CVE-2026-95634

HighCVSS 8.6/10Last modified Oct 15, 2026

Description

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-956357.8Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current use CVE-2026-956367.8Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the contex CVE-2026-956377.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-956387.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of CVE-2026-956398.6Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of th CVE-2026-95642.4A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown fu CVE-2026-956405.5Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-956417.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-95656.3A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function is_dangerous of the file apps/runtime/src-taur CVE-2026-956537.5Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, m CVE-2026-956547.4Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-ch CVE-2026-956558.1Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitra