GFI KerioConnect versions before 10.0.8 Patch 2 contain a stored cross-site scripting (XSS) vulnerability in the Webmail component. This flaw allows remote attackers to execute JavaScript in an authenticated user's Webmail session by uploading a crafted SVG email attachment that bypasses sanitization. Exploitation leverages the temporary-download endpoint's weak Content-Security-Policy sandbox, enabling script execution upon opening the attachment. This can lead to theft of user credentials and mailbox contents. Proofpoint Threat Research has observed active exploitation in the wild targeting credential and mailbox theft.
EPICS Base versions 7.0.10 and earlier contain an integer overflow vulnerability in network request processing. This flaw can lead to incorrect memory allocation sizes, potentially causing memory corruption, denial of service, or remote code execution if exploited.
A vulnerability in Autodesk Fusion desktop application allows a maliciously crafted dynamic library loaded via the TextCommands.LoadDll command to execute arbitrary code. This occurs due to an exposed dangerous function that can be triggered when loading a DLL from an arbitrary path. The vulnerability has a high severity rating with a CVSS score of 7.8.
CVE-2026-109090 is a heap overflow vulnerability in libXi versions before 1.8.4. It occurs when a malicious X server sends an excessively large DEVICE_ENABLE reply, which is improperly handled by libXi. This flaw can lead to high impact on confidentiality, integrity, and availability.
A buffer overflow vulnerability exists in libXi before version 1.8.4 when handling DEVICE_RESOLUTION. This flaw could cause a heap overflow triggered by a malicious X server, potentially leading to high impact on confidentiality, integrity, and availability.
Private keys for eight eMudhra intermediate CA certificates have been compromised, affecting the trust of certificates used by HCL Notes Client for outbound network requests. This vulnerability allows an unauthenticated network attacker to spoof server certificates and perform man-in-the-middle (MITM) attacks, potentially intercepting or modifying outbound TLS traffic.
CVE-2026-108142 is a critical vulnerability in the CDP Coordinator Service that allows an unauthenticated attacker to bypass authorization controls. This flaw enables unauthorized access without requiring user interaction or privileges.
This vulnerability allows an authenticated user with the Restore Operator role, who can control the contents of a backed-up NAS share, to perform relative path traversal and write attacker-controlled files to arbitrary paths on the backup server. The flaw requires high privileges and user interaction is not needed. The vulnerability has a medium severity rating with a CVSS score of 5.9. No affected versions or patches are specified in the available data.
A vulnerability in libXtst versions before 1.2.6 allows a malicious X server to send malformed RECORD EnableContext replies that cause an X client using the parse_reply_call_callback function to enter an endless loop. This results in a denial of service condition due to resource exhaustion.
This vulnerability allows an authenticated user with the Restore Operator role, who can control the contents of a backed-up NAS share, to perform relative path traversal and write attacker-controlled files to arbitrary paths on the backup server.
Private keys for eight eMudhra intermediate CA certificates have been compromised, affecting the trust of certificates used by HCL Domino Server for outbound network requests. This compromise allows an unauthenticated network attacker to spoof server certificates and perform man-in-the-middle (MITM) attacks, potentially intercepting or modifying outbound TLS traffic. The vulnerability is critical with a CVSS score of 9.1. No specific affected software versions or patches have been provided.
This vulnerability allows an attacker who already has valid Administrator credentials to bypass multi-factor authentication (MFA) by disabling MFA globally before completing the verification process. It affects systems where MFA enforcement can be disabled by an administrator prior to authentication completion.
This vulnerability allows an unauthenticated attacker to bypass REST API authentication by using a forged federation token. The attacker can receive responses from REST API endpoints that do not invoke the Veeam Backup for Microsoft 365 backup service. The vulnerability has a medium severity rating with a CVSS score of 6.9.
Adobe Campaign Classic (ACC) suffers from a critical SQL Injection vulnerability (CVE-2026-105781) that allows an attacker to execute arbitrary SQL commands without user interaction. This flaw could lead to arbitrary code execution in the context of the current user, potentially enabling elevated access or control over the victim's account or session. The vulnerability impacts confidentiality, integrity, and availability with a CVSS score of 10. No affected versions or patch information are provided.
CVE-2026-106077 is a high-severity vulnerability in Veeam Backup for Microsoft 365 that allows a user with the Administrator role to read arbitrary files on the backup server with LocalSystem privileges. This flaw could lead to unauthorized access to sensitive data stored on the backup server. The vulnerability has a CVSS 4.0 base score of 8.3, indicating significant impact if exploited. No patch or remediation information is currently provided, and no known exploits are reported in the wild.
This vulnerability in Veeam Backup for Microsoft 365 allows an authenticated organization-transfer peer to perform SQL injection on the source server's configuration database. Exploitation can lead to unauthorized cross-tenant read and write access to configuration data and remote code execution with the privileges of the PostgreSQL service account. The vulnerability is rated critical with a CVSS 4.0 score of 9.0. No affected versions or patch information are provided.
Adobe Campaign Classic (ACC) suffers from an Incorrect Authorization vulnerability that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. The vulnerability does not require user interaction and affects the security scope, potentially leading to full compromise of confidentiality, integrity, and availability.
Adobe Campaign Classic (ACC) is affected by a critical SQL Injection vulnerability (CVE-2026-105779) that allows a low-privileged attacker to bypass security features and gain unauthorized read and limited write access without user interaction. The vulnerability changes the security scope and poses a significant risk to confidentiality, integrity, and availability.
Adobe Campaign Classic (ACC) suffers from a critical SQL Injection vulnerability that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects the scope of the application and can lead to complete compromise of confidentiality, integrity, and availability.
Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-104350). This vulnerability allows an attacker to inject malicious scripts into web pages viewed by victims, potentially leading to elevated access or control over the victim's account or session. Exploitation requires user interaction, such as visiting a crafted URL or interacting with a compromised page. The vulnerability has a critical severity with a CVSS score of 9.3.