevated authentication step, accepting only a valid client token. An attacker who ...
CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...
CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...
PT-2026-111819
šØ CVE-2026-106625 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. š@cveNotify...
CVE-2026-102603: Unverified Password Change
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...
CVE-2026-104342: Use After Free
Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
PT-2026-113279
šØ CVE-2026-103837 Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. š@cveNotify...
CVE-2026-85288
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...
EUVD-2026-65617
Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...