PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

18,799 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-110073 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

    CVE-2026-110073
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-110037 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

    CVE-2026-110037
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-110005 — The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerab…

    High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host…

    CVE-2026-110005
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-109415 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

    CVE-2026-109415
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-107682 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

    CVE-2026-107682
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-107305 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

    CVE-2026-107305
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-106634 — Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu…

    High · CVSS 3.1 7.7 · Assessor: [email protected]

    Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.

    CVE-2026-106634
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-106633 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

    CVE-2026-106633
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-106632 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

    CVE-2026-106632
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-106631 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

    CVE-2026-106631
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-106630 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacke…

    Critical · CVSS 3.1 9.3 · Assessor: [email protected]

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

    CVE-2026-106630
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-106629 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacke…

    Critical · CVSS 3.1 9.3 · Assessor: [email protected]

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

    CVE-2026-106629
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-106628 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

    CVE-2026-106628
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-106626 — Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execu…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

    CVE-2026-106626
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-105895 — Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execu…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

    CVE-2026-105895
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-104252 — Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/v…

    Critical · CVSS 3.1 9.8 · Assessor: [email protected]

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vtta…

    CVE-2026-104252
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-103855 — Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-103855
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-103854 — Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the co…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-103854
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-103853 — Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-103853
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-103852 — Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-103852
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-103851 — Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code executio…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-103851
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-103850 — Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-103850
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-103848 — Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command In…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

    CVE-2026-103848
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-103847 — Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context…

    High · CVSS 3.1 8.6 · Assessor: [email protected]

    Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.

    CVE-2026-103847
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.