Adobe Connect Patches Three Critical Stored XSS Flaws Enabling Privilege Escalation

·26 views

Adobe's September 2026 security release for Connect addresses three critical stored cross-site scripting vulnerabilities — CVE-2026-75684, CVE-2026-75689, and CVE-2026-75697 — each scoring 9.3 on the CVSS v3 scale. Unlike reflected XSS, these stored flaws persist within the application and can execute malicious payloads against any user who later visits an affected page, including administrators. Because the exploit runs within a privileged browser session, it can effectively grant attackers the same permissions as the signed-in user without requiring any authentication. The complete fix is available in Adobe Connect version 12.12, accompanied by Android client version 4.5. A ZoomEye scan identified over 23,600 publicly reachable Adobe Connect instances, highlighting the broad potential exposure across the internet.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Runway releases open-weight Praxis-1 robot model topping RoboLab-120 benchmark at 46.2%

Runway released Praxis-1 on November 11, 2026, a 27-billion-parameter world action model with open weights under Apache 2.0 that permits commercial use. The model reached 46.2% success on NVIDIA's RoboLab-120 leaderboard, placing it ahead of several competing systems. It jointly predicts future video and robot actions, returning 24 action steps in about 0.55 seconds on a single H100 GPU. Three checkpoints are available on Hugging Face, including a DROID fine-tune for single-arm tabletop tasks and a bimanual YAM variant. The article's author notes that these results come from Runway's own reporting and have not yet been independently reproduced.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Two Forgotten Smart Plugs Prompt a Home Automation Project Built With AI Agents

The author found two old Oakter smart plugs in storage and discovered that their dependence on a discontinued service made them effectively unusable. That prompted an investigation into whether the devices could be revived and, ultimately, a broader effort to build Pebble Home, a home automation platform. The author, who had roughly 80 smart devices from several vendors and multiple radio protocols, used AI coding agents to analyse protocols, debug integrations and build interfaces. The project has reshaped the author's views on how much control people truly have over the software behind their devices. The account is presented as a work in progress.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Shared household notes beat perfect memory, builders of TaskFamily find

A household task app called TaskFamily was built on the observation that families usually forget things because each detail belongs to a single person. The developers consolidated tasks, schedules and errands into one visible place, and they kept entries short so they could be written quickly and stay current. Finished items were cleared so the list remained easy to scan and trustworthy, and stale duplicate copies in other channels were eliminated to avoid contradictions. Notifications were limited to time-sensitive items after frequent alerts led people to ignore them. The authors acknowledge that the tool cannot by itself make households adopt the habit of recording information.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Label Created Is Not a Carrier Scan: Why Tracking States Should Stay Separate

A common mistake in carrier tracking systems is treating the first status a carrier returns as proof the parcel is in its hands, when that row often only means a shipping label or pre-advice was created. Such a record reflects that the carrier expects the parcel while it still sits with the shipper. Lumping this pre-scan state into an in-transit bucket distorts transit-time metrics, blurs which party owns a stuck-parcel alert, and produces customer messaging that can be contradicted. The proposed fix is to track a normalised status alongside a boolean for whether the carrier has scanned the parcel and the timestamp of that first scan. Transit time should then be measured from the first carrier scan, and matching should key on the meaning of status wording rather than on carrier-specific rules.

0 comments Read more at DEV Community