CVEs.

Publicly disclosed vulnerabilities, with advisories linked where they're available.

• MEDIUMCVE-2026-14255CVSS 5.5

  Uncontrolled Recursion Vulnerability in Certain Autodesk Products

  A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.

  Advisory ↗
• HIGHCVE-2026-0533CVSS 7.1

  Stored XSS in Autodesk Fusion Client

  A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

  Advisory ↗
• HIGHCVE-2026-4345CVSS 7.1

  Stored XSS in Autodesk Fusion Client

  A Maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

  Advisory ↗