35594 matches found
CVE-2026-73032
PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM...
CVE-2026-48413
Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...
CVE-2026-48414 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...
CVE-2026-48414 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...
CVE-2026-48414
CVE-2026-48414 concerns Adobe Commerce (Magento) with a stored Cross-Site Scripting (XSS) vulnerability that can be triggered via vulnerable form fields by a low-privileged attacker. The attacker may inject malicious JavaScript, which could execute in a victim’s browser when visiting the affected...
CVE-2026-48413 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...
CVE-2026-48415 Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...
CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers
Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...
CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers
Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...
CVE-2026-73218
Cursor for macOS prior to 3.0.0 is vulnerable to a sandbox escape: an agent in Auto-Run Sandbox mode, with Docker Desktop and the Dev Containers CLI installed, can launch a privileged container and mount Docker’s virtiofs0. This grants read/write access to the user’s home directory and enables ho...
CVE-2026-20712
Incomplete cleanup in some UEFI firmware for some IntelR reference platforms within UEFI may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...
CVE-2026-20712
Incomplete cleanup in some UEFI firmware for some IntelR reference platforms within UEFI may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...
EUVD-2026-56824
Incomplete cleanup in some UEFI firmware for some IntelR reference platforms within UEFI may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...
EUVD-2026-56822
Exposure of sensitive information caused by incorrect data forwarding during transient execution for some IntelR Processors within Ring 0: Hypervisor and Kernel may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable dat...
CVE-2026-62890
Heap-based buffer overflow in Windows GDI+ allows an authorized attacker to execute code locally...
CVE-2026-20799
Untrusted search path for some Battery Life Diagnostic Tool software before version 2.9.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. Th...
CVE-2026-20775
Uncaught exception for some IntelR TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requiremen...
CVE-2026-20752
Improper authentication for some IntelR PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...
CVE-2026-20705
Insecure storage of sensitive information in the IntelR TDX module for some IntelR platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially...