CVEs.

Publicly disclosed vulnerabilities, with advisories linked where they're available.

• HIGHCVE-2026-0533CVSS 7.1

  Stored XSS in Autodesk Fusion Client

  A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

  Advisory ↗
• HIGHCVE-2026-4345CVSS 7.1

  Stored XSS in Autodesk Fusion Client

  A Maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

  Advisory ↗