CVE-2026-47989

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47987

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47985

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47983

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47982

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47981

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47980

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47977

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47975

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47973

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47970

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47966

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47962

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47958

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47957

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47954

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-47953

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2026-34707

InCopy | Heap-based Buffer Overflow (CWE-122)

InCopy versions 21.3, 20.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Incopy Macos Windows

CVE-2026-34706

InCopy | Out-of-bounds Write (CWE-787)

InCopy versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Incopy Macos Windows

CVE-2026-34705

InDesign Desktop | Out-of-bounds Read (CWE-125)

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Indesign Indesign Desktop Macos and 1 more