News · NVD CVE API 2.0

• NVD CVE API 2.0 14 Oct

  CVE-2026-110628 · CVSS 9.2

  Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-110628
• NVD CVE API 2.0 14 Oct

  CVE-2026-110616 · CVSS 9.2

  NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-110616
• NVD CVE API 2.0 14 Oct

  CVE-2026-110612 · CVSS 9.3

  vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-110612
• NVD CVE API 2.0 14 Oct

  CVE-2020-37282 · CVSS 9.3

  office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2020-37282
• NVD CVE API 2.0 14 Oct

  CVE-2020-37281 · CVSS 9.2

  Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2020-37281
• NVD CVE API 2.0 14 Oct

  CVE-2026-108065 · CVSS 9.8

  SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-108065
• NVD CVE API 2.0 14 Oct

  CVE-2026-16741 · CVSS 9.8

  Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-16741
• NVD CVE API 2.0 14 Oct

  CVE-2026-16740 · CVSS 9.8

  Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-16740
• NVD CVE API 2.0 14 Oct

  CVE-2026-108291 · CVSS 9.8

  Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-108291
• NVD CVE API 2.0 14 Oct

  CVE-2026-107424 · CVSS 9.8

  Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-107424
• NVD CVE API 2.0 14 Oct

  CVE-2026-14851 · CVSS 9.2

  A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnera

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-14851
• NVD CVE API 2.0 14 Oct

  CVE-2026-104748 · CVSS 9.8

  The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for un

  Fix: 2 public exploits Fix panel

  detailsCVE-2026-104748
• NVD CVE API 2.0 14 Oct

  CVE-2026-89310 · CVSS 9.4

  A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-89310
• NVD CVE API 2.0 14 Oct

  CVE-2026-107594 · CVSS 10.0

  The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-107594
• NVD CVE API 2.0 14 Oct

  CVE-2026-87855 · CVSS 9.8

  The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-87855
• NVD CVE API 2.0 14 Oct

  CVE-2026-104800 · CVSS 9.8

  The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauth

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-104800
• NVD CVE API 2.0 14 Oct

  CVE-2026-97668 · CVSS 9.8

  The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-97668
• NVD CVE API 2.0 14 Oct

  CVE-2026-97657 · CVSS 9.8

  The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omissi

  Fix: 1 public exploit Fix panel

  detailsCVE-2026-97657
• NVD CVE API 2.0 14 Oct

  CVE-2026-110002 · CVSS 9.8

  The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-110002
• NVD CVE API 2.0 14 Oct

  CVE-2026-93388 · CVSS 9.8

  The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This mak

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-93388
• NVD CVE API 2.0 14 Oct

  CVE-2026-92097 · CVSS 9.1

  The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-92097
• NVD CVE API 2.0 14 Oct

  CVE-2026-110392 · CVSS 9.8

  Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-110392
• NVD CVE API 2.0 13 Oct

  CVE-2026-97381 · CVSS 9.9

  Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or resta

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-97381
• NVD CVE API 2.0 13 Oct

  CVE-2026-110165 · google, chrome · CVSS 9.6

  Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  Fix: Microsoft: Release Notes (Microsoft Edge (Chromium-based)) · 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-110165
• NVD CVE API 2.0 13 Oct

  CVE-2026-110161 · google, chrome · CVSS 9.6

  Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)

  Fix: Microsoft: Release Notes (Microsoft Edge (Chromium-based)) · 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-110161
• NVD CVE API 2.0 13 Oct

  CVE-2026-110159 · google, chrome · CVSS 9.6

  Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

  Fix: Microsoft: Release Notes (Microsoft Edge (Chromium-based)); Release Notes (Microsoft Edge (Chromium-based)) · 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-110159
• NVD CVE API 2.0 13 Oct

  CVE-2026-110152 · google, chrome · CVSS 9.6

  Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  Fix: 1 public exploit · Microsoft: Release Notes (Microsoft Edge (Chromium-based)) · 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-110152
• NVD CVE API 2.0 13 Oct

  CVE-2026-110149 · google, chrome · CVSS 9.6

  Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  Fix: Microsoft: Release Notes (Microsoft Edge (Chromium-based)) · 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-110149
• NVD CVE API 2.0 13 Oct

  CVE-2026-110142 · google, chrome · CVSS 9.6

  Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  Fix: Microsoft: Release Notes (Microsoft Edge (Chromium-based)) · 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-110142
• NVD CVE API 2.0 13 Oct

  CVE-2026-110136 · google, chrome · CVSS 9.6

  Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  Fix: Microsoft: Release Notes (Microsoft Edge (Chromium-based)) · 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-110136
• NVD CVE API 2.0 13 Oct

  CVE-2026-93909 · CVSS 9.1

  IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-93909
• NVD CVE API 2.0 13 Oct

  CVE-2026-93895 · CVSS 9.1

  IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-93895
• NVD CVE API 2.0 13 Oct

  CVE-2026-90530 · CVSS 9.3

  ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-90530
• NVD CVE API 2.0 13 Oct

  CVE-2026-75994 · CVSS 9.6

  ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-75994
• NVD CVE API 2.0 13 Oct

  CVE-2026-49950 · CVSS 9.3

  Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-49950
• NVD CVE API 2.0 13 Oct

  CVE-2026-106624 · CVSS 10.0

  ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-106624
• NVD CVE API 2.0 13 Oct

  CVE-2026-106622 · CVSS 10.0

  ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-106622
• NVD CVE API 2.0 13 Oct

  CVE-2026-106621 · CVSS 9.1

  ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-106621
• NVD CVE API 2.0 13 Oct

  CVE-2026-106620 · CVSS 9.6

  ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-106620
• NVD CVE API 2.0 13 Oct

  CVE-2026-106619 · CVSS 9.0

  ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-106619
• NVD CVE API 2.0 13 Oct

  CVE-2026-106612 · CVSS 9.9

  ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-106612
• NVD CVE API 2.0 13 Oct

  CVE-2026-105903 · CVSS 9.9

  ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-105903
• NVD CVE API 2.0 13 Oct

  CVE-2026-105899 · CVSS 10.0

  ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-105899
• NVD CVE API 2.0 13 Oct

  CVE-2026-90532 · CVSS 10.0

  Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-90532
• NVD CVE API 2.0 13 Oct

  CVE-2026-90531 · CVSS 9.6

  Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-90531
• NVD CVE API 2.0 13 Oct

  CVE-2026-83662 · CVSS 9.3

  Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-83662
• NVD CVE API 2.0 13 Oct

  CVE-2026-75732 · CVSS 9.9

  Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-75732
• NVD CVE API 2.0 13 Oct

  CVE-2026-63160 · CVSS 9.1

  Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-63160
• NVD CVE API 2.0 13 Oct

  CVE-2026-63159 · CVSS 9.1

  Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-63159
• NVD CVE API 2.0 13 Oct

  CVE-2026-63158 · CVSS 9.1

  Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-63158

Older