1721 matches found
CVE-2026-104338
The Razorpay for WooCommerce WordPress plugin, in versions before 4.8.9 , is vulnerable to an unauthenticated user context switch . The root cause is a missing authorization check on a REST route where the plugin derives the acting user's identity from an unauthenticated request parameter . An un...
CVE-2026-104338 Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user...
WordPress Razorpay for WooCommerce plugin < 4.8.9 - Unauthenticated User Context Switch vulnerability
Unauthenticated User Context Switch vulnerability discovered by RIA Labs in WordPress Plugin Razorpay for WooCommerce versions 4.8.9...
CVE-2026-100111 Photoshop Desktop | Out-of-bounds Write (CWE-787)
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-103836 Substance3D - Stager | Out-of-bounds Write (CWE-787)
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-103835 Substance3D - Stager | Out-of-bounds Write (CWE-787)
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-103833
Substance3D - Stager is affected by an out-of-bounds write vulnerability (CWE-787). Successful exploitation could lead to arbitrary code execution within the context of the current user. This vulnerability requires user interaction , specifically when a victim opens a malicious file . No specific...
CVE-2026-104340 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-104342 Adobe Framemaker | Use After Free (CWE-416)
Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-104342 Adobe Framemaker | Use After Free (CWE-416)
Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-103967 Adobe Framemaker | Out-of-bounds Write (CWE-787)
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
PT-2026-113467
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
PT-2026-113413
šØ CVE-2026-104346 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. š@cveNotify...
CVE-2026-85953
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution...
BIT-GITLAB-2026-92628 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context...
PT-2026-102738
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context...
EUVD-2026-85731
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context...
CVE-2026-92628
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context...
CVE-2026-92628: Concurrent Execution using Shared Resource with Improper Synchronization
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context...
CVE-2026-92628
GitLab CE/EE versions 18.6 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are affected by a race condition in the MCP search tool . Improper synchronization during shared state handling could lead to search results being returned under an incorrect user context . GitLab has remediate...