Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,094 results · page 5 of 262
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55683 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55682 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.1
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55681 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55680 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55679 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.5
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.CVE-2026-55498 · Other software · error311 · reported by GitHubMedium 4.8
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An unauthenticated holder of a valid share token can use shared-folder listing, direct download, or ZIP creation to access files outside the folder that was actually shared. The flaw occurs because the affected shared-folder paths resolve symlinks without enforcing the original shared folder as the real-path boundary. This issue is fixed in version 3.15.0.
- Product
- FileRise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2026-55167 · Other software · LDAPAccountManager · reported by GitHubMedium 4.2
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.CVE-2026-105429 · Other software · NetBird · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cHigh 8.9
Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.
- Product
- NetBird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-90532 · Other software · Adobe · reported by AdobeCritical 10
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalationCVE-2026-90531 · Other software · Adobe · reported by AdobeCritical 9.6
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-83960 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-83958 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2026-83662 · Other software · Adobe · reported by AdobeCritical 9.3
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-75732 · Other software · Adobe · reported by AdobeCritical 9.9
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-48398 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-48383 · Other software · Adobe · reported by AdobeCritical 10
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-48382 · Other software · Adobe · reported by AdobeCritical 10
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass.CVE-2026-110084 · Other software · Adobe · reported by AdobeHigh 7.1
Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result CVE-2026-110083 · Other software · Adobe · reported by AdobeHigh 7.1
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2026-110082 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-110081 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110080 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110079 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110078 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110077 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110076 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110075 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110074 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-110073 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-110037 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-109415 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-107682 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-107305 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbCVE-2026-106634 · Other software · Adobe · reported by AdobeHigh 7.7
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-106633 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-106632 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-106631 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vCVE-2026-106630 · Other software · Adobe · reported by AdobeCritical 9.3
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vCVE-2026-106629 · Other software · Adobe · reported by AdobeCritical 9.3
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-106628 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current uCVE-2026-106626 · Other software · Adobe · reported by AdobeCritical 9.1
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current uCVE-2026-105895 · Other software · Adobe · reported by AdobeCritical 9.9
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could rCVE-2026-103848 · Other software · Adobe · reported by AdobeCritical 9.9
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locCVE-2026-96921 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.CVE-2026-96858 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-96108 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-88093 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevateCVE-2026-88075 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.CVE-2026-85928 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.CVE-2026-85874 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.