Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,429 results · page 3 of 129
Oct 15, 2026WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext.CVE-2026-63315 · Other software · Slican · reported by cvd@cert.plHigh 8.2
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100.
- Product
- IPx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a uCVE-2026-105271 · Other software · GEO CORPORATION · reported by vultures@jpcert.or.jpMedium 5.1
"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application.
- Product
- "ゲオアプリ" for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.CVE-2026-109527 · Other software · modelcontextprotocol · reported by GitHubHigh 7.5
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.
- Product
- python-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients.CVE-2026-108395 · Other software · modelcontextprotocol · reported by GitHubHigh 7.5
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.
- Product
- io.modelcontextprotocol.sdk:mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key ofCVE-2026-102476 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.1
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation. The impacted component is io.vertx:vertx-core.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).CVE-2026-59951 · Other software · modelcontextprotocol · reported by GitHubMedium 6.9
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.
- Product
- python-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text.CVE-2026-15102 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.5
ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.
- Product
- ADP Desktop SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 14, 2026libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCVE-2026-110654 · Other software · zapping-vbi · reported by VulnCheckMedium 6.9
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.
- Product
- libzvbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style arCVE-2026-73539 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2High 7.5
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context.CVE-2026-60021 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 6.5
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values toCVE-2026-110643 · Other software · kky-ykk · reported by VulnCheckCritical 9.3
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
- Product
- transcribe2texts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails.CVE-2026-101025 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.9
Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX JavaScript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sizedCVE-2026-101341 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-97312 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-96523 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-96522 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-96521 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-95641 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-95639 · Other software · Adobe · reported by AdobeHigh 8.6
Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-95638 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-95637 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-95636 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-95635 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-83966 · Other software · Adobe · reported by AdobeHigh 7.8
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance 3D Sampler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-83965 · Other software · Adobe · reported by AdobeHigh 7.8
Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance 3D Sampler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-83661 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-75995 · Websites & servers · Adobe · reported by AdobeHigh 8.4
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-75994 · Websites & servers · Adobe · reported by AdobeCritical 9.6
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-71385 · Websites & servers · Adobe · reported by AdobeHigh 8.4
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106619 · Websites & servers · Adobe · reported by AdobeCritical 9
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106618 · Websites & servers · Adobe · reported by AdobeHigh 8.8
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106617 · Websites & servers · Adobe · reported by AdobeHigh 8.8
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106615 · Websites & servers · Adobe · reported by AdobeHigh 8.8
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106614 · Websites & servers · Adobe · reported by AdobeHigh 7.8
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106613 · Websites & servers · Adobe · reported by AdobeHigh 8.8
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106612 · Websites & servers · Adobe · reported by AdobeCritical 9.9
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106090 · Websites & servers · Adobe · reported by AdobeHigh 8.8
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106089 · Websites & servers · Adobe · reported by AdobeHigh 8.8
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-105901 · Websites & servers · Adobe · reported by AdobeHigh 8.8
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the cCVE-2026-105899 · Websites & servers · Adobe · reported by AdobeCritical 10
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-105898 · Websites & servers · Adobe · reported by AdobeHigh 8.2
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-104348 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-104347 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-104346 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-103821 · Other software · Adobe · reported by AdobeHigh 7.8
Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance 3D Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-100129 · Other software · Adobe · reported by AdobeHigh 7.8
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-100128 · Other software · Adobe · reported by AdobeHigh 7.8
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-100127 · Other software · Adobe · reported by AdobeHigh 7.8
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-100112 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-100111 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.