Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,054 results · page 3 of 22
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47977 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47975 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47974 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47973 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47972 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47970 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47966 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47962 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47958 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47957 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47956 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47954 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47953 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47951 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47950 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47949 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47948 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47945 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47944 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47943 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47942 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47941 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47939 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47936 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to abuse the unprotectCVE-2025-48516 · Other software · AMD · reported by psirt@amd.comMedium 6.9
Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to abuse the unprotected PMIC interface to create a permanent denial of service condition or affect the integrity of the memory module.
- Product
- AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-CVE-2026-34259 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.2
Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability.
- Product
- SAP Forecasting & Replenishment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNCVE-2026-2291 · Other software · dnsmasq · reported by cret@cert.orgHigh 7.3
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.
- Product
- dnsmasq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Vulnerability in Wikimedia Foundation AbuseFilter.CVE-2026-34086 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 2.1
Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.
- Product
- AbuseFilter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.org
Apr 14, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-27222 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-27258 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122).CVE-2026-33461 · Other software · Elastic · reported by security@elastic.coHigh 7.7
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122).CVE-2026-33460 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse CVE-2026-23818 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse an open redirect vulnerability in the login flow using a crafted URL. Successful exploitation may redirect an authenticated user to an attacker-controlled server hosting a spoofed login page prompting the unsuspecting victim to give away their credentials, which could then be captured by the attacker, before being redirected back to the legitimate login page.
- Product
- Private 5G Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: fromCVE-2026-4272 · Other software · Honeywell · reported by psirt@honeywell.comHigh 8.1
Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA. This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.
- Product
- Barcode Scanners
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse.CVE-2025-7024 · Other software · AIRBUS · reported by cert@airbus.comMedium 5.6
Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse. An attacker may execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vulnerable directory. This issue affects TETRA connectivity Server: 7.0. Vulnerability fix is available and delivered to impacted customers.
- Product
- TETRA Connectivity Server (TCS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by thCVE-2025-69784 · Other software · Xcitium · reported by MITREHigh 8.8
A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by the product. By redirecting this path to a user-writable location, an attacker can cause OpenEDR to load an attacker-controlled DLL into high-privilege processes. This results in arbitrary code execution with SYSTEM privileges, leading to full compromise of the affected system.
- Product
- Openedr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27266 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27265 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inCVE-2026-27262 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27257 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27256 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27255 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27254 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27253 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27252 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27251 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27250 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27249 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27248 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged CVE-2026-27247 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.