Skip to content
Threat Feed
Subscribe

Tag

Client-Side-Exploitation

3 briefs RSS
critical advisory

SiYuan Stored XSS Leads to Remote Code Execution (CVE-2026-66396)

SiYuan before v3.7.2 is vulnerable to stored cross-site scripting (XSS) due to improper escaping of the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing attackers with editor permissions to inject malicious onload handlers that execute arbitrary code in the Electron renderer with full Node.js access, leading to remote code execution.

SiYuan xss remote-code-execution client-side-exploitation electron
2t 1c
high advisory

Adobe Premiere Pro Out-of-Bounds Write Vulnerability (CVE-2026-48369)

An out-of-bounds write vulnerability (CVE-2026-48369) in Adobe Premiere Pro, requiring user interaction to open a malicious file, can lead to arbitrary code execution in the context of the current user.

Premiere Pro +1 vulnerability rce adobe premiere-pro client-side-exploitation
3t 1c
high advisory

Multiple Vulnerabilities in Foxit PDF Editor and Reader

Multiple critical vulnerabilities, including CVE-2026-13126 and CVE-2026-13127, have been discovered in Foxit PDF Editor and Reader for Windows and macOS, enabling a remote attacker to achieve arbitrary code execution, elevate privileges, and compromise data confidentiality if users open a crafted malicious PDF document.

PDF Editor +3 client-side-exploitation document-exploit pdf rce privilege-escalation data-exfiltration windows macos
3t 5c