CVE-2026-76708

A vulnerability exists in the HPE Networking Analytics and Location Engine (ALE) because the application and its underlying operating system utilize default, hard-coded credentials for multiple administrative and system accounts. An unauthenticated remote attacker can exploit this by logging in w...

CVE-2026-59991

The psd-tools Python package, used for processing Adobe Photoshop PSD files, contains an uncontrolled memory allocation vulnerability in the PSDImage.composite() and PSDImage.numpy() functions. Prior to version 1.17.4 , the software allocated output buffers based on attacker-controlled header geo...

CVE-2026-28324

The SolarWinds Observability Self-Hosted platform is vulnerable to an unauthenticated remote code execution (RCE) vulnerability. The root cause is identified as insufficient integrity checks affecting installations configured in non-default and non-secure configurations . This vulnerability has a...

CVE-2026-63628

The mppx TypeScript interface for the machine payments protocol is vulnerable to a gas draining attack in versions prior to 0.8.2 . The flaw exists in the fee-payer cosigning path located in src/tempo/internal/fee-payer.ts, where the software copies a client-supplied access_list from a 0x78 FeePa...

CVE-2026-63627

The mppx TypeScript interface for machine payments protocol contains a vulnerability prior to version 0.8.2 in the FeePayerPolicy component (src/tempo/internal/fee-payer.ts). The decodeFunctionData function failed to reject trailing bytes when validating fee-sponsored calldata. This allowed a cli...

CVE-2026-91129

The Home Assistant home automation software is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the IPP integration (specifically within homeassistant/components/ipp/config_flow.py). Prior to version 2026.2.3 , the async_step_zeroconf function automatically processed unauthenticated _ip...

CVE-2026-91130

Prior to version 2026.7.0 , the Statistics Graph card in Home Assistant (specifically in src/components/chart/statistics-chart.ts) was vulnerable to Cross-Site Scripting (XSS) . The application failed to escape entity names passed through getStatisticLabel and computeStateName, as well as interpo...

CVE-2026-57149

The plone.app.portlets component is vulnerable to Remote Code Execution (RCE) via TALES injection in versions 5.0.0 through 5.0.7, 6.0.0 through 6.0.3, and 7.0.0 through 7.0.1. The root cause is that the Classic portlet (plone.app.portlets.portlets.classic) uses user-supplied template/macro field...

CVE-2026-63386

The js-toml JavaScript TOML parser is vulnerable to a denial of service (DoS) due to uncontrolled recursion in the load() function. In versions prior to 1.1.3 , the recursive parser at src/load/parser.ts and the interpreter at src/load/interpreter.ts fail to bound the nesting depth of arrays, inl...

CVE-2026-77399

The icalendar library for Python, versions 6.1.0 through 7.2.2 , is vulnerable to a Denial of Service (DoS) . The vInt.from_ical function accepts an attacker-controlled VALARM REPEAT value, allowing applications to eagerly expand it without an application-level limit. While parsing alone does not...

CVE-2026-84395

Adobe Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that could lead to privilege escalation and potentially result in unauthorized write access . Exploitation of this issue does not require user interaction. The CVSS 3.1 score is 7.1 (High) . No specific...

CVE-2026-83963

Substance3D - Modeler is affected by an out-of-bounds write vulnerability (CWE-787) that could lead to arbitrary code execution within the context of the current user. Exploitation of this flaw requires user interaction, specifically when a victim opens a malicious file . No specific exploit deta...

CVE-2026-81998

The software Substance3D - Modeler is affected by an out-of-bounds write vulnerability (CWE-787). This flaw could lead to arbitrary code execution within the context of the current user. Exploitation of this vulnerability requires user interaction , specifically where a victim must open a malicio...

CVE-2026-83962

The software Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability (CWE-121). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Practical exploitation requires user interaction , specifically when a victim open...

CVE-2026-79906

Substance3D - Modeler is affected by an out-of-bounds write vulnerability (CWE-787). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Successful exploitation requires user interaction , specifically when a victim opens a malicious file ...

CVE-2026-94462

The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...

CVE-2026-75743

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows an attacker to bypass security measures and gain unauthorized write access , potentially leading to a limited disruption of availability. Successful exploitation require...

CVE-2026-82000

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). A low-privileged attacker can exploit this flaw to achieve privilege escalation and gain elevated access to internal resources . The vulnerability requires no user interaction for explo...

CVE-2026-75745

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability (CWE-863) that could lead to arbitrary code execution in the context of the current user. An attacker could exploit this issue without requiring any user interaction. While specific technical root causes or...

CVE-2026-75744

Adobe Experience Manager Forms JEE is impacted by a stored Cross-Site Scripting (XSS) vulnerability. A high-privileged attacker can inject malicious scripts into vulnerable form fields, which execute in a victim's browser upon visiting the affected page. This could result in the attacker gaining ...

CVE-2026-81995

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability (CWE-20) that can lead to arbitrary code execution in the context of the current user. An attacker with high privileges can exploit this issue without requiring any user interaction. The vulnerability has...

CVE-2026-81999

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that can lead to privilege escalation . An attacker with high privileges can exploit this issue to gain elevated access to internal resources. Exploitation does not require any user inte...

CVE-2026-75689

Adobe Connect is impacted by a stored Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this by injecting malicious scripts into vulnerable form fields . When a victim navigates to the page containing these fields, the malicious JavaScript may execute in their browser, potential...

CVE-2026-83964

Adobe Connect is affected by an Improper Certificate Validation vulnerability (CWE-295) that can result in the disclosure of sensitive memory and information. Exploitation of this flaw does not require user interaction. Adobe has released security updates to address this and other related vulnera...

CVE-2026-34689

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability. This flaw could allow an attacker to perform an arbitrary file system read , gaining access to sensitive files and directories outside the intended access scope. Exploitatio...

CVE-2026-75686

The software Adobe Connect is impacted by an Improper Input Validation vulnerability (CWE-20). A remote attacker can exploit this flaw to achieve arbitrary code execution within the context of the current user. Successful exploitation requires user interaction , specifically requiring a victim to...

CVE-2026-75682

The Adobe Connect platform is affected by an SQL Injection vulnerability (CWE-89) caused by the Improper Neutralization of Special Elements used in an SQL Command. A low-privileged attacker can exploit this flaw without user interaction to execute arbitrary SQL commands, which may lead to arbitra...

CVE-2026-48361

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can abuse this flaw to inject malicious scripts into vulnerable form fields . When a victim browses to the page containing the affected field, the malicious JavaScript may be executed in their bro...

CVE-2026-75684

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this by injecting malicious scripts into vulnerable form fields . When a victim navigates to the page containing the compromised field, the malicious JavaScript may execute in their browser. Th...

CVE-2026-75698

Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this flaw by tricking a victim into visiting a maliciously crafted URL or interacting with a compromised web page. Successful exploitation allows the attacker to inject malicious sc...

CVE-2026-75697

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to inject malicious scripts into vulnerable form fields . When a victim navigates to a page containing the affected field, the malicious JavaScript may execute in their browser. This co...

CVE-2026-75658

Adobe Bridge is affected by an out-of-bounds write vulnerability (CWE-787) that could allow an attacker to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction , specifically requiring a victim to open a malicious file. No speci...

CVE-2026-75656

Adobe Bridge is affected by an out-of-bounds read vulnerability (CWE-125) that can lead to the disclosure of sensitive memory . An attacker can leverage this flaw to expose sensitive information, though exploitation requires user interaction to open a malicious file. Remediation information is av...

CVE-2026-75649

Adobe Bridge is impacted by a Heap-based Buffer Overflow (CWE-122) vulnerability. This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Practical exploitation requires user interaction , specifically when a victim opens a malicious file . Re...

CVE-2026-75676

Adobe Bridge is affected by a Stack-based Buffer Overflow vulnerability (CWE-121). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Exploitation requires user interaction , specifically for a victim to open a malicious file . For remedi...

CVE-2026-75665

Adobe Bridge is impacted by a Heap-based Buffer Overflow (CWE-122) vulnerability. This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Successful exploitation requires user interaction , specifically when a victim opens a maliciously crafte...

CVE-2026-75655

Adobe Bridge is affected by an Uncontrolled Recursion vulnerability (CWE-674) that could allow an attacker to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction , specifically when a victim opens a malicious file. No specific software versi...

CVE-2026-75663

Adobe Bridge is affected by an out-of-bounds write vulnerability (CWE-787). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Successful exploitation requires user interaction , specifically when a victim opens a malicious file. A patch ...

CVE-2026-77246

MCP Atlassian , a Model Context Protocol server for Confluence and Jira, is vulnerable to server-local file exfiltration in versions prior to 0.22.0 . In an HTTP transport deployment where READ_ONLY_MODE=false , the server accepts requests without an Authorization identity and allows attacker-con...

CVE-2026-75632

The CAI Content Credentials software is affected by an Uncontrolled Resource Consumption vulnerability (CWE-400). An attacker can exploit this flaw to exhaust system resources, leading to an application denial-of-service (DoS) condition. The vulnerability is exploitable over the network without r...

CVE-2026-75634

CAI Content Credentials is affected by an Improper Input Validation vulnerability (CWE-20) that could result in a Security feature bypass . An attacker could leverage this flaw to bypass security measures and obtain unauthorized limited write access . Successful exploitation requires user interac...

CVE-2026-19480

The CAI Content Credentials software is affected by an Improper Input Validation vulnerability (CWE-20) that can lead to a Security feature bypass . An attacker could exploit this flaw to bypass security measures and gain unauthorized write access . Notably, exploitation of this issue does not re...

CVE-2026-75633

CAI Content Credentials is impacted by an Improper Input Validation vulnerability (CWE-20). An attacker can exploit this flaw to crash the application, resulting in a denial-of-service (DoS) condition. Successful exploitation requires user interaction , such as a victim visiting a maliciously cra...

CVE-2026-89277

The CAI Content Credentials software is vulnerable to an Integer Overflow or Wraparound (CWE-190) vulnerability. An attacker could exploit this flaw to cause an application crash, resulting in a denial-of-service (DoS) condition. Exploitation requires user interaction, such as a victim visiting a...

CVE-2026-75638

The CAI Content Credentials software is affected by an Improper Input Validation vulnerability (CWE-20). This flaw could allow an attacker to bypass security features and obtain unauthorized write access . Successful exploitation requires user interaction , such as a victim visiting a maliciously...

CVE-2026-76194

The CAI Content Credentials software is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to a Security feature bypass . An attacker could exploit this to gain unauthorized limited write access by tricking a victim into visiting a maliciously crafted URL or interacti...

CVE-2026-77248

Versions of MCP Atlassian prior to 0.22.0 are vulnerable to an unauthenticated arbitrary local file read. The streamable HTTP transport accepts requests without a user identity and defaults to operator credentials, while the upload_attachment function accepts an unrestricted file_path . An unauth...

CVE-2026-95862

Certain UniFi gateway devices are vulnerable to an Out-of-bounds Write vulnerability. A malicious actor with network access could exploit this flaw to perform a Denial of Service (DoS) attack against the device. No specific affected versions, root causes, or remediation steps are provided in the ...

CVE-2026-77256

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a vulnerability where the plaintext OAuth fallback file, which stores refresh and access tokens , is created with permissions inherited from the process umask . In many standard or permissive configurations, this...

CVE-2026-95861

Certain UniFi gateway devices are vulnerable to an Uncontrolled Recursion vulnerability. A malicious actor with network access can exploit this flaw to perform a Denial of Service (DoS) attack against the device. No specific software versions, root cause files, or remediation steps are provided i...