CVE-2026-63157

The Omnispace Agora Project versions prior to 26.10.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability in the Links module . The root cause is the failure to neutralize quotes when echoing an unsanitized link address (adress) field into an onclick event-handler attribute. An aut...

CVE-2026-63161 Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2026-63161 Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2026-63161

The Omnispace Agora Project versions prior to 26.10.0 are susceptible to a session fixation vulnerability (CWE-384). This flaw occurs because the application fails to regenerate the session identifier upon successful authentication. A remote attacker can exploit this by planting a known session i...

CVE-2026-63161 Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2023-35793-CSRF-On-Web-SSH

CVE-2023-35793-CSRF-On-Web-SSH Repository contains description for CVE-2023-35793 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-35793 Vendor: Cassia Networks Product: Access Controller Version: Cassia-AC-2.1.1.2303271039 Vulnerability: Cross Site Request Forgery...

CVE-2026-83662 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Experience Manager is affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue...

CVE-2026-83662

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79 ). An attacker could exploit this issue to inject malicious scripts into a web page, potentially leading to elevated access or control over the victim's account or session . Successful exploitatio...

CVE-2026-48382 Adobe Experience Manager | Incorrect Authorization (CWE-863)

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user...

CVE-2026-106630

Adobe Experience Manager is impacted by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by injecting malicious scripts into vulnerable form fields . When a victim visits a page containing these fields, the malicious JavaScript may execute in their browser,...

CVE-2026-106629 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable...

CVE-2026-105895 Adobe Experience Manager | Improper Input Validation (CWE-20)

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require use...

CVE-2026-92922

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerab...

CVE-2026-83700

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-83701

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-104875

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875 Ente: Accepted emergency contact can bypass the recovery notice period

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-83701

A Use after free vulnerability exists in the Windows Now Playing Session Manager . This flaw allows an authorized attacker to achieve local privilege escalation . No specific exploit details or in-the-wild exploitation information are provided in the documents. Remediation is indicated as an OFFI...

CVE-2026-83700

A Use after free vulnerability exists in the Windows Now Playing Session Manager . This flaw allows an authorized attacker to perform a local elevation of privilege . No specific exploit details or remediation steps are provided in the documents.

CVE-2026-110221 QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes featurepricename and impactvalue POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted reque...