Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
405,578 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-63169 | 5.3 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe | Oct 13, 2026 |
| CVE-2026-19810 | 5.4 Medium | Cross-Site Scripting (XSS) in Symantec Endpoint Detection and Response Console | Oct 13, 2026 |
| CVE-2026-63168 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass | Oct 13, 2026 |
| CVE-2026-63157 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Links Module | Oct 13, 2026 |
| CVE-2026-63156 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter | Oct 13, 2026 |
| CVE-2026-63148 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename | Oct 13, 2026 |
| CVE-2026-103852 | 5.5 Medium | Substance3D - Stager | NULL Pointer Dereference (CWE-476) | Oct 13, 2026 |
| CVE-2026-103832 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103842 | 7.8 High | Substance3D - Stager | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103836 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103835 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103837 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103833 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103834 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103841 | 7.8 High | Substance3D - Stager | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103839 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103850 | 5.5 Medium | Substance3D - Stager | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103838 | 7.8 High | Substance3D - Stager | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103851 | 7.8 High | Substance3D - Stager | Stack-based Buffer Overflow (CWE-121) | Oct 13, 2026 |
| CVE-2026-103840 | 7.8 High | Substance3D - Stager | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103830 | 7.8 High | Substance3D - Stager | Stack-based Buffer Overflow (CWE-121) | Oct 13, 2026 |
| CVE-2026-103843 | 7.8 High | Substance3D - Stager | Use After Free (CWE-416) | Oct 13, 2026 |
| CVE-2026-63147 | 5.1 Medium | Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name | Oct 13, 2026 |
| CVE-2026-63172 | 7.1 High | Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit | Oct 13, 2026 |
| CVE-2026-63161 | 8.6 High | Omnispace Agora Project < 26.10.0 Session Fixation via Authentication | Oct 13, 2026 |
| CVE-2026-63174 | 8.6 High | Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList | Oct 13, 2026 |
| CVE-2026-63153 | 8.6 High | Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() | Oct 13, 2026 |
| CVE-2026-63165 | 8.6 High | Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter | Oct 13, 2026 |
| CVE-2026-63152 | 8.6 High | Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter | Oct 13, 2026 |
| CVE-2026-63163 | 8.7 High | Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload | Oct 13, 2026 |
| CVE-2026-63162 | 8.7 High | Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter | Oct 13, 2026 |
| CVE-2026-103846 | 8.6 High | Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79) | Oct 13, 2026 |
| CVE-2026-103845 | 8.6 High | Dimension | Uncontrolled Search Path Element (CWE-427) | Oct 13, 2026 |
| CVE-2026-103855 | 5.5 Medium | Dimension | NULL Pointer Dereference (CWE-476) | Oct 13, 2026 |
| CVE-2026-103844 | 7.8 High | Dimension | Out-of-bounds Write (CWE-787) | Oct 13, 2026 |
| CVE-2026-103854 | 7.8 High | Dimension | Stack-based Buffer Overflow (CWE-121) | Oct 13, 2026 |
| CVE-2026-103853 | 5.5 Medium | Dimension | Out-of-bounds Read (CWE-125) | Oct 13, 2026 |
| CVE-2026-103847 | 8.6 High | Dimension | Untrusted Search Path (CWE-426) | Oct 13, 2026 |
| CVE-2026-63154 | 8.7 High | Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[] | Oct 13, 2026 |
| CVE-2026-63160 | 9.1 Critical | Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage | Oct 13, 2026 |
| CVE-2026-63159 | 9.1 Critical | Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover | Oct 13, 2026 |
| CVE-2026-63158 | 9.1 Critical | Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies | Oct 13, 2026 |
| CVE-2026-63149 | 9.1 Critical | Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() | Oct 13, 2026 |
| CVE-2026-90532 | 10.0 Critical | Adobe Experience Manager | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-90531 | 9.6 Critical | Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | Oct 13, 2026 |
| CVE-2026-83960 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-83958 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-83662 | 9.3 Critical | Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) | Oct 13, 2026 |
| CVE-2026-75732 | 9.9 Critical | Adobe Experience Manager | Incorrect Authorization (CWE-863) | Oct 13, 2026 |
| CVE-2026-48398 | 5.4 Medium | Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.