RCE
Monthly
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Arbitrary shortcode execution in Click to Chat for WhatsApp plugin versions up to and including 4.44 allows unauthenticated remote attackers to run registered WordPress shortcodes by injecting delimiters into the URL of an archive page, which is substituted into the {url} greeting placeholder and then passed to do_shortcode() without sanitization. Exploitation depends on a non-default configuration: the greetings feature must be active and rendering greetings-1 or greetings-2 templates on archive pages with the {url} placeholder present, and meaningful impact requires a dangerous shortcode from WordPress core, the active theme, or another plugin. The CVE assigns a 9.1 base score (AC:L), but our independent assessment sets attack complexity to High (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in ONLYOFFICE Document Server affects every release before 10.0.0, allowing an attacker who holds a valid Inbox-compatible JWT to run arbitrary OS commands as the ds service account. The flaw lives in the Document Builder API: because the optional third argument of builder.SaveFile() accepts user-controlled converter XML, injecting a duplicate m_sFileTo element overrides the server-generated output path and lets the attacker write outside the designated job directory, overwrite runtime.json, and repoint the Document Builder executable so that commands execute during a subsequent job. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact, with exploitation gated on possession of a JWT signed with the deployment's secret (PR:L).
Privilege escalation in the Ignition Perspective module (Inductive Automation Ignition) - a genuine high-priority issue in an OT/ICS context - allows an authenticated user with legitimate access to a Vision project to supply their valid Vision session identifier and obtain Designer-level privileges, leading to arbitrary code execution in the context of the Ignition Gateway process. The flaw (CWE-863, CVSS 8.7) affects Gateways where both Vision and Perspective modules are deployed, requires low-privilege Vision credentials and a valid session, and needs network reachability but no user interaction. No public exploit identified at time of analysis.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape in Google Chrome desktop builds prior to 155.0.8059.79 allows an attacker who can already run a program on the target host to abuse an incorrect authorization check in Chrome's Updater component and execute arbitrary code outside the browser sandbox, with high impact to confidentiality, integrity and availability plus a scope change across the sandbox boundary. The independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning a pre-existing low-privileged local foothold and user interaction are both required, and CISA's SSVC rates the issue non-automatable, so opportunistic mass exploitation is unlikely. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped a vendor patch in Chrome 155.0.8059.79.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
Sandbox escape in Google Chrome on macOS lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by delivering a crafted extension that abuses incorrect reference resolution in the Extensions subsystem, affecting all Mac builds prior to 155.0.8059.79. Google rates the issue High (Chromium severity: High) and has shipped a vendor fix, and there is no public exploit identified at time of analysis, with the CISA SSVC assessment recording exploitation as none. The impact is total once the chain fires (Scope:Changed, C:H/I:H/A:H), but high attack complexity (AC:H), required user interaction (UI:R) and the hard prerequisite of a prior renderer compromise make this a targeted second-stage escalation rather than a standalone remote exploit.
A heap-based buffer overflow in PDFium, the PDF rendering engine embedded in Google Chrome, allows a remote attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to open a crafted HTML page. All desktop Chrome builds prior to 155.0.8059.79 (stable and extended-stable channels) are affected, and exploitation requires user interaction (UI:R), which limits mass or automated abuse. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none; however, CISA assigns a total technical impact once the bug is triggered, and Google rates the Chromium security severity as High. The primary constraint on real-world impact is that code execution is confined to the renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape vulnerability.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.
Arbitrary code execution in Adobe Photoshop Desktop is possible when a user opens an attacker-supplied file, because an incorrect authorization check (CWE-863) combined with a scope change lets crafted file content escape the application's intended security boundary and run code as the current user. Photoshop builds 27.10 and earlier and 26.11.7 and earlier are affected, and exploitation hinges on convincing a victim to download and open the malicious file (AV:L, PR:N, UI:R), which makes phishing or poisoned shared assets the realistic delivery path rather than any remote or network-facing vector. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuinely serious but not emergency-tier issue; a vendor advisory (APSB26-158) is available.
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
Out-of-bounds write in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious file. The vulnerability requires user interaction (opening the file) and has a local attack vector, with a CVSS 3.1 base score of 7.8 High. No public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (27.x up to and including 27.10, and 26.x up to and including 26.11.7) is possible when a user opens a specially crafted file, because an integer overflow or wraparound during file parsing corrupts memory and lets attacker-controlled code run in the context of the current user. Exploitation is local in nature - the attacker must deliver a malicious file and convince the victim to open it - and, per the CVSS vector (AV:L, PR:N, UI:R, S:U), no prior authentication is needed but no privilege escalation is gained, since code executes only with the victim's own rights. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is a credible but not top-tier priority driven by targeted social engineering rather than opportunistic mass exploitation.
Opening a maliciously crafted file in Adobe Photoshop Desktop (27.10 and earlier, and 26.11.7 and earlier) can trigger a double-free memory-corruption condition that results in arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker cannot reach the target over the network and must rely on the victim opening the file, and that code executes only with the privileges of the logged-on user rather than escalating to system level; adversary value is therefore tied to social-engineering delivery of a weaponised document, and there is no public exploit identified at time of analysis. The independent assessment rates this as a credible but not emergency-level priority, consistent with the local attack vector and user-interaction requirement; no CISA KEV listing or public proof-of-concept was supplied in the source data.
Opening an attacker-supplied file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds write that leads to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is strictly local and client-side: there is no network-facing service to hit, and the victim must be socially engineered into opening a malicious asset in their own session. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the practical risk is bounded by the required user interaction and the specialized deployment of this creative tooling, which favors targeted delivery over opportunistic mass exploitation.
Arbitrary code execution in Adobe Substance 3D Sampler 6.0.3 and earlier is possible because a stack-based buffer overflow (CWE-121) is triggered when the application parses a specially crafted file, with any code executed inheriting the privileges of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) shows no privileges are required, but the attack is not network-reachable: the attacker must first deliver the malicious file and rely on the victim opening it in the application. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuinely moderate-risk desktop issue rather than a top-priority emergency, though the high confidentiality, integrity, and availability impact on the user's session justifies prompt patching.
Integer overflow (CWE-190) in Adobe Photoshop Desktop lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Affected installations are Photoshop 27.x up to and including 27.10 and Photoshop 26.x up to and including 26.11.7, per Adobe advisory APSB26-158 (tracked as EUVD-2026-100691). The vector is local (AV:L) and unauthenticated (PR:N) but gated by mandatory user interaction (UI:R), so there is no network-facing, no-click exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority client-side file-parsing flaw rather than a mass-exploitation emergency.
Improper input validation in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a high-privileged, already-authenticated attacker with network adjacency to the administrative component to execute arbitrary code in the context of the current user, with full confidentiality, integrity and availability impact and a changed scope (CVSS 8.4). Exploitation is access-gated rather than remotely reachable: the attacker must hold high privileges on the system (PR:H) and be positioned within the administrative network zone where Adobe confines the vulnerable component by default (AV:A), with no user interaction required (UI:N). No public exploit code and no CISA KEV entry have been identified at time of analysis, so this is a high-severity but access-gated issue rather than a drop-everything emergency; because the scope is changed, successful exploitation can affect resources beyond the vulnerable component itself.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) stems from an incorrect authorization flaw (CWE-863) in a component that is restricted to the administrative network zone by default, letting an attacker who can reach that zone bypass authorization checks and execute code in the context of the current user without authentication or user interaction. The 9.6 CVSS score reflects a scope-changed (S:C) impact in which the compromised component can affect resources beyond its own security boundary, but the adjacent-network vector (AV:A, PR:N, UI:N) means the real-world exposure hinges on segmentation: organizations that properly firewall the ColdFusion administrative interface from ordinary users are largely insulated, while flat networks, exposed admin interfaces, or an existing internal foothold remove the only barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary code execution in Adobe ColdFusion 2023 and 2025 is achievable through an incorrect authorization flaw (CWE-863) in a component that is, by default, reachable only from the administrative network zone. Exploitation requires two prerequisites confirmed by the assessed vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (8.4): the attacker must already be positioned on the adjacent administrative network segment, and must hold a high-privilege ColdFusion account; no user interaction is required and complexity is low once those conditions are met. There is no public exploit identified at time of analysis, so this is a serious but constrained flaw rather than a drop-everything internet-facing emergency - exposure is concentrated in organizations that expose the ColdFusion administrative zone broadly or allow high-privilege accounts to proliferate.
Unauthenticated remote code execution in Xorbits Xoscar through 0.11.2 lets any attacker who can reach the actor-pool TCP channel run arbitrary code as the server process, because the receive path hands raw network bytes straight to cloudpickle.loads() before the message type is validated. The CVSS 4.0 vector (AV:N/PR:N/UI:N, 9.3) confirms the bug is remotely reachable and requires no credentials or user interaction, so any deployment exposing an actor pool on a routable interface is exposed at default configuration; impact is worst where the process runs as root, typical of GPU-node deployments. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is bounded by network reachability - installations that bind the actor-pool port to localhost or keep it on an isolated segment are not remotely exploitable.
Unauthenticated remote code execution in Adobe ColdFusion 2023 (versions up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows any remote attacker who can reach the service to execute arbitrary code under the context of the ColdFusion process, with no user interaction required. The CVSS 3.1 base score is a maximum 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the Scope:Changed metric indicates the attacker's actions can escape the vulnerable component and affect resources beyond its intended security boundary - typically the underlying JVM or host operating system. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is a high-severity, top-priority patching case driven by the attack vector and impact ratings rather than by confirmed active exploitation; the practical gating factor is network reachability of the exposed ColdFusion endpoint, with WAF-protected or segmented deployments materially harder to attack.
Arbitrary code execution in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an unauthenticated remote attacker to execute code in the context of the ColdFusion service account. The flaw is a code-injection issue (CWE-94) rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no unusual complexity are needed - only network reachability of a vulnerable instance. No public exploit code or confirmed active exploitation was identified at time of analysis, but given the severity and the historical targeting of ColdFusion, this warrants expedited patching.
Improper input validation in Adobe ColdFusion 2023 (2023.0 through 2023.0.25) and ColdFusion 2025 (2025.0 through 2025.0.13) can let an unauthenticated remote attacker execute arbitrary code in the context of the affected service, with no user interaction required and a scope change that extends impact beyond the vulnerable component. The assessed CVSS is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack-complexity score reflects that exploitation depends on conditions beyond the attacker's control - a race or specific server state - so successful compromise is not guaranteed on demand. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, but the internet-facing nature of ColdFusion and the fully unauthenticated attack path make this a high-priority patch target.
Arbitrary code execution in Adobe ColdFusion (2023 at or below 2023.0.25, and 2025 at or below 2025.0.13) arises from an incorrect authorization flaw (CWE-863) that allows a low-privileged, authenticated actor to bypass intended access checks and execute code in the context of the current user, with no user interaction required. The vendor-assigned CVSS 3.1 base score is 8.8 (High) with a changed scope (S:C) and high impact across confidentiality, integrity and availability. The vector specifies a local attack path (AV:L) requiring low privileges (PR:L), which is consistent with the assessment that an attacker must already hold a low-privileged ColdFusion account or session; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Incorrect authorization in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an authenticated, locally-positioned low-privileged attacker to execute arbitrary code in the context of another user, with a changed security scope. The flaw maps to CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (base 8.8): exploitation requires an existing low-privilege account or session plus local access to the server or application context, and it needs no user interaction. No public exploit has been identified at time of analysis, and the high confidentiality, integrity and availability impact is bounded by the fact that an external unauthenticated attacker cannot trigger the issue without first obtaining a foothold and valid low-privilege credentials on an unpatched instance.
Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged attacker with local access to execute arbitrary code under the context of the current user without user interaction (CVSS 8.8, scope changed). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but the Adobe PSIRT 'Authentication Bypass' tag suggests the authorization barrier may be weaker than the PR:L metric implies-defenders should verify the true prerequisite set in APSB26-144. Organizations running affected builds should treat this as a credible priority while confirming whether any authenticated session is truly required.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is possible when a low-privileged authenticated attacker with local or adjacent access exploits an incorrect authorization flaw (CWE-863) to operate outside the intended security scope and run code in the context of the current user. Adobe notes the exploit depends on conditions beyond the attacker's control, which is reflected in the high attack complexity (AC:H), and no user interaction is required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the combination of authenticated low privilege (PR:L), local vector (AV:L) and high complexity makes reliable mass exploitation unlikely.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a valid low-privileged account run code in the context of the ColdFusion service, with no interaction required from any user. The underlying defect is improper input validation (CWE-20) reachable over the network, scored CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the only significant barrier is that the attacker must first authenticate with low privileges, so exposure is greatest where ColdFusion login interfaces are reachable from untrusted networks or where weak or shared low-privilege accounts exist. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, which keeps this a high-priority patching item rather than an emergency incident.
Arbitrary code execution is possible in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) through an incorrect authorization check (CWE-863) that lets a low-privileged actor perform actions beyond their granted permissions and reach code execution, with no user interaction required. Rated CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the flaw is network-reachable and low-complexity, but the PR:L vector means the attacker must already hold a low-privilege position relative to ColdFusion - a valid low-level account or access to a reachable authenticated interface - rather than being fully anonymous; the changed scope indicates impact can extend beyond the initially vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the independent assessment rates it a genuine high-priority finding rather than an inflated score, so it warrants prompt patching given the code-execution impact.
Authenticated low-privileged users on Adobe ColdFusion 2023 through 2023.0.25 and ColdFusion 2025 through 2025.0.13 can exploit an incorrect authorization weakness (CWE-863) to execute arbitrary code in the context of the current user, with changed scope extending impact beyond the vulnerable component. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8), so an existing low-privileged account is required and no user interaction is needed; the AV:L value suggests local/console-adjacent access even though the supplied tags include Authentication Bypass and RCE. No public exploit was identified at time of analysis; this is a high-severity, high-priority flaw warranting prompt patching, but the attack-vector and tag conflict should be confirmed with Adobe.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is achievable by a low-privileged, locally positioned attacker who abuses an incorrect authorization flaw to escalate into code execution in the context of the current user. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C, score 8.8) shows the barrier is a valid low-privileged account plus local/session reach to the server rather than unauthenticated network access, and no user interaction is needed. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is real but is gated by the authenticated-plus-local prerequisites, keeping it below a pre-authentication remote code execution scenario.
Arbitrary code execution in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged authenticated remote attacker to inject and execute code in the context of the current user without user interaction, with a CVSS score of 9.9 and scope change. The vulnerable component is reachable over the network, but the attacker must already have a low-privileged foothold (PR:L) rather than fully anonymous access. No public exploit identified at time of analysis; patch available per vendor advisory APSB26-144.
Incorrect authorization handling in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an attacker who already holds a low-privileged ColdFusion session or local access to the server to bypass authorization checks and execute arbitrary code in the context of the current user, with no user interaction required. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C) makes clear this is not an anonymous remote flaw despite the 'Authentication Bypass' tag - obtaining a low-privileged account or local foothold is the gating prerequisite, after which complexity is low and impact is high across confidentiality, integrity, and availability with a scope change. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited; a vendor fix is available via Adobe advisory APSB26-144, so systems already patched past 2023.0.25 / 2025.0.13 are not affected.
Unauthenticated remote code execution affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), where the server accepts and stores an uploaded file of a dangerous/executable type and subsequently executes it, giving the attacker code execution in the context of the ColdFusion service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) confirms the flaw is network-reachable, requires no credentials and no user interaction, and has changed scope, so any internet- or network-exposed instance of an affected version that exposes a file-upload-capable endpoint is in scope. At time of analysis, there is no public exploit identified and no confirmation of active exploitation (no CISA KEV listing), but the combination of a 10.0 score, trivial prerequisites, and full confidentiality/integrity/availability impact makes this a top-priority patching target; environments that front ColdFusion with upload filtering or a WAF, or that deny execution in the upload directory, are materially less exposed.
Incorrect authorization in Adobe ColdFusion 2023.0.25 and earlier and 2025.0.13 and earlier allows an authenticated low-privileged attacker to execute arbitrary code in the context of the current user, but only when a victim opens a malicious file supplied by the attacker. The local access vector and required user interaction mean the flaw is not directly reachable through a network request against an exposed server without a prior foothold; no public exploit code or active exploitation has been identified at time of analysis. Adobe has released security advisory APSB26-144 covering affected versions.
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.
Out-of-bounds write in Adobe Bridge (versions up to and including 15.1.8 and 16.0.7) can let an attacker execute arbitrary code in the context of the current user when a crafted file is opened. The attack is local and requires the victim to open a malicious file (UI:R), so delivery of the file to the target and a user action are both prerequisites; no authentication is required of the attacker and complexity is low once the file is opened. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the vendor advisory (APSB26-167) is the authoritative fix reference. Given the mandatory user interaction and local delivery requirement, this is a credible but second-tier priority rather than an urgent remotely exploitable issue.
Out-of-bounds write in Adobe Bridge allows a local attacker to achieve arbitrary code execution in the context of the current user when a victim opens a malicious file. Affected versions are Adobe Bridge 15.1.8 and earlier, and 16.0.7 and earlier. Exploitation requires user interaction (opening a crafted file) and no elevated privileges, but the attack is local. No public exploit code has been identified at time of analysis, and the flaw is rated CVSS 7.8, making it a legitimately actionable local code-execution flaw but not a drop-everything emergency.
Out-of-bounds write in Adobe Bridge - versions 15.x through 15.1.8 and 16.x through 16.0.7 - can result in arbitrary code execution in the context of the current user when a victim opens or previews a crafted file. The issue is local in reach (AV:L) and requires attacker-induced user interaction (UI:R), with no authentication or elevated privileges needed (PR:N) and low attack complexity (AC:L) once the file is opened, yielding a CVSS 3.1 base score of 7.8. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical barrier for an attacker remains the social engineering needed to convince a target on an unpatched version to open the malicious file.
An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.
Unauthenticated remote code execution affects Adobe Experience Manager as a Cloud Service (0 through 2026.9.28187), AEM 6.5 LTS (through SP3), and AEM 6.5 (through 6.5.25) due to an incorrect authorization check (CWE-863) in a network-reachable component. Because the CVSS vector is PR:N/UI:N, attackers need no credentials and no victim interaction - any internet-facing or otherwise reachable affected instance is directly attackable - and the changed scope (S:C) means a successful exploit can compromise resources beyond the vulnerable component itself, including the victim's account or session and the underlying runtime. At the time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, but the maximum 10.0 base score, the authentication-bypass/RCE tagging from the vendor, and the trivial attack preconditions make this a top-priority remediation item despite the absence of observed exploitation.
Incorrect authorization in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including 6.5 LTS SP3) lets an authenticated attacker who holds only a low-privileged account break out of their assigned permission level and execute arbitrary code as the current user, with a changed scope that can extend the compromise to the victim's account or session. The flaw is remotely reachable, requires no user interaction, and carries a 9.9 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which our independent assessment confirms is a genuine high-priority issue rather than a CVSS-inflated one. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, although the low-privilege prerequisite means any exposed AEM instance that permits self-registration or has a large internal user base is a realistic target.
Authenticated path traversal in Omnispace Agora Project before 26.10.0 lets a low-privileged user write attacker-controlled files outside the intended upload temporary directory by supplying an unanchored tmpFolderName value in the upload destination path; pointing it at the web root can yield remote code execution if the written file is executable from that location. Per the CVSS vector (PR:L), a valid low-privileged account on the Agora web application is required, so exposure is materially lower on instances with restricted account provisioning or closed self-registration, and versions 26.10.0 and later are unaffected. CVSS 8.7 (v4.0) reflects high confidentiality, integrity and availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (26.10.0) is available.
Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.
Unauthenticated remote code execution in Adobe Experience Manager stems from an incorrect authorization check that lets a remote attacker bypass access controls and execute arbitrary code in the context of the current user, with the changed-scope rating indicating impact can extend beyond the vulnerable component (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Every unpatched deployment is in scope: AEM 6.5 up to and including 6.5.25, AEM 6.5 LTS up to and including 6.5 LTS SP3, and AEM as a Cloud Service up to and including 2026.9.28187; no credentials or user interaction are required, and the only practical precondition is that the affected author, publish, or endpoint is reachable from the attacker's network. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the authentication-bypass-to-RCE chain plus the maximum severity score make internet-facing, unpatched instances a top remediation priority rather than a high-score/low-real-risk case.
Unauthenticated remote code execution affects Adobe Experience Manager, specifically AEM as a Cloud Service builds up to and including 2026.9.28187, AEM 6.5 LTS up to and including SP3, and AEM 6.5 up to and including 6.5.25, and is rooted in an incorrect authorization check (CWE-863) that carries a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the defective access-control decision itself is the entry point, a remote attacker needs only network reachability, no credentials, and no user interaction, and the changed scope (S:C) means the resulting arbitrary code execution in the current user's context can be leveraged to gain elevated access or control over a victim's account or session beyond the vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated, no-interaction exploitation profile places internet-exposed AEM instances at top-priority risk, with network isolation (VPN, WAF, non-exposed tiers) and the affected-version boundaries as the main mitigating factors.
Arbitrary code execution in Adobe Experience Manager (AEM) allows an attacker with a high-privilege account (e.g., administrator or author-level) to run malicious code on the server, potentially affecting resources beyond the vulnerable component due to changed scope. The improper input validation flaw (CWE-20) affects AEM as a Cloud Service ≤2026.9.28187, AEM 6.5 ≤6.5.25, and AEM 6.5 LTS ≤6.5 LTS SP3, and requires network access but no user interaction. No public exploit or active exploitation has been identified at time of analysis; patches are available per the Adobe advisory (apsb26-152).
Improper input validation in Adobe Experience Manager 6.5 (versions up to and including 6.5.25) allows an attacker who already holds a valid low-privilege account or session to execute arbitrary code in the context of the current user, and because the flaw crosses a security scope boundary it can lead to elevated access or takeover of the victim's account or session. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) confirms the issue is remotely reachable with low attack complexity and no user interaction, but it explicitly requires an authenticated low-privilege position - it is not exploitable by a fully unauthenticated attacker. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing); Adobe has published advisory APSB26-152 covering the fix.
Opening an attacker-supplied crafted file in Adobe Dimension 4.1.8 or earlier can trigger a stack-based buffer overflow that allows arbitrary code execution in the context of the victim's user account. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is delivered purely through social engineering - a target must open a malicious file - and requires no network reachability, credentials, or elevated privileges, though any resulting code runs only at the victim's privilege level with no scope change. No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a credible but moderate-priority patching item rather than an emergency.
Arbitrary code execution in Adobe Substance 3D Stager (versions 3.1.8 and earlier) is possible when a victim opens a maliciously crafted file, which overflows a stack buffer during parsing and lets the malformed input corrupt memory in the context of the current user. The attack cannot be triggered remotely or without the target's cooperation - it is a local vector (AV:L) that requires user interaction (UI:R), so delivery depends on social engineering that convinces the victim to open the file - and code executes with the privileges of that user only (S:U), meaning a non-administrative victim limits the blast radius to that account. Adobe's PSIRT assigned a 7.8 base score (CWE-121), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
OS command injection in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through SP3) allows an authenticated, low-privileged attacker to run arbitrary operating-system commands in the context of the current user, with changed scope (S:C) meaning the injected command executes outside the application's own security authority on the host. Rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the exploitation bar is low attack complexity with no user interaction; the only meaningful constraint is the need for a valid low-privilege AEM session, which is a very low bar in multi-user AEM author environments where content authors and other non-admin accounts are routinely issued. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS score was supplied with the source data. This is a genuine high-priority vulnerability rather than a CVSS-inflated paper risk, and the specific vulnerable feature or injectable parameter is not named in the advisory summary, so patch validation and hunting should be prioritized on affected instances.
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Arbitrary shortcode execution in Click to Chat for WhatsApp plugin versions up to and including 4.44 allows unauthenticated remote attackers to run registered WordPress shortcodes by injecting delimiters into the URL of an archive page, which is substituted into the {url} greeting placeholder and then passed to do_shortcode() without sanitization. Exploitation depends on a non-default configuration: the greetings feature must be active and rendering greetings-1 or greetings-2 templates on archive pages with the {url} placeholder present, and meaningful impact requires a dangerous shortcode from WordPress core, the active theme, or another plugin. The CVE assigns a 9.1 base score (AC:L), but our independent assessment sets attack complexity to High (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in ONLYOFFICE Document Server affects every release before 10.0.0, allowing an attacker who holds a valid Inbox-compatible JWT to run arbitrary OS commands as the ds service account. The flaw lives in the Document Builder API: because the optional third argument of builder.SaveFile() accepts user-controlled converter XML, injecting a duplicate m_sFileTo element overrides the server-generated output path and lets the attacker write outside the designated job directory, overwrite runtime.json, and repoint the Document Builder executable so that commands execute during a subsequent job. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact, with exploitation gated on possession of a JWT signed with the deployment's secret (PR:L).
Privilege escalation in the Ignition Perspective module (Inductive Automation Ignition) - a genuine high-priority issue in an OT/ICS context - allows an authenticated user with legitimate access to a Vision project to supply their valid Vision session identifier and obtain Designer-level privileges, leading to arbitrary code execution in the context of the Ignition Gateway process. The flaw (CWE-863, CVSS 8.7) affects Gateways where both Vision and Perspective modules are deployed, requires low-privilege Vision credentials and a valid session, and needs network reachability but no user interaction. No public exploit identified at time of analysis.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape in Google Chrome desktop builds prior to 155.0.8059.79 allows an attacker who can already run a program on the target host to abuse an incorrect authorization check in Chrome's Updater component and execute arbitrary code outside the browser sandbox, with high impact to confidentiality, integrity and availability plus a scope change across the sandbox boundary. The independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning a pre-existing low-privileged local foothold and user interaction are both required, and CISA's SSVC rates the issue non-automatable, so opportunistic mass exploitation is unlikely. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped a vendor patch in Chrome 155.0.8059.79.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
Sandbox escape in Google Chrome on macOS lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by delivering a crafted extension that abuses incorrect reference resolution in the Extensions subsystem, affecting all Mac builds prior to 155.0.8059.79. Google rates the issue High (Chromium severity: High) and has shipped a vendor fix, and there is no public exploit identified at time of analysis, with the CISA SSVC assessment recording exploitation as none. The impact is total once the chain fires (Scope:Changed, C:H/I:H/A:H), but high attack complexity (AC:H), required user interaction (UI:R) and the hard prerequisite of a prior renderer compromise make this a targeted second-stage escalation rather than a standalone remote exploit.
A heap-based buffer overflow in PDFium, the PDF rendering engine embedded in Google Chrome, allows a remote attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to open a crafted HTML page. All desktop Chrome builds prior to 155.0.8059.79 (stable and extended-stable channels) are affected, and exploitation requires user interaction (UI:R), which limits mass or automated abuse. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none; however, CISA assigns a total technical impact once the bug is triggered, and Google rates the Chromium security severity as High. The primary constraint on real-world impact is that code execution is confined to the renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape vulnerability.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.
Arbitrary code execution in Adobe Photoshop Desktop is possible when a user opens an attacker-supplied file, because an incorrect authorization check (CWE-863) combined with a scope change lets crafted file content escape the application's intended security boundary and run code as the current user. Photoshop builds 27.10 and earlier and 26.11.7 and earlier are affected, and exploitation hinges on convincing a victim to download and open the malicious file (AV:L, PR:N, UI:R), which makes phishing or poisoned shared assets the realistic delivery path rather than any remote or network-facing vector. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuinely serious but not emergency-tier issue; a vendor advisory (APSB26-158) is available.
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
Out-of-bounds write in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious file. The vulnerability requires user interaction (opening the file) and has a local attack vector, with a CVSS 3.1 base score of 7.8 High. No public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (27.x up to and including 27.10, and 26.x up to and including 26.11.7) is possible when a user opens a specially crafted file, because an integer overflow or wraparound during file parsing corrupts memory and lets attacker-controlled code run in the context of the current user. Exploitation is local in nature - the attacker must deliver a malicious file and convince the victim to open it - and, per the CVSS vector (AV:L, PR:N, UI:R, S:U), no prior authentication is needed but no privilege escalation is gained, since code executes only with the victim's own rights. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is a credible but not top-tier priority driven by targeted social engineering rather than opportunistic mass exploitation.
Opening a maliciously crafted file in Adobe Photoshop Desktop (27.10 and earlier, and 26.11.7 and earlier) can trigger a double-free memory-corruption condition that results in arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker cannot reach the target over the network and must rely on the victim opening the file, and that code executes only with the privileges of the logged-on user rather than escalating to system level; adversary value is therefore tied to social-engineering delivery of a weaponised document, and there is no public exploit identified at time of analysis. The independent assessment rates this as a credible but not emergency-level priority, consistent with the local attack vector and user-interaction requirement; no CISA KEV listing or public proof-of-concept was supplied in the source data.
Opening an attacker-supplied file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds write that leads to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is strictly local and client-side: there is no network-facing service to hit, and the victim must be socially engineered into opening a malicious asset in their own session. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the practical risk is bounded by the required user interaction and the specialized deployment of this creative tooling, which favors targeted delivery over opportunistic mass exploitation.
Arbitrary code execution in Adobe Substance 3D Sampler 6.0.3 and earlier is possible because a stack-based buffer overflow (CWE-121) is triggered when the application parses a specially crafted file, with any code executed inheriting the privileges of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) shows no privileges are required, but the attack is not network-reachable: the attacker must first deliver the malicious file and rely on the victim opening it in the application. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuinely moderate-risk desktop issue rather than a top-priority emergency, though the high confidentiality, integrity, and availability impact on the user's session justifies prompt patching.
Integer overflow (CWE-190) in Adobe Photoshop Desktop lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Affected installations are Photoshop 27.x up to and including 27.10 and Photoshop 26.x up to and including 26.11.7, per Adobe advisory APSB26-158 (tracked as EUVD-2026-100691). The vector is local (AV:L) and unauthenticated (PR:N) but gated by mandatory user interaction (UI:R), so there is no network-facing, no-click exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority client-side file-parsing flaw rather than a mass-exploitation emergency.
Improper input validation in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a high-privileged, already-authenticated attacker with network adjacency to the administrative component to execute arbitrary code in the context of the current user, with full confidentiality, integrity and availability impact and a changed scope (CVSS 8.4). Exploitation is access-gated rather than remotely reachable: the attacker must hold high privileges on the system (PR:H) and be positioned within the administrative network zone where Adobe confines the vulnerable component by default (AV:A), with no user interaction required (UI:N). No public exploit code and no CISA KEV entry have been identified at time of analysis, so this is a high-severity but access-gated issue rather than a drop-everything emergency; because the scope is changed, successful exploitation can affect resources beyond the vulnerable component itself.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) stems from an incorrect authorization flaw (CWE-863) in a component that is restricted to the administrative network zone by default, letting an attacker who can reach that zone bypass authorization checks and execute code in the context of the current user without authentication or user interaction. The 9.6 CVSS score reflects a scope-changed (S:C) impact in which the compromised component can affect resources beyond its own security boundary, but the adjacent-network vector (AV:A, PR:N, UI:N) means the real-world exposure hinges on segmentation: organizations that properly firewall the ColdFusion administrative interface from ordinary users are largely insulated, while flat networks, exposed admin interfaces, or an existing internal foothold remove the only barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary code execution in Adobe ColdFusion 2023 and 2025 is achievable through an incorrect authorization flaw (CWE-863) in a component that is, by default, reachable only from the administrative network zone. Exploitation requires two prerequisites confirmed by the assessed vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (8.4): the attacker must already be positioned on the adjacent administrative network segment, and must hold a high-privilege ColdFusion account; no user interaction is required and complexity is low once those conditions are met. There is no public exploit identified at time of analysis, so this is a serious but constrained flaw rather than a drop-everything internet-facing emergency - exposure is concentrated in organizations that expose the ColdFusion administrative zone broadly or allow high-privilege accounts to proliferate.
Unauthenticated remote code execution in Xorbits Xoscar through 0.11.2 lets any attacker who can reach the actor-pool TCP channel run arbitrary code as the server process, because the receive path hands raw network bytes straight to cloudpickle.loads() before the message type is validated. The CVSS 4.0 vector (AV:N/PR:N/UI:N, 9.3) confirms the bug is remotely reachable and requires no credentials or user interaction, so any deployment exposing an actor pool on a routable interface is exposed at default configuration; impact is worst where the process runs as root, typical of GPU-node deployments. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is bounded by network reachability - installations that bind the actor-pool port to localhost or keep it on an isolated segment are not remotely exploitable.
Unauthenticated remote code execution in Adobe ColdFusion 2023 (versions up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows any remote attacker who can reach the service to execute arbitrary code under the context of the ColdFusion process, with no user interaction required. The CVSS 3.1 base score is a maximum 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the Scope:Changed metric indicates the attacker's actions can escape the vulnerable component and affect resources beyond its intended security boundary - typically the underlying JVM or host operating system. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is a high-severity, top-priority patching case driven by the attack vector and impact ratings rather than by confirmed active exploitation; the practical gating factor is network reachability of the exposed ColdFusion endpoint, with WAF-protected or segmented deployments materially harder to attack.
Arbitrary code execution in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an unauthenticated remote attacker to execute code in the context of the ColdFusion service account. The flaw is a code-injection issue (CWE-94) rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials, no user interaction, and no unusual complexity are needed - only network reachability of a vulnerable instance. No public exploit code or confirmed active exploitation was identified at time of analysis, but given the severity and the historical targeting of ColdFusion, this warrants expedited patching.
Improper input validation in Adobe ColdFusion 2023 (2023.0 through 2023.0.25) and ColdFusion 2025 (2025.0 through 2025.0.13) can let an unauthenticated remote attacker execute arbitrary code in the context of the affected service, with no user interaction required and a scope change that extends impact beyond the vulnerable component. The assessed CVSS is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack-complexity score reflects that exploitation depends on conditions beyond the attacker's control - a race or specific server state - so successful compromise is not guaranteed on demand. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, but the internet-facing nature of ColdFusion and the fully unauthenticated attack path make this a high-priority patch target.
Arbitrary code execution in Adobe ColdFusion (2023 at or below 2023.0.25, and 2025 at or below 2025.0.13) arises from an incorrect authorization flaw (CWE-863) that allows a low-privileged, authenticated actor to bypass intended access checks and execute code in the context of the current user, with no user interaction required. The vendor-assigned CVSS 3.1 base score is 8.8 (High) with a changed scope (S:C) and high impact across confidentiality, integrity and availability. The vector specifies a local attack path (AV:L) requiring low privileges (PR:L), which is consistent with the assessment that an attacker must already hold a low-privileged ColdFusion account or session; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Incorrect authorization in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an authenticated, locally-positioned low-privileged attacker to execute arbitrary code in the context of another user, with a changed security scope. The flaw maps to CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (base 8.8): exploitation requires an existing low-privilege account or session plus local access to the server or application context, and it needs no user interaction. No public exploit has been identified at time of analysis, and the high confidentiality, integrity and availability impact is bounded by the fact that an external unauthenticated attacker cannot trigger the issue without first obtaining a foothold and valid low-privilege credentials on an unpatched instance.
Incorrect authorization (CWE-863) in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged attacker with local access to execute arbitrary code under the context of the current user without user interaction (CVSS 8.8, scope changed). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but the Adobe PSIRT 'Authentication Bypass' tag suggests the authorization barrier may be weaker than the PR:L metric implies-defenders should verify the true prerequisite set in APSB26-144. Organizations running affected builds should treat this as a credible priority while confirming whether any authenticated session is truly required.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is possible when a low-privileged authenticated attacker with local or adjacent access exploits an incorrect authorization flaw (CWE-863) to operate outside the intended security scope and run code in the context of the current user. Adobe notes the exploit depends on conditions beyond the attacker's control, which is reflected in the high attack complexity (AC:H), and no user interaction is required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the combination of authenticated low privilege (PR:L), local vector (AV:L) and high complexity makes reliable mass exploitation unlikely.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a valid low-privileged account run code in the context of the ColdFusion service, with no interaction required from any user. The underlying defect is improper input validation (CWE-20) reachable over the network, scored CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the only significant barrier is that the attacker must first authenticate with low privileges, so exposure is greatest where ColdFusion login interfaces are reachable from untrusted networks or where weak or shared low-privilege accounts exist. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, which keeps this a high-priority patching item rather than an emergency incident.
Arbitrary code execution is possible in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) through an incorrect authorization check (CWE-863) that lets a low-privileged actor perform actions beyond their granted permissions and reach code execution, with no user interaction required. Rated CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the flaw is network-reachable and low-complexity, but the PR:L vector means the attacker must already hold a low-privilege position relative to ColdFusion - a valid low-level account or access to a reachable authenticated interface - rather than being fully anonymous; the changed scope indicates impact can extend beyond the initially vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the independent assessment rates it a genuine high-priority finding rather than an inflated score, so it warrants prompt patching given the code-execution impact.
Authenticated low-privileged users on Adobe ColdFusion 2023 through 2023.0.25 and ColdFusion 2025 through 2025.0.13 can exploit an incorrect authorization weakness (CWE-863) to execute arbitrary code in the context of the current user, with changed scope extending impact beyond the vulnerable component. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8), so an existing low-privileged account is required and no user interaction is needed; the AV:L value suggests local/console-adjacent access even though the supplied tags include Authentication Bypass and RCE. No public exploit was identified at time of analysis; this is a high-severity, high-priority flaw warranting prompt patching, but the attack-vector and tag conflict should be confirmed with Adobe.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is achievable by a low-privileged, locally positioned attacker who abuses an incorrect authorization flaw to escalate into code execution in the context of the current user. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C, score 8.8) shows the barrier is a valid low-privileged account plus local/session reach to the server rather than unauthenticated network access, and no user interaction is needed. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is real but is gated by the authenticated-plus-local prerequisites, keeping it below a pre-authentication remote code execution scenario.
Arbitrary code execution in Adobe ColdFusion 2023 up to 2023.0.25 and ColdFusion 2025 up to 2025.0.13 allows a low-privileged authenticated remote attacker to inject and execute code in the context of the current user without user interaction, with a CVSS score of 9.9 and scope change. The vulnerable component is reachable over the network, but the attacker must already have a low-privileged foothold (PR:L) rather than fully anonymous access. No public exploit identified at time of analysis; patch available per vendor advisory APSB26-144.
Incorrect authorization handling in Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13) allows an attacker who already holds a low-privileged ColdFusion session or local access to the server to bypass authorization checks and execute arbitrary code in the context of the current user, with no user interaction required. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C) makes clear this is not an anonymous remote flaw despite the 'Authentication Bypass' tag - obtaining a low-privileged account or local foothold is the gating prerequisite, after which complexity is low and impact is high across confidentiality, integrity, and availability with a scope change. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited; a vendor fix is available via Adobe advisory APSB26-144, so systems already patched past 2023.0.25 / 2025.0.13 are not affected.
Unauthenticated remote code execution affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), where the server accepts and stores an uploaded file of a dangerous/executable type and subsequently executes it, giving the attacker code execution in the context of the ColdFusion service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) confirms the flaw is network-reachable, requires no credentials and no user interaction, and has changed scope, so any internet- or network-exposed instance of an affected version that exposes a file-upload-capable endpoint is in scope. At time of analysis, there is no public exploit identified and no confirmation of active exploitation (no CISA KEV listing), but the combination of a 10.0 score, trivial prerequisites, and full confidentiality/integrity/availability impact makes this a top-priority patching target; environments that front ColdFusion with upload filtering or a WAF, or that deny execution in the upload directory, are materially less exposed.
Incorrect authorization in Adobe ColdFusion 2023.0.25 and earlier and 2025.0.13 and earlier allows an authenticated low-privileged attacker to execute arbitrary code in the context of the current user, but only when a victim opens a malicious file supplied by the attacker. The local access vector and required user interaction mean the flaw is not directly reachable through a network request against an exposed server without a prior foothold; no public exploit code or active exploitation has been identified at time of analysis. Adobe has released security advisory APSB26-144 covering affected versions.
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.
Out-of-bounds write in Adobe Bridge (versions up to and including 15.1.8 and 16.0.7) can let an attacker execute arbitrary code in the context of the current user when a crafted file is opened. The attack is local and requires the victim to open a malicious file (UI:R), so delivery of the file to the target and a user action are both prerequisites; no authentication is required of the attacker and complexity is low once the file is opened. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the vendor advisory (APSB26-167) is the authoritative fix reference. Given the mandatory user interaction and local delivery requirement, this is a credible but second-tier priority rather than an urgent remotely exploitable issue.
Out-of-bounds write in Adobe Bridge allows a local attacker to achieve arbitrary code execution in the context of the current user when a victim opens a malicious file. Affected versions are Adobe Bridge 15.1.8 and earlier, and 16.0.7 and earlier. Exploitation requires user interaction (opening a crafted file) and no elevated privileges, but the attack is local. No public exploit code has been identified at time of analysis, and the flaw is rated CVSS 7.8, making it a legitimately actionable local code-execution flaw but not a drop-everything emergency.
Out-of-bounds write in Adobe Bridge - versions 15.x through 15.1.8 and 16.x through 16.0.7 - can result in arbitrary code execution in the context of the current user when a victim opens or previews a crafted file. The issue is local in reach (AV:L) and requires attacker-induced user interaction (UI:R), with no authentication or elevated privileges needed (PR:N) and low attack complexity (AC:L) once the file is opened, yielding a CVSS 3.1 base score of 7.8. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical barrier for an attacker remains the social engineering needed to convince a target on an unpatched version to open the malicious file.
An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.
Unauthenticated remote code execution affects Adobe Experience Manager as a Cloud Service (0 through 2026.9.28187), AEM 6.5 LTS (through SP3), and AEM 6.5 (through 6.5.25) due to an incorrect authorization check (CWE-863) in a network-reachable component. Because the CVSS vector is PR:N/UI:N, attackers need no credentials and no victim interaction - any internet-facing or otherwise reachable affected instance is directly attackable - and the changed scope (S:C) means a successful exploit can compromise resources beyond the vulnerable component itself, including the victim's account or session and the underlying runtime. At the time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, but the maximum 10.0 base score, the authentication-bypass/RCE tagging from the vendor, and the trivial attack preconditions make this a top-priority remediation item despite the absence of observed exploitation.
Incorrect authorization in Adobe Experience Manager 6.5 (up to and including 6.5.25) and AEM 6.5 LTS (up to and including 6.5 LTS SP3) lets an authenticated attacker who holds only a low-privileged account break out of their assigned permission level and execute arbitrary code as the current user, with a changed scope that can extend the compromise to the victim's account or session. The flaw is remotely reachable, requires no user interaction, and carries a 9.9 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which our independent assessment confirms is a genuine high-priority issue rather than a CVSS-inflated one. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, although the low-privilege prerequisite means any exposed AEM instance that permits self-registration or has a large internal user base is a realistic target.
Authenticated path traversal in Omnispace Agora Project before 26.10.0 lets a low-privileged user write attacker-controlled files outside the intended upload temporary directory by supplying an unanchored tmpFolderName value in the upload destination path; pointing it at the web root can yield remote code execution if the written file is executable from that location. Per the CVSS vector (PR:L), a valid low-privileged account on the Agora web application is required, so exposure is materially lower on instances with restricted account provisioning or closed self-registration, and versions 26.10.0 and later are unaffected. CVSS 8.7 (v4.0) reflects high confidentiality, integrity and availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (26.10.0) is available.
Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.
Unauthenticated remote code execution in Adobe Experience Manager stems from an incorrect authorization check that lets a remote attacker bypass access controls and execute arbitrary code in the context of the current user, with the changed-scope rating indicating impact can extend beyond the vulnerable component (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Every unpatched deployment is in scope: AEM 6.5 up to and including 6.5.25, AEM 6.5 LTS up to and including 6.5 LTS SP3, and AEM as a Cloud Service up to and including 2026.9.28187; no credentials or user interaction are required, and the only practical precondition is that the affected author, publish, or endpoint is reachable from the attacker's network. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the authentication-bypass-to-RCE chain plus the maximum severity score make internet-facing, unpatched instances a top remediation priority rather than a high-score/low-real-risk case.
Unauthenticated remote code execution affects Adobe Experience Manager, specifically AEM as a Cloud Service builds up to and including 2026.9.28187, AEM 6.5 LTS up to and including SP3, and AEM 6.5 up to and including 6.5.25, and is rooted in an incorrect authorization check (CWE-863) that carries a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the defective access-control decision itself is the entry point, a remote attacker needs only network reachability, no credentials, and no user interaction, and the changed scope (S:C) means the resulting arbitrary code execution in the current user's context can be leveraged to gain elevated access or control over a victim's account or session beyond the vulnerable component. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated, no-interaction exploitation profile places internet-exposed AEM instances at top-priority risk, with network isolation (VPN, WAF, non-exposed tiers) and the affected-version boundaries as the main mitigating factors.
Arbitrary code execution in Adobe Experience Manager (AEM) allows an attacker with a high-privilege account (e.g., administrator or author-level) to run malicious code on the server, potentially affecting resources beyond the vulnerable component due to changed scope. The improper input validation flaw (CWE-20) affects AEM as a Cloud Service ≤2026.9.28187, AEM 6.5 ≤6.5.25, and AEM 6.5 LTS ≤6.5 LTS SP3, and requires network access but no user interaction. No public exploit or active exploitation has been identified at time of analysis; patches are available per the Adobe advisory (apsb26-152).
Improper input validation in Adobe Experience Manager 6.5 (versions up to and including 6.5.25) allows an attacker who already holds a valid low-privilege account or session to execute arbitrary code in the context of the current user, and because the flaw crosses a security scope boundary it can lead to elevated access or takeover of the victim's account or session. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) confirms the issue is remotely reachable with low attack complexity and no user interaction, but it explicitly requires an authenticated low-privilege position - it is not exploitable by a fully unauthenticated attacker. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing); Adobe has published advisory APSB26-152 covering the fix.
Opening an attacker-supplied crafted file in Adobe Dimension 4.1.8 or earlier can trigger a stack-based buffer overflow that allows arbitrary code execution in the context of the victim's user account. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is delivered purely through social engineering - a target must open a malicious file - and requires no network reachability, credentials, or elevated privileges, though any resulting code runs only at the victim's privilege level with no scope change. No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a credible but moderate-priority patching item rather than an emergency.
Arbitrary code execution in Adobe Substance 3D Stager (versions 3.1.8 and earlier) is possible when a victim opens a maliciously crafted file, which overflows a stack buffer during parsing and lets the malformed input corrupt memory in the context of the current user. The attack cannot be triggered remotely or without the target's cooperation - it is a local vector (AV:L) that requires user interaction (UI:R), so delivery depends on social engineering that convinces the victim to open the file - and code executes with the privileges of that user only (S:U), meaning a non-administrative victim limits the blast radius to that account. Adobe's PSIRT assigned a 7.8 base score (CWE-121), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
OS command injection in Adobe Experience Manager 6.5 (through 6.5.25) and AEM 6.5 LTS (through SP3) allows an authenticated, low-privileged attacker to run arbitrary operating-system commands in the context of the current user, with changed scope (S:C) meaning the injected command executes outside the application's own security authority on the host. Rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the exploitation bar is low attack complexity with no user interaction; the only meaningful constraint is the need for a valid low-privilege AEM session, which is a very low bar in multi-user AEM author environments where content authors and other non-admin accounts are routinely issued. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS score was supplied with the source data. This is a genuine high-priority vulnerability rather than a CVSS-inflated paper risk, and the specific vulnerable feature or injectable parameter is not named in the advisory summary, so patch validation and hunting should be prioritized on affected instances.