Adobe's APSB26-163 bulletin fixes more than 30 vulnerabilities in its Content Credentials Rust SDK, C2PA Tool and JS SDK. Adobe rates the worst, a server-side request forgery flaw, 8.6 and most others 7.5, and says it knows of no exploits in the wild.
Correction (Oct 14): An earlier version said Adobe's Content Credentials update covered six CVEs, five of them certificate-validation flaws. Adobe's APSB26-163 bulletin fixes more than 30 vulnerabilities, the worst rated 8.6 by Adobe, and four of the six CVEs we listed are certificate-validation flaws.
Adobe says it is not aware of exploits in the wild for any of the issues.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Adobe has patched 11 CVEs in Substance 3D Stager 3.1.8 and earlier, each rated 7.8 by Adobe. All can lead to arbitrary code execution when a user opens a malicious file.
Adobe disclosed CVE-2026-106634, a path traversal flaw in Experience Manager 6.5 LTS SP3 and earlier and 6.5.25 and earlier that lets low-privileged attackers write files to unauthorized locations. Adobe rates it 7.7 under CVSS 3.1.
Adobe ColdFusion 2025 and 2023 have a critical path traversal flaw, CVE-2026-90530, rated 9.3 by Adobe, that allows arbitrary file reads through RDS. Fixed in 2025.0.14 and 2023.0.26 per the CVE record; Production Secure Profile disables RDS.
TWCERT/CC disclosed two code injection flaws in TeamPlus Messenger 16.8.0 through 17.0.6, each rated 8.8 under CVSS 3.1. Attackers who trick users into opening crafted links or content can run code after a Windows warning; version 17.0.7 fixes them.
CVE-2026-110536 is an unauthenticated OS command injection flaw in the HNAP handler of D-Link DIR-868L firmware 2.01b05, rated 10.0 by VulDB. Exploit code is public, and D-Link no longer patches the end-of-life router.
