# Vulnerabilities published in 2026


- [CVE-2026-75711](https://insights.sbomify.com/CVE-2026-75711/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75710](https://insights.sbomify.com/CVE-2026-75710/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-7571](https://insights.sbomify.com/CVE-2026-7571/): Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data (high 7.1)
- [CVE-2026-75709](https://insights.sbomify.com/CVE-2026-75709/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75708](https://insights.sbomify.com/CVE-2026-75708/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75707](https://insights.sbomify.com/CVE-2026-75707/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75706](https://insights.sbomify.com/CVE-2026-75706/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75705](https://insights.sbomify.com/CVE-2026-75705/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75704](https://insights.sbomify.com/CVE-2026-75704/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75703](https://insights.sbomify.com/CVE-2026-75703/): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 10.0)
- [CVE-2026-75702](https://insights.sbomify.com/CVE-2026-75702/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75701](https://insights.sbomify.com/CVE-2026-75701/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75700](https://insights.sbomify.com/CVE-2026-75700/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-7570](https://insights.sbomify.com/CVE-2026-7570/): Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-75699](https://insights.sbomify.com/CVE-2026-75699/): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 10.0)
- [CVE-2026-75698](https://insights.sbomify.com/CVE-2026-75698/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (critical 9.3)
- [CVE-2026-75697](https://insights.sbomify.com/CVE-2026-75697/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-75696](https://insights.sbomify.com/CVE-2026-75696/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75695](https://insights.sbomify.com/CVE-2026-75695/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75694](https://insights.sbomify.com/CVE-2026-75694/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75693](https://insights.sbomify.com/CVE-2026-75693/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75692](https://insights.sbomify.com/CVE-2026-75692/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75691](https://insights.sbomify.com/CVE-2026-75691/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75690](https://insights.sbomify.com/CVE-2026-75690/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-7569](https://insights.sbomify.com/CVE-2026-7569/): Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability (high 8.8)
- [CVE-2026-75689](https://insights.sbomify.com/CVE-2026-75689/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-75687](https://insights.sbomify.com/CVE-2026-75687/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75686](https://insights.sbomify.com/CVE-2026-75686/): Adobe Connect | Improper Input Validation (CWE-20) (critical 9.3)
- [CVE-2026-75685](https://insights.sbomify.com/CVE-2026-75685/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75684](https://insights.sbomify.com/CVE-2026-75684/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-75683](https://insights.sbomify.com/CVE-2026-75683/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75682](https://insights.sbomify.com/CVE-2026-75682/): Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (critical 9.9)
- [CVE-2026-75681](https://insights.sbomify.com/CVE-2026-75681/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75680](https://insights.sbomify.com/CVE-2026-75680/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-7568](https://insights.sbomify.com/CVE-2026-7568/): Signed integer overflow in metaphone() (medium 6.3)
- [CVE-2026-75679](https://insights.sbomify.com/CVE-2026-75679/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75678](https://insights.sbomify.com/CVE-2026-75678/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75677](https://insights.sbomify.com/CVE-2026-75677/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75676](https://insights.sbomify.com/CVE-2026-75676/): Bridge | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-75675](https://insights.sbomify.com/CVE-2026-75675/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75674](https://insights.sbomify.com/CVE-2026-75674/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75672](https://insights.sbomify.com/CVE-2026-75672/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75671](https://insights.sbomify.com/CVE-2026-75671/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75670](https://insights.sbomify.com/CVE-2026-75670/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-7567](https://insights.sbomify.com/CVE-2026-7567/): Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover (critical 9.8)
- [CVE-2026-75669](https://insights.sbomify.com/CVE-2026-75669/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75668](https://insights.sbomify.com/CVE-2026-75668/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75667](https://insights.sbomify.com/CVE-2026-75667/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75666](https://insights.sbomify.com/CVE-2026-75666/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75665](https://insights.sbomify.com/CVE-2026-75665/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-75663](https://insights.sbomify.com/CVE-2026-75663/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-75661](https://insights.sbomify.com/CVE-2026-75661/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75660](https://insights.sbomify.com/CVE-2026-75660/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-7566](https://insights.sbomify.com/CVE-2026-7566/): Deserialization in LearnPress – Backup & Migration Tool (medium 6.6)
- [CVE-2026-75659](https://insights.sbomify.com/CVE-2026-75659/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75658](https://insights.sbomify.com/CVE-2026-75658/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-75657](https://insights.sbomify.com/CVE-2026-75657/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75656](https://insights.sbomify.com/CVE-2026-75656/): Bridge | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-75655](https://insights.sbomify.com/CVE-2026-75655/): Bridge | Uncontrolled Recursion (CWE-674) (high 7.8)
- [CVE-2026-75652](https://insights.sbomify.com/CVE-2026-75652/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75651](https://insights.sbomify.com/CVE-2026-75651/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75650](https://insights.sbomify.com/CVE-2026-75650/): Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine (critical 10.0, exploited in the wild)
- [CVE-2026-7565](https://insights.sbomify.com/CVE-2026-7565/): Path traversal in LearnPress – Backup & Migration Tool (medium 4.9)
- [CVE-2026-75649](https://insights.sbomify.com/CVE-2026-75649/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-75647](https://insights.sbomify.com/CVE-2026-75647/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75646](https://insights.sbomify.com/CVE-2026-75646/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75644](https://insights.sbomify.com/CVE-2026-75644/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75643](https://insights.sbomify.com/CVE-2026-75643/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75642](https://insights.sbomify.com/CVE-2026-75642/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75640](https://insights.sbomify.com/CVE-2026-75640/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75639](https://insights.sbomify.com/CVE-2026-75639/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75638](https://insights.sbomify.com/CVE-2026-75638/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.5)
- [CVE-2026-75637](https://insights.sbomify.com/CVE-2026-75637/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75636](https://insights.sbomify.com/CVE-2026-75636/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75635](https://insights.sbomify.com/CVE-2026-75635/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75634](https://insights.sbomify.com/CVE-2026-75634/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 4.3)
- [CVE-2026-75633](https://insights.sbomify.com/CVE-2026-75633/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 5.5)
- [CVE-2026-75632](https://insights.sbomify.com/CVE-2026-75632/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-75631](https://insights.sbomify.com/CVE-2026-75631/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-7563](https://insights.sbomify.com/CVE-2026-7563/): Missing authorization in Classified Listing – AI-Powered Classified ads & Business Directory Plugin (medium 4.3)
- [CVE-2026-75629](https://insights.sbomify.com/CVE-2026-75629/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-75628](https://insights.sbomify.com/CVE-2026-75628/): Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backsla (medium 5.7)
- [CVE-2026-75627](https://insights.sbomify.com/CVE-2026-75627/): Bastillion Authentication Bypass via Path-Prefix Routing Mismatch (critical 9.3)
- [CVE-2026-75626](https://insights.sbomify.com/CVE-2026-75626/): SpiderFoot Stored Cross-Site Scripting via Correlation Titles (critical 9.3)
- [CVE-2026-75625](https://insights.sbomify.com/CVE-2026-75625/): Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass (critical 9.1)
- [CVE-2026-75624](https://insights.sbomify.com/CVE-2026-75624/): IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service (high 8.8)
- [CVE-2026-75621](https://insights.sbomify.com/CVE-2026-75621/): IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges (medium 6.2)
- [CVE-2026-7562](https://insights.sbomify.com/CVE-2026-7562/): WP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-75619](https://insights.sbomify.com/CVE-2026-75619/): RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101 (medium 6.9)
- [CVE-2026-75618](https://insights.sbomify.com/CVE-2026-75618/): RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101 (high 7.1)
- [CVE-2026-75616](https://insights.sbomify.com/CVE-2026-75616/): Command Injection in Router Web Management Interface (high 8.5)
- [CVE-2026-7561](https://insights.sbomify.com/CVE-2026-7561/): Tm – WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2026-75608](https://insights.sbomify.com/CVE-2026-75608/): Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information (high 7.7)
- [CVE-2026-75607](https://insights.sbomify.com/CVE-2026-75607/): Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations (high 8.1)
- [CVE-2026-75604](https://insights.sbomify.com/CVE-2026-75604/): Next.js: Unauthenticated Remote Code Execution on windows-hosted servers (critical 9.0)
- [CVE-2026-75602](https://insights.sbomify.com/CVE-2026-75602/): OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool (medium 6.5)
- [CVE-2026-75601](https://insights.sbomify.com/CVE-2026-75601/): Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled (medium 4.3)
- [CVE-2026-75600](https://insights.sbomify.com/CVE-2026-75600/): FreePBX: Authenticated API generatedocs Host Command Injection (high 8.6)
- [CVE-2026-75597](https://insights.sbomify.com/CVE-2026-75597/): pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo (medium 5.3)
- [CVE-2026-75596](https://insights.sbomify.com/CVE-2026-75596/): Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/384/