Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-48016

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication, allowing a normal customer or guest context to trigger the payment flow for another user's order while /store-api/order enforces the expected o

PUBLISHED
Vendor
shopware, shopware
Product
shopware, platform
Provider severity
MEDIUM
Conflicts
1

CVE-2026-48015

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, <script>, and <foreignObject> to execute in the Shopware domain when the uploaded SVG is viewed. This issue is

PUBLISHED
Vendor
shopware, shopware
Product
platform, shopware
Provider severity
MEDIUM
Conflicts
1

CVE-2026-48014

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE_ACL or perform an explicit privilege check, so AclAnnotationValidator exits when route ACL metadata is absent and low-privileged users without order:update, order_transaction:update, or orde

PUBLISHED
Vendor
shopware, shopware
Product
shopware, platform
Provider severity
MEDIUM
Conflicts
1

CVE-2026-48013

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel `uploadFromURL` flow validates target IPs against private/reserved ranges via `FileUrlValidator`, the `linkURL` flow only performs a URL format check (regex for `http://` or `https://` prefix), allowing SSRF to internal network services and cloud metada

PUBLISHED
Vendor
shopware, shopware
Product
shopware, platform
Provider severity
MEDIUM
Conflicts
2

CVE-2026-48012

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the server does not restrict that fallback target to same-origin URLs, does not require a relative path, and does not reject dangero

PUBLISHED
Vendor
shopware, shopware
Product
shopware, platform
Provider severity
MEDIUM
Conflicts
1

CVE-2026-48011

Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.

PUBLISHED
Vendor
shopware
Product
shopware
Provider severity
LOW
Conflicts
0

CVE-2026-48010

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed

PUBLISHED
Vendor
shopware, shopware
Product
shopware, platform
Provider severity
MEDIUM
Conflicts
1

CVE-2026-4801

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up to, and including, 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations fetched from external iCal feeds in the Events block rendering function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a

PUBLISHED
Vendor
godaddy
Product
Page Builder Gutenberg Blocks – CoBlocks
Provider severity
MEDIUM
Conflicts
0

CVE-2026-48009

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account by triggering POST /api/_action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PATCH /api/_action/user/user-recovery/password; the root cause is that src/Core/System/User/Recovery/UserRecoveryDefinition.php exposes the hash field through the Admin API without ApiAware(false) or Read

PUBLISHED
Vendor
shopware, shopware
Product
shopware, platform
Provider severity
MEDIUM
Conflicts
1

CVE-2026-48008

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the

PUBLISHED
Vendor
shopware, shopware
Product
shopware, platform
Provider severity
MEDIUM
Conflicts
1

CVE-2026-48006

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down.

PUBLISHED
Vendor
Red Hat, Red Hat, netty, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat Single Sign-On 7, Red Hat Fuse 7, netty, Red Hat Data Grid 8.6.2, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack
Provider severity
HIGH
Conflicts
3

CVE-2026-48001

Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce Webhooks Plugin, Adobe Commerce, Magento Open Source, Adobe Commerce B2B
Provider severity
LOW
Conflicts
1

CVE-2026-48000

Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site, potentially enabling credential theft and account takeover. Exploitation of this issue requires user interaction in that a victim must click on a malicious link.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce B2B, Adobe Commerce, Magento Open Source, Adobe Commerce Webhooks Plugin
Provider severity
MEDIUM
Conflicts
1

CVE-2026-4800

A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, lodash, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, lodash, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, lodash, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, lodash, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat Satellite 6, Red Hat Satellite 6, Logging Subsystem for Red Hat OpenShift, Confidential Compute Attestation, Red Hat Openshift Data Foundation 4.17, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Container Platform 4.19, Red Hat Openshift Data Foundation 4.17, Red Hat OpenShift Dev Spaces 3.27, Red Hat Openshift Data Foundation 4.16, lodash-amd, Red Hat Openshift Data Foundation 4.17, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.2, Red Hat OpenShift AI (RHOAI), Node HealthCheck Operator, Red Hat Directory Server 13, Node HealthCheck Operator, Red Hat OpenShift Service Mesh 3.0, Gatekeeper 3, Cluster Observability Operator 1.5.0, Red Hat OpenShift Container Platform 4.19, Streams for Apache Kafka 3.2.0, Red Hat Ansible Automation Platform 2, Red Hat Openshift Data Foundation 4.17, Red Hat Connectivity Link 1, Red Hat Openshift Data Foundation 4.16, Red Hat OpenShift AI (RHOAI), Red Hat build of Apicurio Registry 3, Red Hat Openshift Data Foundation 4.2, Logging Subsystem for Red Hat OpenShift, Red Hat OpenShift AI (RHOAI), Red Hat Ansible Automation Platform 2.5, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Ansible Automation Platform 2, Network Observability (NETOBSERV) 1.11.1, Red Hat Openshift Data Foundation 4.19, Migration Toolkit for Applications 8, Red Hat Openshift Data Foundation 4.17, Red Hat Openshift Data Foundation 4.19, Red Hat OpenShift AI (RHOAI), Red Hat Edge Manager 1.1, Red Hat OpenShift Virtualization 4, Red Hat Openshift Data Foundation 4.16, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Openshift Data Foundation 4.17, Red Hat Satellite 6, Red Hat Single Sign-On 7, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.18, Red Hat Edge Manager 1.0, OpenShift Service Mesh 3, Red Hat Satellite 6.18, Red Hat Openshift Data Foundation 4.17, Red Hat Openshift Data Foundation 4.19, lodash.template, OpenShift Pipelines, Red Hat Openshift Data Foundation 4.2, Red Hat Enterprise Linux 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Openshift Data Foundation 4.18, Multicluster Engine for Kubernetes, Red Hat Openshift Data Foundation 4.19, Red Hat Ansible Automation Platform 2, Red Hat Openshift Data Foundation 4.2, Red Hat Openshift Data Foundation 4.18, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4.2, Red Hat Openshift Data Foundation 4.2, Red Hat Enterprise Linux 9, Red Hat Openshift Data Foundation 4.17, Red Hat Openshift Data Foundation 4.17, Red Hat Enterprise Linux 8, Cryostat 4, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4.18, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6, Red Hat Enterprise Linux 10, OpenShift Service Mesh 3, Migration Toolkit for Virtualization 2.9, Red Hat OpenShift Container Platform 4.21, Red Hat Satellite 6.18, Red Hat Enterprise Linux 9, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.16, Logging Subsystem for Red Hat OpenShift, Red Hat Developer Hub 1.8, Red Hat Enterprise Linux 10, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.16, OpenShift Lightspeed, Red Hat Data Grid 8.6.1, Red Hat Openshift Data Foundation 4.18, Cryostat 4 on RHEL 9, Red Hat Openshift Data Foundation 4.19, Red Hat Build of Podman Desktop, Red Hat OpenShift Service Mesh 3.3, Red Hat Enterprise Linux 10, Red Hat 3scale API Management Platform 2, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat OpenShift Container Platform 4.2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Service Mesh 2.6, Red Hat OpenShift Container Platform 4.16, Red Hat Openshift Data Foundation 4.2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Openshift Data Foundation 4.16, Red Hat Openshift Data Foundation 4.2, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 8, Red Hat Openshift Data Foundation 4.19, Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat 3scale API Management Platform 2, Red Hat JBoss Enterprise Application Platform 7, Red Hat Quay 3, Red Hat Enterprise Linux 9, Red Hat Openshift Data Foundation 4.19, Red Hat Trusted Artifact Signer 1.3, Red Hat Satellite 6, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Openshift Data Foundation 4.16, Red Hat 3scale API Management Platform 2, Red Hat Openshift Data Foundation 4.19, Red Hat build of Apicurio Registry 2, Red Hat Satellite 6.18, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.17, Red Hat Openshift Data Foundation 4.2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Openshift Data Foundation 4.18, Logging Subsystem for Red Hat OpenShift, Red Hat build of Apicurio Registry 3, Node HealthCheck Operator, Red Hat Openshift Data Foundation 4.16, Red Hat 3scale API Management Platform 2, Red Hat Openshift Data Foundation 4.2, Red Hat OpenShift Dev Spaces 3.27, Red Hat Enterprise Linux 10, lodash-es, Red Hat Enterprise Linux 10, Red Hat Openshift Data Foundation 4.2, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.18, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8, Red Hat Openshift Data Foundation 4.18, Node HealthCheck Operator, Red Hat Openshift Data Foundation 4.2, Red Hat 3scale API Management Platform 2, Red Hat Openshift Data Foundation 4.2, Red Hat OpenShift distributed tracing 3.9.2, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.2, Red Hat Openshift Data Foundation 4.18, Red Hat Enterprise Linux 9, Red Hat Openshift Data Foundation 4.19, Red Hat Process Automation 7, Cluster Observability Operator 1.5.0, Red Hat Directory Server 11, Red Hat Build of Podman Desktop, Red Hat Openshift Data Foundation 4.17, Red Hat OpenShift Service Mesh 3.1, Red Hat OpenShift Container Platform 4.17, Logging Subsystem for Red Hat OpenShift, Network Observability (NETOBSERV) 1.11.1, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Openshift Data Foundation 4.18, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat OpenShift GitOps 1.19, Red Hat Developer Hub 1.9, Red Hat Trusted Profile Analyzer, Red Hat Openshift Data Foundation 4.19, Red Hat Quay 3, Red Hat Satellite 6, Red Hat Advanced Cluster Security 4, Red Hat OpenShift GitOps 1.18, Red Hat build of Apache Camel - HawtIO 4, Red Hat Enterprise Linux 9, Red Hat Developer Hub, Red Hat Satellite 6, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Openshift Data Foundation 4.17, Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Openshift Data Foundation 4.16, Red Hat Enterprise Linux 9, Red Hat Openshift Data Foundation 4.19, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Openshift Data Foundation 4.16, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Openshift Data Foundation 4.18, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.19, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 9, Red Hat OpenShift Service Mesh 3.3, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.16, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Apicurio Registry 3, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.19, Streams for Apache Kafka 2.9.4, Logging Subsystem for Red Hat OpenShift, Red Hat Openshift Data Foundation 4.17, Red Hat Openshift Data Foundation 4.2, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Openshift Data Foundation 4.16, Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1, Red Hat Openshift Data Foundation 4.18, Red Hat Fuse 7, Red Hat Openshift Data Foundation 4.16, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Build of Keycloak, Red Hat Openshift Data Foundation 4.18, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Container Platform 4.19, Red Hat Enterprise Linux 9, Red Hat 3scale API Management Platform 2, Red Hat Openshift Data Foundation 4.17, Red Hat OpenShift Service Mesh 3.2, Red Hat Openshift Data Foundation 4.17, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 9, Red Hat OpenShift GitOps, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat 3scale API Management Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat OpenShift Dev Spaces 3.27, Red Hat OpenShift AI (RHOAI), Red Hat Ansible Automation Platform 2, Red Hat Openshift Data Foundation 4.19, Red Hat OpenShift Container Platform 4.2, Node HealthCheck Operator, Red Hat Openshift Data Foundation 4.2, Logging Subsystem for Red Hat OpenShift, Self-service automation portal 2, Logging Subsystem for Red Hat OpenShift, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift AI (RHOAI), Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Openshift Data Foundation 4.18, Red Hat OpenShift Virtualization 4, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI 2.25, Red Hat Enterprise Linux 10, Red Hat Edge Manager 1.1, Red Hat Openshift Data Foundation 4.17, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.16, Cluster Observability Operator 1.5.0, Red Hat 3scale API Management Platform 2, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.2, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.19, Red Hat Satellite 6, OpenShift Lightspeed, Red Hat Edge Manager 1.1, Red Hat OpenShift Container Platform 4, Red Hat Edge Manager 1.0, Red Hat OpenShift AI 3.3, Migration Toolkit for Virtualization 2.1, Logging Subsystem for Red Hat OpenShift, Red Hat Openshift Data Foundation 4.19, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Openshift Data Foundation 4.17, Red Hat Openshift Data Foundation 4.17, Red Hat OpenShift GitOps, Red Hat Openshift Data Foundation 4.2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 3.3, Logging Subsystem for Red Hat OpenShift, Red Hat Trusted Artifact Signer, Red Hat Openshift Data Foundation 4.16, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Service Mesh 3.2, Red Hat Openshift Data Foundation 4.2, Red Hat Directory Server 12, Red Hat Ansible Automation Platform 2.6, OpenShift Pipelines, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Openshift Data Foundation 4.2, Red Hat Enterprise Linux 10, Red Hat Openshift Data Foundation 4.16, Red Hat OpenShift Container Platform 4.18, Red Hat Openshift Data Foundation 4.16, Red Hat Openshift Data Foundation 4.19, Red Hat OpenShift Service Mesh 2.6, Red Hat Openshift Data Foundation 4.2, Red Hat Edge Manager 1.1, Red Hat Migration Toolkit 1.8, Red Hat Satellite 6, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4.16, Red Hat Enterprise Linux 10, Red Hat Openshift Data Foundation 4.2, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4, Red Hat JBoss Enterprise Application Platform 8, lodash, Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.18, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux 10, Red Hat Openshift Data Foundation 4.17, Red Hat Openshift Data Foundation 4.2, Red Hat Discovery 2, Red Hat Openshift Data Foundation 4.18, Red Hat 3scale API Management Platform 2, Logging Subsystem for Red Hat OpenShift
Provider severity
HIGH
Conflicts
3

CVE-2026-47999

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce Webhooks Plugin, Adobe Commerce, Adobe Commerce B2B, Magento Open Source
Provider severity
MEDIUM
Conflicts
1

CVE-2026-47998

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce Webhooks Plugin, Magento Open Source, Adobe Commerce, Adobe Commerce B2B
Provider severity
MEDIUM
Conflicts
1

CVE-2026-47997

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce, Magento Open Source, Adobe Commerce B2B, Adobe Commerce Webhooks Plugin
Provider severity
MEDIUM
Conflicts
1

CVE-2026-47996

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce B2B, Adobe Commerce Webhooks Plugin, Adobe Commerce, Magento Open Source
Provider severity
HIGH
Conflicts
1

CVE-2026-47995

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Magento Open Source, Adobe Commerce B2B, Adobe Commerce, Adobe Commerce Webhooks Plugin
Provider severity
HIGH
Conflicts
1

CVE-2026-47994

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Magento Open Source, Adobe Commerce B2B, Adobe Commerce, Adobe Commerce Webhooks Plugin
Provider severity
HIGH
Conflicts
1

CVE-2026-47993

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47992

Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Webhooks Plugin, Magento Open Source
Provider severity
HIGH
Conflicts
1

CVE-2026-47991

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could lead to account takeover. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47990

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-4799

In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.

PUBLISHED
Vendor
floragunn
Product
Search Guard FLX
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47989

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47988

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce, Magento Open Source, Adobe Commerce Webhooks Plugin, Adobe Commerce B2B
Provider severity
HIGH
Conflicts
1

CVE-2026-47987

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47986

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47985

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47984

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

PUBLISHED
Vendor
Adobe, Adobe, Adobe, Adobe
Product
Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Webhooks Plugin, Magento Open Source
Provider severity
HIGH
Conflicts
1

CVE-2026-47983

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47982

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47981

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47980

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-4798

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only

PUBLISHED
Vendor
themefusion
Product
Avada (Fusion) Builder
Provider severity
HIGH
Conflicts
0

CVE-2026-47979

Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

PUBLISHED
Vendor
Adobe, Adobe
Product
Adobe Media Encoder, Adobe Media Encoder
Provider severity
MEDIUM
Conflicts
1

CVE-2026-47978

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47977

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47976

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

PUBLISHED
Vendor
Adobe, Adobe
Product
Adobe Media Encoder, Adobe Media Encoder
Provider severity
HIGH
Conflicts
1

CVE-2026-47975

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47974

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47973

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47972

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47971

Media Encoder is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

PUBLISHED
Vendor
Adobe, Adobe
Product
Adobe Media Encoder, Adobe Media Encoder
Provider severity
HIGH
Conflicts
1

CVE-2026-47970

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0

CVE-2026-47969

Audition is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

PUBLISHED
Vendor
Adobe, Adobe
Product
Audition, Audition
Provider severity
MEDIUM
Conflicts
1

CVE-2026-47968

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

PUBLISHED
Vendor
Adobe, Adobe
Product
Audition, Audition
Provider severity
HIGH
Conflicts
1

CVE-2026-47967

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

PUBLISHED
Vendor
Adobe, Adobe
Product
Audition, Audition
Provider severity
HIGH
Conflicts
1

CVE-2026-47966

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

PUBLISHED
Vendor
Adobe
Product
Adobe Experience Manager
Provider severity
MEDIUM
Conflicts
0