Missing authorization in the Windows SMB Server component allows a locally authenticated attacker with low privileges to read sensitive information they are not authorized to access. The flaw, rooted in CWE-862, means the SMB Server fails to enforce proper authorization checks before returning data to a requesting principal. Affecting Windows 10, Windows 11, and Windows Server 2016 through 2025, this is a moderate-severity confidentiality issue with no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows exposes high-impact local information disclosure to low-privileged authenticated users. The flaw spans a wide swath of Windows releases - from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 - making the remediation surface unusually broad. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the confidentiality impact is rated high because an out-of-bounds read can expose arbitrary kernel or process memory contents.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Out-of-bounds read in the Windows Push Message Routing Service exposes process or kernel memory to a locally authenticated attacker, resulting in sensitive information disclosure. The vulnerability affects a wide range of Microsoft Windows releases spanning Windows 10 through Windows 11 and Windows Server 2016 through 2025, making patch surface substantial across enterprise environments. No public exploit code has been identified at time of analysis, and the attack is constrained to local execution with standard user privileges.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Windows XML Paper Specification (XPS) document handler allows a locally-authenticated standard user to disclose memory contents from the affected process. The flaw spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker with low-level privileges to inject malicious scripts into pages rendered by SharePoint, enabling spoofing attacks against other authenticated users. The flaw is classified CWE-79 and confirmed by Microsoft (secure@microsoft.com) with a vendor patch available targeting builds below 16.0.20326.20090. No public exploit code has been identified and the vulnerability does not appear in CISA KEV.
An authenticated stored cross-site scripting flaw in the Column Management component of ClassCMS 1CMS v5.6 lets an attacker with a valid low-privileged account inject a crafted payload into the title field, which is persisted and later rendered to other users. When a victim views the poisoned column listing, arbitrary script or HTML executes in their browser session, enabling session theft, credential harvesting, or actions performed as the victim. EPSS places exploitation probability at roughly 0.34% (27th percentile) and there is no CISA KEV listing, though a public proof-of-concept repository referencing this CVE has been published.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to permanently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected deployments include AEM 6.5 LTS up to SP2, AEM 6.5 up to 6.5.24, and AEM as a Cloud Service up to 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity attack path and broad AEM deployment make this a meaningful persistent threat in content-rich enterprise environments.
Stored Cross-Site Scripting in Adobe Experience Manager 6.5 LTS (≤SP2), AEM 6.5 (≤6.5.24), and AEM as a Cloud Service (≤2026.7.0) allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields of the authoring interface. When any other authenticated user visits the page containing the injected payload, the script executes in their browser under the site's origin with a changed scope, enabling session token theft or unauthorized actions on the victim's behalf. No public exploit code or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released patches under advisory APSB26-98; no public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious scripts into vulnerable form fields. When any user - including administrators - subsequently browses the affected page, the injected JavaScript executes in their browser context, enabling session hijacking, credential theft, or UI redress attacks. Affected versions span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-browses a page containing the injected content, the script executes in their browser, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. The scope-changed CVSS vector confirms the attack crosses security boundaries, affecting users beyond the injecting account. No public exploit code and no CISA KEV listing are present at time of analysis.
Stored cross-site scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes silently in any victim's browser upon page load. The vulnerability spans AEM 6.5 up to 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to build 2026.7.0, per Adobe security bulletin APSB26-98. Because the scope changes to the victim's browser context, a successful injection enables session token theft, credential harvesting, or further client-side attacks against any user - including administrators - who visits the poisoned content.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change flag (S:C) signals that injected scripts escape the AEM application trust boundary and execute in the victim browser's security context; no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields across the authoring interface. When any victim - including higher-privileged users such as administrators - browses to the page rendering the stored payload, the script executes in their browser, enabling session token theft, unauthorized content manipulation, or further actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; Adobe has released fixes via security advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently navigates to the affected page. The scope-changed CVSS vector (S:C) confirms that injected scripts operate within the victim's browser security context, enabling session hijacking, credential theft, or unauthorized AEM actions against higher-privileged users. Adobe has issued advisory APSB26-98 covering AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), as documented in Adobe advisory APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that renders the affected page. The vulnerability affects AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit code or active exploitation has been identified at time of analysis, and Adobe has addressed this in advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user browses to the affected page, the script executes in their browser within a changed scope context - enabling session theft, credential harvesting, or UI redressing against higher-privileged users. No public exploit code and no CISA KEV listing at time of analysis, but the low complexity and network accessibility make this straightforward to exploit by any authenticated user with form-submission rights.
Stored XSS in Adobe Experience Manager enables a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields within the content authoring interface. When any user - including privileged editors or administrators - navigates to the affected page, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf. Adobe addressed this under advisory APSB26-98; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-visits the page containing the injected content, the script executes in their browser under a changed scope (S:C), enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to pages containing the poisoned fields, the injected script executes in their browser under the AEM origin, enabling session token theft, credential harvesting, or UI redirection. Three deployment lines are affected: AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When a higher-privileged user (such as an administrator) browses the affected page, the script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. The scope change (S:C in CVSS) signals that injected scripts can operate outside the application's own origin, amplifying the effective impact beyond the application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the page containing the injected payload, the script executes in their browser context, crossing scope boundaries into the victim's session. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2, as confirmed by APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently visits the affected page. The scope-changed nature of this flaw (S:C in CVSS) means the attacker's script runs within the victim's browser security context, enabling session token theft, credential harvesting, or further client-side attacks. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit code or KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the CMS. When any user-including administrators-browses to a page containing the injected content, the script executes in their browser under a changed security context (S:C), enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit or active exploitation confirmed via CISA KEV at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the authoring environment. When any higher-privileged user subsequently browses the affected page, the script executes in their browser within a changed scope, potentially enabling session theft or unauthorized actions. Adobe has issued advisory APSB26-98 covering AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0; no public exploit or CISA KEV listing has been identified.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to persist malicious JavaScript payloads in vulnerable form fields, which then execute in any victim's browser upon page visit. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed the issue in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager permits low-privileged authenticated users to inject persistent JavaScript payloads into vulnerable form fields within the CMS authoring interface. When any user - including administrators - browses a page containing the injected field, their browser executes the attacker's script in the context of the AEM domain, with scope change confirming cross-boundary impact. All AEM 6.5 versions through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 build are affected; remediation is available via Adobe APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of other users - including administrators - when they visit the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or CISA KEV listing has been identified at time of analysis; the scope-changed CVSS vector reflects the cross-user browser impact.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject malicious JavaScript into vulnerable form fields, where it persists server-side and executes in any victim's browser upon visiting the affected page. Three release tracks are affected: AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed impact means attacker-controlled scripts run in victim browser contexts - including those of administrators - enabling session hijacking, credential theft, or unauthorized actions on behalf of higher-privileged users. No public exploit or CISA KEV listing identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 through 6.5.24 and 6.5 LTS through SP2 (on-premises), as well as AEM as a Cloud Service through the July 2026 release (2026.7.0). Adobe has published advisory APSB26-98 confirming the scope-changed impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields that persists and executes in the browsers of other users who visit the affected page. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed nature of the vulnerability means the attacker's payload crosses from the AEM application context into victim browser sessions, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated low-privilege attackers to inject and execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed CVSS vector indicates successful exploitation can cross session boundaries, enabling session token theft or unauthorized actions beyond the attacker's direct privilege level - though exploitation requires both a valid AEM credential and victim interaction via a crafted page. No public exploit code and no CISA KEV listing exist at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks without sanitization. Affected releases span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no confirmed active exploitation or public proof-of-concept code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privilege attackers to execute arbitrary JavaScript in the browser context of targeted users who visit a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Adobe addressed this in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the DOM environment through a crafted webpage. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is documented under Adobe APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject malicious JavaScript that executes within a victim's browser context, with scope changing beyond AEM's own origin. Three product lines are affected: AEM 6.5, AEM 6.5 LTS, and AEM as a Cloud Service through their respective latest releases at time of disclosure. Exploitation requires user interaction - the victim must navigate to an attacker-crafted URL while authenticated - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-changed CVSS vector indicates impact can extend beyond the AEM application boundary into the victim's broader browser session; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted URL or webpage. All three AEM delivery models are affected - on-premises 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has published Security Bulletin APSB26-98 addressing this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL. All currently supported AEM deployment models are affected - Cloud Service through 2026.7.0, on-premises 6.5 through 6.5.24, and 6.5 LTS through SP2. The scope change in the CVSS vector indicates the JavaScript executes in a context beyond the vulnerable component itself, potentially enabling session hijacking or privilege escalation within the AEM environment. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DOM-based XSS in Adobe Experience Manager enables an authenticated attacker to inject malicious JavaScript that executes within a victim's browser by manipulating client-side DOM sinks on crafted or attacker-influenced AEM pages. Affected deployments span AEM 6.5 on-premises through version 6.5.24, the 6.5 LTS track through SP2, and AEM as a Cloud Service through the 2026.7.0 release channel. Adobe has addressed the issue in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-adjacent, low-privileged attacker to execute arbitrary JavaScript within a victim's browser session by luring them to a crafted webpage. The vulnerability arises from unsanitized attacker-controlled data being written into the DOM without server-side involvement, enabling script execution in a changed security scope (S:C). Exploitation requires user interaction and no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables an authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sources and sinks via a crafted webpage. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 (≤6.5.24), and AEM 6.5 LTS (≤SP2), as confirmed by Adobe APSB26-98. The CVSS scope-change metric (S:C) indicates the payload escapes the AEM application context and can affect the victim's broader browser environment; no public exploit identified at time of analysis.