Search vulnerabilities

Expected end of text, found '–' (at char 44), (line:1, col:45)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2026-83958

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager Experience Manager Cloud Service
CVE-2026-70125

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2021 Office 2024
CVE-2026-107253

Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Orphans Media
CVE-2026-62122

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Arraytics Wordpress-extensions
Products
Booktics Booktics
CVE-2026-119260

chromium-browser: Use after free in Frames

Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-79880

Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8

A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-110081

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager
CVE-2026-110082

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager
CVE-2026-110083

Adobe Experience Manager | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager
CVE-2026-93577

Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-89078

Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-110084

Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)

Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager
CVE-2026-79883

Unauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensitive Information Disclosure in AOS-10

A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-109763

Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-68482

Apache Answer: Improper Authorization in Question Invite User Lookup

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Answer Apache Answer
CVE-2026-62298

asn1c: ASAN crash with decode of open types

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer_get` in `OPEN_TYPE_oer.c`, and `OPEN_TYPE_uper_get` in `OPEN_TYPE_uper.c` share the pattern: a conditional null check on `*memb_ptr2` resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the `OPEN TYPE` member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for `E2connectionUpdateAcknowledge`, notes that `E2AP` uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mouse07410
Products
Asn1c