Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows exposes high-impact local information disclosure to low-privileged authenticated users. The flaw spans a wide swath of Windows releases - from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 - making the remediation surface unusually broad. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the confidentiality impact is rated high because an out-of-bounds read can expose arbitrary kernel or process memory contents.
Out-of-bounds read in Windows Print Spooler Components exposes local kernel or heap memory to low-privileged authenticated users across multiple Windows 10, Windows 11, and Windows Server releases. An authorized local attacker can trigger the CWE-125 defect to read beyond the bounds of an allocated buffer, leaking sensitive data - with no integrity or availability impact. A vendor-released patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local information disclosure in the Windows MIDI Service Module allows a low-privileged authenticated local user to read sensitive system information outside its intended authorization boundary. Affecting Windows 11 versions 24H2, 25H2, and 26H1, the flaw (CWE-497) enables an attacker already present on the system to extract data that should be inaccessible to their privilege level. Microsoft has released patches for all three affected branches; no public exploit code or active exploitation has been identified.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Windows License Manager on multiple Windows 10, 11, and Server editions exposes sensitive system licensing data to locally authenticated low-privileged users due to CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). An attacker with an existing local session can read confidential licensing information — such as activation data, product identifiers, or licensing metadata — without authorization. No public exploit code and no CISA KEV listing have been identified; vendor patches are available for all affected versions, reducing urgency for patched environments.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Out-of-bounds read in the Windows Push Message Routing Service exposes process or kernel memory to a locally authenticated attacker, resulting in sensitive information disclosure. The vulnerability affects a wide range of Microsoft Windows releases spanning Windows 10 through Windows 11 and Windows Server 2016 through 2025, making patch surface substantial across enterprise environments. No public exploit code has been identified at time of analysis, and the attack is constrained to local execution with standard user privileges.
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing all affected builds.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Use-after-free in the Windows Network Connection Broker service allows a local authenticated attacker to read stale heap memory, disclosing potentially sensitive information. The vulnerability spans every supported Windows client and server release from Windows 10 1607 and Windows Server 2016 through Windows 11 25H2 and Windows Server 2025, making the exposed surface extremely broad. Microsoft has shipped patched cumulative updates for all affected SKUs; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows XML Paper Specification (XPS) document handler allows a locally-authenticated standard user to disclose memory contents from the affected process. The flaw spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Sensitive information disclosure in the Windows Program Compatibility Assistant (PCA) Service allows a locally authenticated attacker with standard user privileges to read sensitive data written to log files. Affected systems include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both full and Server Core configurations. No public exploit code or active exploitation has been identified at time of analysis, and vendor-released patches are available via Microsoft's update guide.
Uninitialized resource use in the Microsoft Account component on Windows allows a low-privileged local attacker to disclose sensitive information from memory. Affecting a broad swath of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - the flaw exposes high-confidentiality data (potentially account tokens, credentials, or session state) with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Use-after-free (CWE-416) in Microsoft Office Word enables a locally authenticated attacker to disclose sensitive memory contents. Exploitation requires only low-privileged local access with no user interaction, yielding high confidentiality impact per the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update mechanism.
Symlink following in Windows UPnP Device Host (upnphost) allows a locally authenticated, low-privileged attacker to redirect the service's file access operations through crafted symbolic links or junctions, disclosing the contents of otherwise inaccessible files. The vulnerability spans an unusually wide set of affected Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - indicating a systemic deficiency in how the UPnP host service resolves paths before file access. Microsoft has released corrective patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker with low-level privileges to inject malicious scripts into pages rendered by SharePoint, enabling spoofing attacks against other authenticated users. The flaw is classified CWE-79 and confirmed by Microsoft (secure@microsoft.com) with a vendor patch available targeting builds below 16.0.20326.20090. No public exploit code has been identified and the vulnerability does not appear in CISA KEV.
An authenticated stored cross-site scripting flaw in the Column Management component of ClassCMS 1CMS v5.6 lets an attacker with a valid low-privileged account inject a crafted payload into the title field, which is persisted and later rendered to other users. When a victim views the poisoned column listing, arbitrary script or HTML executes in their browser session, enabling session theft, credential harvesting, or actions performed as the victim. EPSS places exploitation probability at roughly 0.34% (27th percentile) and there is no CISA KEV listing, though a public proof-of-concept repository referencing this CVE has been published.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to permanently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected deployments include AEM 6.5 LTS up to SP2, AEM 6.5 up to 6.5.24, and AEM as a Cloud Service up to 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity attack path and broad AEM deployment make this a meaningful persistent threat in content-rich enterprise environments.
Stored Cross-Site Scripting in Adobe Experience Manager 6.5 LTS (≤SP2), AEM 6.5 (≤6.5.24), and AEM as a Cloud Service (≤2026.7.0) allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields of the authoring interface. When any other authenticated user visits the page containing the injected payload, the script executes in their browser under the site's origin with a changed scope, enabling session token theft or unauthorized actions on the victim's behalf. No public exploit code or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released patches under advisory APSB26-98; no public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious scripts into vulnerable form fields. When any user - including administrators - subsequently browses the affected page, the injected JavaScript executes in their browser context, enabling session hijacking, credential theft, or UI redress attacks. Affected versions span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-browses a page containing the injected content, the script executes in their browser, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. The scope-changed CVSS vector confirms the attack crosses security boundaries, affecting users beyond the injecting account. No public exploit code and no CISA KEV listing are present at time of analysis.
Stored cross-site scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes silently in any victim's browser upon page load. The vulnerability spans AEM 6.5 up to 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to build 2026.7.0, per Adobe security bulletin APSB26-98. Because the scope changes to the victim's browser context, a successful injection enables session token theft, credential harvesting, or further client-side attacks against any user - including administrators - who visits the poisoned content.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change flag (S:C) signals that injected scripts escape the AEM application trust boundary and execute in the victim browser's security context; no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields across the authoring interface. When any victim - including higher-privileged users such as administrators - browses to the page rendering the stored payload, the script executes in their browser, enabling session token theft, unauthorized content manipulation, or further actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; Adobe has released fixes via security advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently navigates to the affected page. The scope-changed CVSS vector (S:C) confirms that injected scripts operate within the victim's browser security context, enabling session hijacking, credential theft, or unauthorized AEM actions against higher-privileged users. Adobe has issued advisory APSB26-98 covering AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS; no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), as documented in Adobe advisory APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that renders the affected page. The vulnerability affects AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit code or active exploitation has been identified at time of analysis, and Adobe has addressed this in advisory APSB26-98.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user browses to the affected page, the script executes in their browser within a changed scope context - enabling session theft, credential harvesting, or UI redressing against higher-privileged users. No public exploit code and no CISA KEV listing at time of analysis, but the low complexity and network accessibility make this straightforward to exploit by any authenticated user with form-submission rights.
Stored XSS in Adobe Experience Manager enables a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields within the content authoring interface. When any user - including privileged editors or administrators - navigates to the affected page, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf. Adobe addressed this under advisory APSB26-98; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-visits the page containing the injected content, the script executes in their browser under a changed scope (S:C), enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation is identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to pages containing the poisoned fields, the injected script executes in their browser under the AEM origin, enabling session token theft, credential harvesting, or UI redirection. Three deployment lines are affected: AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When a higher-privileged user (such as an administrator) browses the affected page, the script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. The scope change (S:C in CVSS) signals that injected scripts can operate outside the application's own origin, amplifying the effective impact beyond the application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the page containing the injected payload, the script executes in their browser context, crossing scope boundaries into the victim's session. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2, as confirmed by APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently visits the affected page. The scope-changed nature of this flaw (S:C in CVSS) means the attacker's script runs within the victim's browser security context, enabling session token theft, credential harvesting, or further client-side attacks. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit code or KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the CMS. When any user-including administrators-browses to a page containing the injected content, the script executes in their browser under a changed security context (S:C), enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit or active exploitation confirmed via CISA KEV at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the authoring environment. When any higher-privileged user subsequently browses the affected page, the script executes in their browser within a changed scope, potentially enabling session theft or unauthorized actions. Adobe has issued advisory APSB26-98 covering AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0; no public exploit or CISA KEV listing has been identified.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to persist malicious JavaScript payloads in vulnerable form fields, which then execute in any victim's browser upon page visit. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed the issue in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager permits low-privileged authenticated users to inject persistent JavaScript payloads into vulnerable form fields within the CMS authoring interface. When any user - including administrators - browses a page containing the injected field, their browser executes the attacker's script in the context of the AEM domain, with scope change confirming cross-boundary impact. All AEM 6.5 versions through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 build are affected; remediation is available via Adobe APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of other users - including administrators - when they visit the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or CISA KEV listing has been identified at time of analysis; the scope-changed CVSS vector reflects the cross-user browser impact.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject malicious JavaScript into vulnerable form fields, where it persists server-side and executes in any victim's browser upon visiting the affected page. Three release tracks are affected: AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed impact means attacker-controlled scripts run in victim browser contexts - including those of administrators - enabling session hijacking, credential theft, or unauthorized actions on behalf of higher-privileged users. No public exploit or CISA KEV listing identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 through 6.5.24 and 6.5 LTS through SP2 (on-premises), as well as AEM as a Cloud Service through the July 2026 release (2026.7.0). Adobe has published advisory APSB26-98 confirming the scope-changed impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields that persists and executes in the browsers of other users who visit the affected page. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed nature of the vulnerability means the attacker's payload crosses from the AEM application context into victim browser sessions, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated low-privilege attackers to inject and execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed CVSS vector indicates successful exploitation can cross session boundaries, enabling session token theft or unauthorized actions beyond the attacker's direct privilege level - though exploitation requires both a valid AEM credential and victim interaction via a crafted page. No public exploit code and no CISA KEV listing exist at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks without sanitization. Affected releases span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no confirmed active exploitation or public proof-of-concept code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privilege attackers to execute arbitrary JavaScript in the browser context of targeted users who visit a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Adobe addressed this in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the DOM environment through a crafted webpage. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is documented under Adobe APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject malicious JavaScript that executes within a victim's browser context, with scope changing beyond AEM's own origin. Three product lines are affected: AEM 6.5, AEM 6.5 LTS, and AEM as a Cloud Service through their respective latest releases at time of disclosure. Exploitation requires user interaction - the victim must navigate to an attacker-crafted URL while authenticated - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-changed CVSS vector indicates impact can extend beyond the AEM application boundary into the victim's broader browser session; no public exploit has been identified at time of analysis.