Threat database

Adobe Photoshop 2026 contains an Uncontrolled Search Path Element vulnerability (CWE-427) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.6 and 26.11.6. The scope of the vulnerability is changed, indicating potential impact beyond the initial component.

Adobe Photoshop 2026 contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 27.6 and 26.11.6. The CVSS score is 7.8, indicating a high severity risk.

Adobe Photoshop 2026 contains an integer overflow or wraparound vulnerability that may allow arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction and affects certain versions of Photoshop 2026. The issue has a high severity rating with a CVSS score of 7.8.

Adobe Photoshop 2026 contains a heap-based buffer overflow vulnerability that may allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.6 and 26.11.6. The issue has a high severity rating with a CVSS score of 7.8.

Adobe Photoshop 2026 contains an Integer Overflow or Wraparound vulnerability (CWE-190) that may allow arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction and affects certain versions of Photoshop 2026. The issue has a high severity rating with a CVSS score of 7.8.

Adobe Illustrator Desktop 2026 contains an improper input validation vulnerability that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 30.7 and 29.8.10. The scope of the vulnerability is changed, indicating potential impact beyond the initial component.

Adobe Illustrator Desktop 2026 contains an Incorrect Authorization vulnerability (CWE-863) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 30.7 and 29.8.10. The scope of the vulnerability is changed, indicating a potential impact beyond the initially affected component.

Adobe Illustrator Desktop 2026 contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 30.7 and 29.8.10. The CVSS 3.1 base score is 7.8, indicating high severity.

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form fields. When a victim accesses a page with the vulnerable field, the malicious JavaScript may execute in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating with a CVSS score of 9.3.

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form fields. When a victim visits a page with the vulnerable field, the malicious script may execute in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating.

CVE-2026-77109 is an Incorrect Authorization vulnerability in Adobe Commerce that allows an attacker to escalate privileges and gain elevated access to restricted resources without requiring user interaction. The vulnerability changes the security scope and has a high severity rating with a CVSS score of 8.6.

Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Photoshop Mobile for Android contains a session fixation vulnerability that could allow an attacker to escalate privileges by exploiting a victim's interaction with a malicious webpage. The vulnerability affects versions up to 1.6.0.2299 and requires user interaction. The scope of the vulnerability is changed, indicating a potential impact beyond the initially affected component.

Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Animate 2023 contains a code injection vulnerability (CWE-94) that allows an attacker with low privileges to execute arbitrary code in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 23.0.16 and 24.0.14. The scope of impact is changed, indicating potential privilege or security boundary changes during exploitation.