PT-2026-71115

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-48413

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-48414 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-48414

CVE-2026-48414 concerns Adobe Commerce (Magento) with a stored Cross-Site Scripting (XSS) vulnerability that can be triggered via vulnerable form fields by a low-privileged attacker. The attacker may inject malicious JavaScript, which could execute in a victim’s browser when visiting the affected...

CVE-2026-48415 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

CVE-2025-61970

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking...

EUVD-2025-210686

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking...

CVE-2025-0041

Uncontrolled search paths in the Vitis™ Embedded Single File Download SFD for local Windows installation could allow a low-privileged user to create arbitrary code execution...

CVE-2026-48385

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

CVE-2026-48375

The CVE-2026-48375 entry concerns Adobe ColdFusion with an Incorrect Authorization (CWE-863) vulnerability that can crash the application, causing a denial-of-service. According to provided details, a low-privileged attacker over the network can exploit this without user interaction to trigger a ...

EUVD-2026-56544

is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope ...

CVE-2026-21269

CVE-2026-21269 (Adobe ColdFusion) describes a stored cross-site scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript could execute in a victim’s browser when visiting the page containing th...

CVE-2026-25652

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction...

EUVD-2026-55867

SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected...

PT-2026-70108

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

PT-2026-70363

Name of the Vulnerable Software and Affected Versions Vitis Unified affected versions not specified Description Weak permissions in the installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking, which is the...

PT-2026-70027

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Adobe Document Service affected versions not specified Description The Adobe Document Service component uses outdated open source cryptographic and data transfer libraries. A low-privileged authenticated...

CVE-2026-72867

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

CVE-2026-72727

CVE-2026-72727 – Discourse Stored XSS in moderation review queue . A low-privileged user could place crafted content in the moderation review queue that would execute a stored XSS when a moderator viewed it on sites with a modified or disabled default CSP. Affected versions: prior to 2026.1.6, 20...

CVE-2026-72576

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...