CVE-2026-75670

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript in a victim's browser. Exploitation requires user interaction —the victim must visit a crafted webpage. The changed...

CVE-2026-75717

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser. Exploitation requires user interaction —the victim must visit a craf...

CVE-2026-75720

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction — the victim must visit a crafted webpage — and ...

CVE-2026-79905

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields; when a victim browses the affected page, the injected JavaScript executes in the victim's browser. The vulnerabil...

CVE-2026-86464

Eclipse aeriOS Identity Manager (IdM) — in its current development version (no official release published yet) — shipped insecure default configurations in both its Helm chart and Docker Compose deployments. Keycloak and its PostgreSQL backing database were exposed via Kubernetes NodePort service...

CVE-2026-84942

This stored cross-site scripting (XSS) vulnerability affects OpenSearch Dashboards . The root cause is a flaw in the checkForFunctionProperty validation routine within the Vega expression function, which failed to recurse into arrays of objects, allowing a function property nested inside an array...

CVE-2026-76002

Adobe ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). If an attacker can convince a victim to visit a crafted URL referencing a vulnerable page, malicious JavaScript may execute within the victim's browser context. The CVSS 3.1 score is 6.1 (MEDIUM) with a...

CVE-2026-75746

Adobe ColdFusion is affected by a SQL injection (CWE-89) vulnerability caused by improper neutralization of special elements used in an SQL command. A successful exploit allows an attacker to execute arbitrary code in the context of the current user. The vulnerability requires high privileges but...

CVE-2026-76000

Adobe ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability (CWE-400) that can lead to an application denial-of-service . An attacker on an adjacent network can exploit this without user interaction or prior authentication, exhausting system resources to bring down the appl...

CVE-2026-75998

Adobe ColdFusion is affected by an Improper Access Control flaw (CWE-284) that allows an unauthenticated, remote attacker to perform an arbitrary file system read , gaining access to sensitive files and directories outside the intended scope. No user interaction is required. The CVSS 3.1 score is...

CVE-2026-76190

Adobe ColdFusion is affected by an Eval Injection vulnerability (CWE-95), where improper neutralization of directives in dynamically evaluated code could lead to arbitrary code execution in the context of the current user. The vulnerability is exploitable over the network with low complexity and ...

CVE-2026-48273

Adobe ColdFusion is affected by an eval injection vulnerability (CWE-95) that allows a low-privileged network attacker to achieve arbitrary code execution in the context of the current user, with no user interaction required. The vulnerability carries a CVSS 9.9 (Critical) rating with a changed s...

CVE-2026-75999

Adobe ColdFusion is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default, requiring a low-privileged attacker with adjacen...

CVE-2026-75993

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation requires user interaction — the victim mus...

CVE-2026-75771

Adobe Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability (CWE-190) that could lead to arbitrary code execution in the context of the current user. Exploitation requires the victim to open a malicious file , making user interaction a prerequisite. The vulnerability ca...

CVE-2026-75631

CVE-2026-75631 affects Adobe Photoshop Desktop with an out-of-bounds write flaw (CWE-787) that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction , as the victim must open a malicious file. The CVSS 3.1 base score is 7.8 (HIGH) with a...

CVE-2026-75862

Adobe Photoshop Desktop is affected by an Integer Overflow or Wraparound (CWE-190) vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction : a victim must open a malicious file. The CVSS v3.1 score is 7.8 (HIGH) with a l...

CVE-2026-82005

Adobe Photoshop Desktop is affected by an out-of-bounds write vulnerability (CWE-787) that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction , specifically opening a malicious file. The CVSS 3.1 score is 7.8 (HIGH) with a local attac...

CVE-2026-76199

Photoshop Desktop is affected by an Uncontrolled Search Path Element (CWE-427) vulnerability that could allow an attacker to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction , specifically that a victim opens a malicious file. The CVSS 3....

CVE-2026-82007

Photoshop Desktop is affected by an Integer Overflow or Wraparound (CWE-190) vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction —specifically, a victim must open a malicious file. The CVSS 3.1 base score is 7.8 (HIG...

CVE-2026-82006

Photoshop Desktop is affected by a Heap-based Buffer Overflow (CWE-122) that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction —specifically, a victim must open a malicious file . The CVSS v3.1 base score is 7.8 (HIGH) with a local att...

CVE-2026-75863

Adobe Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability (CWE-190) that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction —a victim must open a malicious file . The CVSS 3.1 score is 7.8 (HIGH) , with a lo...

CVE-2026-86808

moltis-org moltis (versions up to 20260818.10) contains a missing authentication vulnerability in the vault_unlock_handler/vault_recovery_handler function of vault.rs. A remote attacker with no privileges or user interaction can exploit this to achieve low impact on confidentiality, integrity, an...

CVE-2026-75991

Adobe Illustrator is affected by an Improper Input Validation (CWE-20) vulnerability that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction : a victim must open a malicious file . The CVSS 3.1 score is 8.6 (HIGH) , with a local attack ...

CVE-2026-75990

Adobe Illustrator is affected by an Incorrect Authorization vulnerability (CWE-863) that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction : a victim must open a malicious file. The CVSS 3.1 score is 8.6 (HIGH) with a changed scope, ...

CVE-2026-75992

Adobe Illustrator is affected by an out-of-bounds write (CWE-787) vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction — a victim must open a malicious file. The assigned CVSS v3.1 score is 7.8 (HIGH) , with a local a...

CVE-2026-84869

CVE-2026-84869 affects the ScreenConnect client (by ConnectWise). A condition in the client allows a guest to transfer and execute files on the host through an active remote session without proper authorization or Host confirmation, as described in the CVELIST record title. ScreenConnect servers ...

CVE-2026-28659

MicroXR Blobstore in Android XR contains a missing permission check that allows access to files belonging to other applications. The vulnerability enables local privilege escalation without requiring additional execution privileges or user interaction. The Android CNA (Google) assigns a CVSS 4.0 ...

CVE-2026-86806

opengeos GeoLibre versions up to 2.3.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the _is_within_roots function. The flaw allows a remote attacker with no privileges and no user interaction to forge server-side requests, resulting in low impact to confidentiality, integ...

CVE-2026-49883

CVE-2026-49883 affects Android Wear (per the 2026-09-01 security bulletin) and involves a missing permission check in the checkReadPermission method of PermissionsManager.java. This allows an attacker to monitor sensitive device state data without requiring additional execution privileges or user...

CVE-2026-17628

Langflow OSS versions 1.0.0 through 1.10.2 are affected by an improper authentication flaw (CWE-287) in the password reset endpoint of its user management API. The endpoint accepts a current password field in the request body but does not verify it against the stored credential before applying th...

CVE-2026-86804

An improper authorization vulnerability in seakee CPA-Manager-Plus versions up to 1.11.10 affects the CPAResource function in the file apps/manager-server/internal/http/controller/proxy/handler.go within the HTTP Handler component. An unauthenticated remote attacker can manipulate this handler to...

CVE-2026-82004

Adobe Campaign Classic (ACC) is affected by an OS Command Injection vulnerability (CWE-78) that allows a remote, unauthenticated attacker to execute arbitrary code in the context of the current user. The vulnerability is rated CVSS 10.0 (CRITICAL) with a network attack vector, low complexity, no ...

CVE-2026-86716

Cesanta mJS versions up to 1.26 contain a heap-based buffer overflow in the function skip_spaces_and_comments (file src/mjs_tok.c ). The flaw can be triggered remotely with no authentication required. The exploit has been publicly disclosed with proof-of-concept maturity, but the project has not ...

CVE-2026-85384

A stack-based buffer overflow exists in the httpd component of the TP-Link RE210 AC750 , caused by improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger...

CVE-2026-66307

An integer underflow (wrap/wraparound) vulnerability in Skype for Business Server allows an unauthorized, network-based attacker to cause a denial of service (CVSS 3.1: 7.5 HIGH , high availability impact). The affected products are Skype for Business Server Subscription Edition , Server 2019 , a...

CVE-2026-66303

CVE-2026-66303 is a null pointer dereference in Skype for Business that allows an authorized attacker (low privileges required) to cause a denial of service over the network. The affected products are Skype for Business Server Subscription Edition , Skype for Business Server 2019 , and Skype for ...

CVE-2026-69646

CVE-2026-69646 is an improper verification of cryptographic signature vulnerability in Skype for Business Server (Subscription Edition, 2015, and 2019). An unauthorized attacker on an adjacent network can perform spoofing without requiring privileges or user interaction. The CVSS 3.1 score is 8.3...

CVE-2026-69642

CVE-2026-69642 is a cross-site scripting (XSS) vulnerability in Skype for Business Server (Subscription Edition, 2019, and 2015), caused by improper input neutralization during web page generation. An unauthorized attacker can perform spoofing over a network with no user interaction or privileges...

CVE-2026-66305

CVE-2026-66305 is a spoofing vulnerability in Skype for Business Server (Subscription Edition, 2019, and 2015) caused by the use of client-side authentication , which allows an authorized attacker to perform spoofing over a network. The CVSS v3.1 score is 7.1 (HIGH) , with high integrity impact a...

CVE-2026-63523

CVE-2026-63523 is a stored cross-site scripting (XSS) vulnerability in Skype for Business Server , affecting the Subscription Edition , 2019 , and 2015 releases. The flaw stems from improper neutralization of input during web page generation, allowing an unauthenticated attacker to perform spoofi...

CVE-2026-66308

CVE-2026-66308 is an out-of-bounds read in Skype for Business Server (Subscription Edition, 2019, and 2015) that allows an authorized attacker to cause a denial of service over a network. The vulnerability is rated CVSS 3.1: 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, meani...

CVE-2026-66306

Skype for Business Server (Subscription Edition, 2019, and 2015) is affected by an information disclosure vulnerability caused by the generation of error messages containing sensitive information , allowing an unauthorized attacker to disclose information over a network. The CVSS 3.1 score is 6.5...

CVE-2026-66302

CVE-2026-66302 is a CRITICAL vulnerability (CVSS 9.8) in Skype for Business Server caused by external control of file name or path , allowing an unauthorized attacker to achieve remote code execution over the network with no privileges or user interaction. Affected products include Skype for Busi...

CVE-2026-66304

CVE-2026-66304 is a server-side request forgery (SSRF) vulnerability in Skype for Business Server , affecting the Subscription Edition , 2019 , and 2015 releases. An unauthorized remote attacker with no privileges required can exploit the flaw to disclose information over a network . The CVSS v3....

CVE-2026-86675

itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/us_edit.php, triggered through manipulation of the ID argument. The attack can be launched remotely and requires low-level privileges (authenticated access). The CVSS 3.1 base score is 6.3 (MEDIU...

CVE-2026-82537

Roo-Code through version 3.54.0 contains an auto-approve bypass vulnerability caused by a word-boundary mismatch in comment handling between the approval gate's shell parser and bash . An attacker can craft a command string pairing an allowlisted word with a hash character, separator, and a denie...

CVE-2026-82536

Roo-Code through version 3.54.0 contains an auto-approve bypass in its shell command parsing logic. The root cause is the omission of the bash pipe operator (specifically the stderr-redirecting pipe) from the parser's operator token set. An attacker can craft a command line combining an allowlist...

CVE-2026-86674

A session fixation vulnerability was identified in the ningzichun Student Management System , affecting the session_start function in login.php. The flaw allows a remote attacker to manipulate session identifiers, enabling unauthorized session takeover. The attack requires user interaction and no...

CVE-2026-79721

MLflow platform (version 0.0.1 or newer ) is vulnerable to arbitrary code execution via a maliciously crafted model artifact . When an end user loads a tampered artifact into a project, it can execute attacker-controlled code on their system. The CNA-assigned CVSS 4.0 score is 8.6 (HIGH) , reflec...