Dimension software is affected by an improper input validation vulnerability that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability changes the security scope and allows a low-privileged attacker to execute code, potentially compromising confidentiality, integrity, and availability.
Adobe Experience Manager contains an Incorrect Authorization vulnerability that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. The vulnerability does not require user interaction and affects the security scope, potentially leading to full compromise of confidentiality, integrity, and availability.
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute malicious JavaScript in the victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability impacts confidentiality and integrity but does not affect availability.
Adobe Experience Manager contains an improper input validation vulnerability that allows a low-privileged attacker to bypass security features and gain unauthorized limited read and write access without requiring user interaction. The vulnerability has a medium severity with a CVSS score of 5.4.
Adobe Connect suffers from a path traversal vulnerability that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. This vulnerability does not require user interaction and can lead to elevated access or control over the victim's account or session. The vulnerability changes the security scope and has a high impact on confidentiality and integrity.
Adobe Experience Manager contains a stored Cross-Site Scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields. When a victim visits a page with the vulnerable field, the injected JavaScript may execute in their browser. This vulnerability affects confidentiality and integrity but does not impact availability.
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute malicious JavaScript in the victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically visiting a crafted webpage. The vulnerability changes the security scope and has a medium severity rating.
Adobe Experience Manager contains a critical code injection vulnerability that allows low-privileged attackers to execute arbitrary code without user interaction. The vulnerability affects the context of the current user and changes the security scope. It has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.
Adobe Experience Manager contains a critical code injection vulnerability (CVE-2026-113579) that allows a low-privileged attacker to execute arbitrary code without user interaction. The vulnerability affects the context of the current user and changes the security scope. It has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.
CVE-2025-0027 is a medium severity vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware. It involves improper access control that could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections. This bypass may impact the integrity of SEV-SNP guest memory, potentially undermining the security guarantees of the virtualization environment.
CAI Content Credentials suffers from an Uncontrolled Resource Consumption vulnerability (CWE-400) that can be exploited to cause application denial-of-service by exhausting system resources. This vulnerability does not require user interaction for exploitation and results in reduced application performance.
The Product Filter for WooCommerce by WBW plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in the 'text_no_products' parameter in all versions up to and including 3.4.5. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link.
CVE-2025-54503 is a vulnerability in the Secure Encrypted Virtualization (SEV) firmware involving improper handling of overlapping protected memory ranges. This flaw could allow a privileged attacker to cause misconfigurations in the Reverse Map Table (RMP), potentially leading to loss of memory integrity. The vulnerability has a medium severity with a CVSS score of 5.9. There is no information about available patches or fixes, and no known exploits in the wild have been reported.
A vulnerability in Secure Encrypted Virtualization (SEV) firmware allows a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segmented Reverse Map Table (RMP) is enabled. This could lead to loss of guest data integrity. The vulnerability has a medium severity rating and a CVSS score of 5.9. No affected software versions or patches are specified in the available data.
CAI Content Credentials suffers from a vulnerability involving the use of a broken or risky cryptographic algorithm. This flaw could allow an attacker to bypass security features and gain unauthorized write access without requiring user interaction. Exploitation depends on conditions beyond the attacker's control. The vulnerability has a medium severity rating with a CVSS score of 5.9.
The U.S. Geological Survey Area Species Management Research Program (ARMI) had a vulnerability allowing authenticated remote attackers to upload arbitrary files, including crafted PHP scripts, which could then be executed on the server. This could lead to remote code execution and full compromise of confidentiality, integrity, and availability. The vulnerability was fixed on 2026-07-20.
CVE-2025-52537 is a medium severity vulnerability in the AMD Secure Encrypted Virtualization (SEV) firmware involving improper access control. An attacker with administrative privileges could exploit this flaw to tamper with memory, potentially compromising the integrity of guest memory. No public exploits or patches are currently documented.
CVE-2025-54506 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the AMD SEV Secure Encrypted Virtualization firmware. This flaw could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially compromising guest integrity. The vulnerability has a medium severity rating and no known exploits in the wild. No affected versions or patch information are currently provided.
CVE-2025-52535 is a vulnerability in the AMD Secure Encrypted Virtualization (SEV) firmware involving improper resource reuse. An attacker with hypervisor-level access could exploit this flaw to write to the Reverse Map Table (RMP) protected memory. This may lead to a loss of guest memory integrity, potentially compromising the isolation guarantees of SEV. The vulnerability has a medium severity rating with a CVSS score of 5.9. No patch or remediation information is currently available.
CVE-2025-54504 is a medium severity vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware. It involves insufficient granularity of access control that could allow an attacker with administrative privileges to write to a trusted region used by SEV-Encrypted State (SEV-ES). This may result in loss of integrity of the protected state.