# Vulnerabilities published in 2026


- [CVE-2026-81995](https://insights.sbomify.com/CVE-2026-81995/): Adobe Experience Manager Forms JEE | Improper Input Validation (CWE-20) (critical 9.1)
- [CVE-2026-81994](https://insights.sbomify.com/CVE-2026-81994/): Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) (high 8.2)
- [CVE-2026-81993](https://insights.sbomify.com/CVE-2026-81993/): Acrobat Reader | Heap-based Buffer Overflow (CWE-122) (medium 5.5)
- [CVE-2026-81992](https://insights.sbomify.com/CVE-2026-81992/): Acrobat Reader | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-81991](https://insights.sbomify.com/CVE-2026-81991/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-81990](https://insights.sbomify.com/CVE-2026-81990/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-8199](https://insights.sbomify.com/CVE-2026-8199/): Post-auth memory exhaustion via bitwise match expressions (high 7.1)
- [CVE-2026-81989](https://insights.sbomify.com/CVE-2026-81989/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-81988](https://insights.sbomify.com/CVE-2026-81988/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-81987](https://insights.sbomify.com/CVE-2026-81987/): Acrobat Reader | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-81986](https://insights.sbomify.com/CVE-2026-81986/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-81985](https://insights.sbomify.com/CVE-2026-81985/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-81984](https://insights.sbomify.com/CVE-2026-81984/): Acrobat Reader | Use After Free (CWE-416) (medium 5.5)
- [CVE-2026-81983](https://insights.sbomify.com/CVE-2026-81983/): Acrobat Reader | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-81982](https://insights.sbomify.com/CVE-2026-81982/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-81981](https://insights.sbomify.com/CVE-2026-81981/): Acrobat Reader | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-81980](https://insights.sbomify.com/CVE-2026-81980/): Acrobat Reader | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-8198](https://insights.sbomify.com/CVE-2026-8198/): Auth bypass in Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity (medium 5.3)
- [CVE-2026-81979](https://insights.sbomify.com/CVE-2026-81979/): Acrobat Reader | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-81978](https://insights.sbomify.com/CVE-2026-81978/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-81977](https://insights.sbomify.com/CVE-2026-81977/): Acrobat Reader | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 5.5)
- [CVE-2026-81976](https://insights.sbomify.com/CVE-2026-81976/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-81975](https://insights.sbomify.com/CVE-2026-81975/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-81973](https://insights.sbomify.com/CVE-2026-81973/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-81971](https://insights.sbomify.com/CVE-2026-81971/): Windows NTFS Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8197](https://insights.sbomify.com/CVE-2026-8197/): Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name (high 7.3)
- [CVE-2026-81969](https://insights.sbomify.com/CVE-2026-81969/): Windows Server Update Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-81964](https://insights.sbomify.com/CVE-2026-81964/): Windows Update Orchestrator Service Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2026-81963](https://insights.sbomify.com/CVE-2026-81963/): Microsoft Windows Link Following (high 7.8, exploited in the wild)
- [CVE-2026-81960](https://insights.sbomify.com/CVE-2026-81960/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-8196](https://insights.sbomify.com/CVE-2026-8196/): JeecgBoot mLogin Endpoint LoginController.java authorization (medium 6.3)
- [CVE-2026-81959](https://insights.sbomify.com/CVE-2026-81959/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81958](https://insights.sbomify.com/CVE-2026-81958/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-81957](https://insights.sbomify.com/CVE-2026-81957/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81956](https://insights.sbomify.com/CVE-2026-81956/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81955](https://insights.sbomify.com/CVE-2026-81955/): Windows Graphics Component Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-81954](https://insights.sbomify.com/CVE-2026-81954/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81953](https://insights.sbomify.com/CVE-2026-81953/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81952](https://insights.sbomify.com/CVE-2026-81952/): Microsoft Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-81951](https://insights.sbomify.com/CVE-2026-81951/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81950](https://insights.sbomify.com/CVE-2026-81950/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-8195](https://insights.sbomify.com/CVE-2026-8195/): JeecgBoot SVG File CommonController.java cross site scripting (medium 5.3)
- [CVE-2026-81949](https://insights.sbomify.com/CVE-2026-81949/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81948](https://insights.sbomify.com/CVE-2026-81948/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81947](https://insights.sbomify.com/CVE-2026-81947/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81946](https://insights.sbomify.com/CVE-2026-81946/): PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm (medium 6.7)
- [CVE-2026-81945](https://insights.sbomify.com/CVE-2026-81945/): PLANET IGS-5225-8P2T4S V1/V2 Admin Stack-Based Buffer Overflow via Web Server (high 7.5)
- [CVE-2026-81944](https://insights.sbomify.com/CVE-2026-81944/): PLANET IGS-5225-8P2T4S V1/V2 Stack-Based Buffer Overflow via Web Server (high 7.7)
- [CVE-2026-81943](https://insights.sbomify.com/CVE-2026-81943/): PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE (high 8.4)
- [CVE-2026-81942](https://insights.sbomify.com/CVE-2026-81942/): PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server (high 8.7)
- [CVE-2026-81941](https://insights.sbomify.com/CVE-2026-81941/): Code injection in Langflow OSS (high 8.8)
- [CVE-2026-81940](https://insights.sbomify.com/CVE-2026-81940/): Code injection in Langflow OSS (high 8.8)
- [CVE-2026-8194](https://insights.sbomify.com/CVE-2026-8194/): osTicket Dispatcher class.dispatcher.php cross-site request forgery (medium 5.3)
- [CVE-2026-81939](https://insights.sbomify.com/CVE-2026-81939/): Path traversal in Network Security Manager (NSM) (critical 9.1)
- [CVE-2026-81937](https://insights.sbomify.com/CVE-2026-81937/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.2)
- [CVE-2026-81934](https://insights.sbomify.com/CVE-2026-81934/): Redis TLS pending-data list use-after-free (high 7.5)
- [CVE-2026-81933](https://insights.sbomify.com/CVE-2026-81933/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.8)
- [CVE-2026-81932](https://insights.sbomify.com/CVE-2026-81932/): Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection (high 8.6)
- [CVE-2026-81931](https://insights.sbomify.com/CVE-2026-81931/): Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting (medium 4.8)
- [CVE-2026-81930](https://insights.sbomify.com/CVE-2026-81930/): Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain (medium 6.3)
- [CVE-2026-8193](https://insights.sbomify.com/CVE-2026-8193/): Akaunting Invoice PDF Rendering dompdf.php server-side request forgery (medium 5.3)
- [CVE-2026-81929](https://insights.sbomify.com/CVE-2026-81929/): Cross-site scripting in Ocean Pro Demos (high 7.2)
- [CVE-2026-81928](https://insights.sbomify.com/CVE-2026-81928/): Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. (high 7.5)
- [CVE-2026-81927](https://insights.sbomify.com/CVE-2026-81927/): Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode (low 1.8)
- [CVE-2026-81926](https://insights.sbomify.com/CVE-2026-81926/): Cross-site scripting in Concrete CMS (low 2.0)
- [CVE-2026-81925](https://insights.sbomify.com/CVE-2026-81925/): Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format (low 2.1)
- [CVE-2026-81924](https://insights.sbomify.com/CVE-2026-81924/): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation (low 2.1)
- [CVE-2026-81923](https://insights.sbomify.com/CVE-2026-81923/): Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor (low 2.1)
- [CVE-2026-81922](https://insights.sbomify.com/CVE-2026-81922/): Missing authorization in Concrete CMS (low 2.1)
- [CVE-2026-81921](https://insights.sbomify.com/CVE-2026-81921/): In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status (low 2.3)
- [CVE-2026-81920](https://insights.sbomify.com/CVE-2026-81920/): Cross-site request forgery in Concrete CMS (low 2.3)
- [CVE-2026-8192](https://insights.sbomify.com/CVE-2026-8192/): Wavlink NU516U1 adm.cgi wzdap os command injection (medium 5.3)
- [CVE-2026-81919](https://insights.sbomify.com/CVE-2026-81919/): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint (low 2.3)
- [CVE-2026-81918](https://insights.sbomify.com/CVE-2026-81918/): Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block (medium 4.8)
- [CVE-2026-81917](https://insights.sbomify.com/CVE-2026-81917/): Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags (medium 5.1)
- [CVE-2026-81916](https://insights.sbomify.com/CVE-2026-81916/): Missing authorization in Concrete CMS (medium 5.1)
- [CVE-2026-81915](https://insights.sbomify.com/CVE-2026-81915/): In Concrete CMS below 9.5.3, Page Type update omits object-level authorization (medium 5.1)
- [CVE-2026-81914](https://insights.sbomify.com/CVE-2026-81914/): Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names (medium 4.3)
- [CVE-2026-81913](https://insights.sbomify.com/CVE-2026-81913/): Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. (medium 5.3)
- [CVE-2026-81912](https://insights.sbomify.com/CVE-2026-81912/): Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature (medium 5.7)
- [CVE-2026-81911](https://insights.sbomify.com/CVE-2026-81911/): Cross-site scripting in Concrete CMS (medium 5.8)
- [CVE-2026-81910](https://insights.sbomify.com/CVE-2026-81910/): Code injection in Concrete CMS (medium 5.9)
- [CVE-2026-8191](https://insights.sbomify.com/CVE-2026-8191/): Wavlink NU516U1 adm.cgi wifi_region os command injection (medium 5.3)
- [CVE-2026-81909](https://insights.sbomify.com/CVE-2026-81909/): Missing authorization in Concrete CMS (medium 5.9)
- [CVE-2026-81908](https://insights.sbomify.com/CVE-2026-81908/): Missing authorization in Concrete CMS (medium 6.0)
- [CVE-2026-81907](https://insights.sbomify.com/CVE-2026-81907/): Cross-site request forgery in Concrete CMS (medium 6.1)
- [CVE-2026-81906](https://insights.sbomify.com/CVE-2026-81906/): [UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks (medium 6.3)
- [CVE-2026-81905](https://insights.sbomify.com/CVE-2026-81905/): Business logic in Concrete CMS (medium 6.3)
- [CVE-2026-81904](https://insights.sbomify.com/CVE-2026-81904/): Concrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration (medium 6.3)
- [CVE-2026-81903](https://insights.sbomify.com/CVE-2026-81903/): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon (high 7.0)
- [CVE-2026-81902](https://insights.sbomify.com/CVE-2026-81902/): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup (high 7.1)
- [CVE-2026-81901](https://insights.sbomify.com/CVE-2026-81901/): Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint (high 7.2)
- [CVE-2026-81900](https://insights.sbomify.com/CVE-2026-81900/): Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight) (high 7.3)
- [CVE-2026-8190](https://insights.sbomify.com/CVE-2026-8190/): Wavlink NU516U1 adm.cgi wan os command injection (medium 5.3)
- [CVE-2026-81899](https://insights.sbomify.com/CVE-2026-81899/): Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard (high 7.3)
- [CVE-2026-81898](https://insights.sbomify.com/CVE-2026-81898/): Cross-site scripting in Concrete CMS (high 7.5)
- [CVE-2026-81897](https://insights.sbomify.com/CVE-2026-81897/): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control (high 7.7)
- [CVE-2026-81896](https://insights.sbomify.com/CVE-2026-81896/): Cross-site scripting in Concrete CMS (high 8.4)
- [CVE-2026-81895](https://insights.sbomify.com/CVE-2026-81895/): SQL injection in Concrete CMS (high 8.5)
- [CVE-2026-81894](https://insights.sbomify.com/CVE-2026-81894/): Cross-site scripting in Concrete CMS (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/337/