Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,135 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-90531 | 9.6 Critical | Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | Oct 13, 2026 |
| CVE-2026-83960 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-83958 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-83662 | 9.3 Critical | Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-75732 | 9.9 Critical | Adobe Experience Manager | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-48398 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-48383 | 10.0 Critical | Adobe Experience Manager | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-48382 | 10.0 Critical | Adobe Experience Manager | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-110084 | 7.1 High | Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91) | Oct 13, 2026 |
| CVE-2026-110083 | 7.1 High | Adobe Experience Manager | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | Oct 13, 2026 |
| CVE-2026-110082 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110081 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110080 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110079 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110078 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110077 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110076 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110075 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110074 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110073 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-110037 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-109415 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-107682 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-107305 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-106634 | 7.7 High | Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Oct 13, 2026 |
| CVE-2026-106633 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-106632 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-106631 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-106630 | 9.3 Critical | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-106629 | 9.3 Critical | Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-106628 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-106626 | 9.1 Critical | Adobe Experience Manager | Improper Input Validation (CWE-20) | Oct 13, 2026 |
| CVE-2026-105895 | 9.9 Critical | Adobe Experience Manager | Improper Input Validation (CWE-20) | Oct 13, 2026 |
| CVE-2026-63146 | 9.3 Critical | Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php | Oct 13, 2026 |
| CVE-2026-103848 | 9.9 Critical | Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | Oct 13, 2026 |
| CVE-2026-110005 | 8.8 High | Moghtech Komodo contains an OS command injection vulnerability | Oct 13, 2026 |
| CVE-2026-104252 | 9.8 Critical | Vitess vttablet /twopcz reflected XSS | Oct 13, 2026 |
| CVE-2026-16753 | 8.8 High | CVE-2026-16753 | Oct 13, 2026 |
| CVE-2026-86022 | 7.0 High | VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling | Oct 13, 2026 |
| CVE-2026-86016 | 8.2 High | VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration | Oct 13, 2026 |
| CVE-2026-55601 | 7.3 High | MultiTail: Shell injection in execute-on-match command handling | Oct 13, 2026 |
| CVE-2026-56826 | 5.4 Medium | Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration | Oct 13, 2026 |
| CVE-2026-104875 | 7.1 High | Ente: Accepted emergency contact can bypass the recovery notice period | Oct 13, 2026 |
| CVE-2026-110256 | 6.3 Medium | Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth | Oct 13, 2026 |
| CVE-2026-110255 | 8.4 High | Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint | Oct 13, 2026 |
| CVE-2026-110254 | 5.3 Medium | Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory | Oct 13, 2026 |
| CVE-2026-110130 | 10.0 Critical | Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check | Oct 13, 2026 |
| CVE-2026-110112 | 9.2 Critical | Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation | Oct 13, 2026 |
| CVE-2026-110111 | 7.7 High | Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi | Oct 13, 2026 |
| CVE-2026-102599 | 7.5 High | Socket.IO: Engine.IO Protocol Revision Mismatch DoS | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.