Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2021-40158 | 7.8 high | 3.0% | autodesk, advance_steel, autocad, autocad_architecture | A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundaries when parsing the JT file. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. | 8 Oct |
| CVE-2022-25788 | 7.8 high | 2.0% | autodesk, advance_steel, autocad, autocad_architecture | A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code. | 8 Oct |
| CVE-2021-40159 | 7.8 high | 2.0% | autodesk, advance_steel, autocad, autocad_architecture | An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities may lead to code execution through maliciously crafted JT files in the context of the current process. | 8 Oct |
| CVE-2026-10789 | 9.6 critical | 1.0% | autodesk, fusion | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user. | Sun 25 Oct |
| CVE-2022-27867 | 7.8 high | 1.0% | autodesk, autocad | A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. | 8 Oct |
| CVE-2026-107672 | 8.8 high | 0.00% | no CPE yet | A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user. | 21 h ago |
| CVE-2025-10244 | 8.7 high | 0.00% | autodesk, fusion | A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | 11 Oct |
| CVE-2026-113775 | 7.8 high | 0.00% | no CPE yet | A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process. | 21 h ago |
| CVE-2026-7406 | 7.8 high | 0.00% | autodesk, advance_steel, autocad, autocad_architecture | A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | Sat 24 Oct |
| CVE-2026-8325 | 7.8 high | 0.00% | autodesk, revit | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | Sat 24 Oct |
| CVE-2026-10709 | 7.8 high | 0.00% | autodesk, fbx_software_development_kit | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | Fri 23 Oct |
| CVE-2026-10710 | 7.8 high | 0.00% | autodesk, fbx_software_development_kit | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | Fri 23 Oct |
| CVE-2026-11803 | 7.8 high | 0.00% | autodesk, revit | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | Fri 23 Oct |
| CVE-2026-1289 | 7.8 high | 0.00% | autodesk, revit | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process. | Fri 23 Oct |
| CVE-2026-14478 | 7.8 high | 0.00% | autodesk, installer | A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability. | Fri 23 Oct |
| CVE-2025-10898 | 7.8 high | 0.00% | autodesk, shared_components | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | 19 Oct |
| CVE-2025-10882 | 7.8 high | 0.00% | autodesk, shared_components | A maliciously crafted X_T file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | 19 Oct |
| CVE-2025-8893 | 7.8 high | 0.00% | autodesk, revit, autocad, autocad_architecture | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | 18 Oct |
| CVE-2025-8894 | 7.8 high | 0.00% | autodesk, autocad_plant_3d, advance_steel, civil_3d | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | 18 Oct |
| CVE-2025-8354 | 7.8 high | 0.00% | autodesk, revit | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | 18 Oct |
| CVE-2025-11795 | 7.8 high | 0.00% | autodesk, 3ds_max | A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | 18 Oct |
| CVE-2025-11797 | 7.8 high | 0.00% | autodesk, 3ds_max | A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | 18 Oct |
| CVE-2026-16782 | 7.8 high | 0.00% | autodesk, 3ds_max | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | 12 Oct |
| CVE-2026-16783 | 7.8 high | 0.00% | autodesk, 3ds_max | A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | 12 Oct |
| CVE-2026-19568 | 7.8 high | 0.00% | autodesk, 3ds_max | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | 12 Oct |
| CVE-2026-7455 | 7.8 high | 0.00% | autodesk, 3ds_max | A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | 12 Oct |
| CVE-2025-8892 | 7.8 high | 0.00% | autodesk, shared_components | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | 11 Oct |
| CVE-2023-41139 | 7.8 high | 0.00% | autodesk, autocad, autocad_advance_steel, autocad_architecture | A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process. | 8 Oct |
| CVE-2026-15102 | 7.5 high | 0.00% | no CPE yet | ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services. | 16 Oct |
| CVE-2026-102636 | 7.1 high | 0.00% | no CPE yet | A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | Wed 28 Oct |
| CVE-2026-102637 | 7.1 high | 0.00% | no CPE yet | A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | Wed 28 Oct |
| CVE-2026-102638 | 7.1 high | 0.00% | no CPE yet | A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | Wed 28 Oct |
| CVE-2026-4344 | 7.1 high | 0.00% | autodesk, fusion | A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | Mon 26 Oct |
| CVE-2026-4345 | 7.1 high | 0.00% | autodesk, fusion | A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | Mon 26 Oct |
| CVE-2026-4369 | 7.1 high | 0.00% | autodesk, fusion | A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | Mon 26 Oct |
| CVE-2026-14255 | 5.5 medium | 0.00% | no CPE yet | A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file. | Tue 27 Oct |
| CVE-2026-1288 | 5.5 medium | 0.00% | autodesk, revit | A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition. | Mon 26 Oct |
| CVE-2026-7405 | 5.5 medium | 0.00% | autodesk, advance_steel, autocad, autocad_architecture | A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service | Sat 24 Oct |
| CVE-2026-14479 | 5.5 medium | 0.00% | autodesk, installer | A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM service to terminate unexpectedly, resulting in a denial-of-service condition. | Fri 23 Oct |
| CVE-2026-16781 | 5.5 medium | 0.00% | autodesk, 3ds_max | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. | 12 Oct |
40 of 40
Download these 40 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.