CVE-2026-4345: Improper Neutralization of Input During Web Page Generation

A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context o...

Adobe Reader < 26.001.21431 Multiple Vulnerabilities (APSB26-44) (macOS)

The version of Adobe Reader installed on the remote macOS host is a version prior to 26.001.21431. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3229 (ALAS-2026-3229)

"The version of nerdctl installed on the remote host is prior to 2.2.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3229 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix...

APSB26-38 : Security updates available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2025 and 2023. These updates resolve critical and moderate vulnerabilities that could lead to arbitrary code execution, application denial-of-service, arbitrary file system read, and security feature bypass. Adobe is not aware of any...

CVE-2026-4369: Improper Neutralization of Input During Web Page Generation

A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to...

CVE-2025-7389: Files or Directories Accessible to External Parties

A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read...

CVE-2026-35032: Server-Side Request Forgery (SSRF)

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint POST /LiveTv/TunerHosts, where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery SSRF via HTTP...

PT-2026-32948

Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interactio...

PT-2026-32624

A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read...

Adobe Acrobat < 24.001.30365 / 26.001.21431 Multiple Vulnerabilities (APSB26-44) (macOS)

The version of Adobe Acrobat installed on the remote macOS host is a version prior to 24.001.30365 or 26.001.21431. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled...

PT-2026-32958

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.7 Description An unauthenticated arbitrary file read is possible via ffmpeg argument injection through the query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds lowercase...

CVE-2026-4344: Improper Neutralization of Input During Web Page Generation

A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read loc...

Jellyfin 代码问题漏洞

Jellyfin is a free software media system developed by Jellyfin. It allows you to control the management and streaming of media. It’s an alternative to proprietary products like Emby and Plex, enabling the delivery of media from dedicated servers to end-user devices through multiple applications...

PT-2026-32957

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint POST /LiveTv/TunerHosts, where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery SSRF via HTTP...

The vulnerability of the Comindware Platform for business process management lies in the incorrect limitation of the path name to the restricted access catalog, allowing attackers to read arbitrary files.

The vulnerability of the Comindware Platform for business process management is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to remotely read arbitrary files...

CVE-2026-40042

Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax and inline tags in issue descriptions...

CVE-2026-40042

Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax and inline tags in issue descriptions...

CVE-2026-40042 Pachno 1.0.6 Wiki TextParser XML External Entity Injection

Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax and inline tags in issue descriptions...

CVE-2026-40042

Pachno 1.0.6 is affected by an XML External Entity (XXE) injection in the TextParser helper. The vulnerability allows unauthenticated attackers to read arbitrary files by crafting malicious XML entities via wiki table syntax and inline tags in issue descriptions, comments, and wiki articles, whic...

📄 Redaxo 5.20.1 Path Traversal

Redaxo versions 5.20.1 and below suffer from a path traversal vulnerability. CVE-2026-21857: Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Overview | Field | Details | |---|---| | CVE ID | CVE-2026-21857 | | Severity | HIGH | | Advisory | View Advisory | | Discovered by...