Adobe disclosed CVE-2026-106634, a path traversal flaw in Experience Manager 6.5 LTS SP3 and earlier and 6.5.25 and earlier that lets low-privileged attackers write files to unauthorized locations. Adobe rates it 7.7 under CVSS 3.1.
A low-privileged attacker can exploit the issue over a network without user interaction.
Scope change raises the impact for multi-tenant deployments.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Adobe ColdFusion 2025 and 2023 have a critical path traversal flaw, CVE-2026-90530, rated 9.3 by Adobe, that allows arbitrary file reads through RDS. Fixed in 2025.0.14 and 2023.0.26 per the CVE record; Production Secure Profile disables RDS.
Adobe has patched 11 CVEs in Substance 3D Stager 3.1.8 and earlier, each rated 7.8 by Adobe. All can lead to arbitrary code execution when a user opens a malicious file.
A critical SQL injection vulnerability assigned CVE-2026-97668 affects the Abandoned Cart Pro for WooCommerce plugin in all versions through 10.8.0. Unauthenticated attackers can extract database information and escalate privileges to administrator via the wp_usermeta table.
Powerlevel10k through 1.20.0 has CVE-2026-110102, an insecure download flaw in its gitstatus installer. VulnCheck rates it 7.5 under CVSS 3.1 and 7.7 under CVSS 4.0; NVD has not scored it. The maintainer confirmed the report and advised against installing on systems without digest tools where a man-in-the-middle attack is possible.
IBM rates two WebSphere Liberty flaws 9.1: a gRPC access-control bypass (CVE-2026-93895) and a samlWeb-2.0 authentication bypass (CVE-2026-93909). Interim fixes are available now; Fix Pack 26.0.0.11 is targeted for Q4 2026.
