Threat database

Adobe FrameMaker 2026 contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires a user to open a specially crafted malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS score is 5.5, indicating medium severity.

Adobe FrameMaker 2026 contains a heap-based buffer overflow vulnerability that can lead to arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction and affects certain versions of the software. The issue has a high severity rating with a CVSS score of 7.8.

Adobe FrameMaker 2026 contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866.

Adobe FrameMaker 2026 contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects multiple versions up to 18.0.0.206 and 17.0.9.866. The CVSS 3.1 base score is 7.8, indicating high severity.

Adobe FrameMaker 2026 contains a Use After Free vulnerability (CWE-416) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS 3.1 base score is 7.8, indicating high severity.

Adobe FrameMaker 2026 contains a heap-based buffer overflow vulnerability that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects multiple versions up to 18.0.0.206 and 17.0.9.866. No patch information is provided.

Adobe FrameMaker 2026 contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS 3.1 score is 7.8, indicating high severity.

Adobe FrameMaker 2026 contains an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS score is 5.5, indicating a medium severity level.

CVE-2026-95631 is an improper input validation vulnerability in Adobe Commerce that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerability changes the security scope and could lead to significant impact on integrity and availability.

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-92910 is an Incorrect Authorization vulnerability in Adobe Commerce that allows an attacker to bypass security features and gain unauthorized read and limited write access without requiring user interaction. The vulnerability changes the security scope and has a high severity rating.

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into vulnerable form fields. When a victim visits a page with the injected script, the malicious JavaScript executes in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating with a CVSS score of 9.3.

CVE-2026-92464 is an improper input validation vulnerability in Adobe Commerce that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerability affects the context of the current user and changes the security scope. It is rated critical with a CVSS score of 9.1.

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim accesses the affected page, the malicious JavaScript executes in their browser, potentially allowing the attacker to gain elevated access or control over the victim's account or session. This vulnerability changes the security scope and has a high severity rating.

Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security controls and gain unauthorized read and write access. This can cause limited disruption to availability. Exploitation does not require user interaction. The vulnerability is rated high severity with a CVSS score of 8.3.

Adobe Commerce contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to execute arbitrary code in the context of the current user without requiring user interaction. This vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form fields. When a victim accesses the affected page, the malicious script may execute in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating with a CVSS score of 9.3.

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields. When victims visit the affected pages, the injected scripts may execute in their browsers, potentially leading to elevated access or control over their accounts or sessions. This vulnerability has a high severity score of 8.7 and affects version 0 of Adobe Commerce. No patch or remediation information is currently provided.

Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.