THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,973 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-103828 — Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103828Read original ↗ (opens in a new tab) - NVD
CVE-2026-103827 — Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103827Read original ↗ (opens in a new tab) - NVD
CVE-2026-103826 — Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103826Read original ↗ (opens in a new tab) - NVD
CVE-2026-103825 — Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103825Read original ↗ (opens in a new tab) - NVD
CVE-2026-103824 — Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103824Read original ↗ (opens in a new tab) - NVD
CVE-2026-103823 — Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103823Read original ↗ (opens in a new tab) - NVD
CVE-2026-103822 — Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103822Read original ↗ (opens in a new tab) - NVD
CVE-2026-103821 — Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103821Read original ↗ (opens in a new tab) - NVD
CVE-2026-101294 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 coul…
High · CVSS 3.1 8.7 · Assessor: [email protected]
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
CVE-2026-101294Read original ↗ (opens in a new tab) - NVD
CVE-2026-100131 — Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100131Read original ↗ (opens in a new tab) - NVD
CVE-2026-100130 — Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100130Read original ↗ (opens in a new tab) - NVD
CVE-2026-100129 — Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100129Read original ↗ (opens in a new tab) - NVD
CVE-2026-100128 — Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100128Read original ↗ (opens in a new tab) - NVD
CVE-2026-100127 — Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100127Read original ↗ (opens in a new tab) - NVD
CVE-2026-100126 — Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker cou…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100126Read original ↗ (opens in a new tab) - NVD
CVE-2026-100112 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100112Read original ↗ (opens in a new tab) - NVD
CVE-2026-100111 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100111Read original ↗ (opens in a new tab) - NVD
CVE-2026-90532 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code executi…
Critical · CVSS 3.1 10.0 · Assessor: [email protected]
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-90532Read original ↗ (opens in a new tab) - NVD
CVE-2026-90531 — Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that…
Critical · CVSS 3.1 9.6 · Assessor: [email protected]
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-90531Read original ↗ (opens in a new tab) - NVD
CVE-2026-86022 — VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double qu…
High · CVSS 3.1 7.0 · Assessor: [email protected]
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the…
CVE-2026-86022Read original ↗ (opens in a new tab) - NVD
CVE-2026-86016 — VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extr…
High · CVSS 3.1 8.2 · Assessor: [email protected]
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files a…
CVE-2026-86016Read original ↗ (opens in a new tab) - NVD
CVE-2026-83960 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-83960Read original ↗ (opens in a new tab) - NVD
CVE-2026-83958 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-83958Read original ↗ (opens in a new tab) - NVD
CVE-2026-83662 — Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Critical · CVSS 3.1 9.3 · Assessor: [email protected]
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVE-2026-83662Read original ↗ (opens in a new tab) - NVD
CVE-2026-75732 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code executi…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-75732Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.