Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 593 of 1013.
- CVE-2026-48433 Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48432 Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48431 Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48430 Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-4843 GSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset
- CVE-2026-48429 Substance3D - Designer | NULL Pointer Dereference (CWE-476)
- CVE-2026-48428 Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48427 Substance3D - Designer | Out-of-bounds Write (CWE-787)
- CVE-2026-48426 Substance3D - Designer | Out-of-bounds Write (CWE-787)
- CVE-2026-48425 Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48424 Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48423 Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48422 Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48421 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
- CVE-2026-48420 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
- CVE-2026-4842 itsourcecode Online Enrollment System Parameter index.php sql injection
- CVE-2026-48419 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
- CVE-2026-48418 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
- CVE-2026-48417 Substance3D - Sampler | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-48416 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-48415 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-48414 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-48413 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-48412 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-48411 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-48410 Lightroom Classic | Out-of-bounds Write (CWE-787)
- CVE-2026-4841 code-projects Online Food Ordering System Shopping Cart cart.php sql injection
- CVE-2026-48409 Lightroom Classic | Out-of-bounds Write (CWE-787)
- CVE-2026-48408 Lightroom Classic | Out-of-bounds Write (CWE-787)
- CVE-2026-48407 Lightroom Classic | Out-of-bounds Write (CWE-787)
- CVE-2026-48406 Lightroom Classic | Out-of-bounds Write (CWE-787)
- CVE-2026-48405 Lightroom Classic | Out-of-bounds Write (CWE-787)
- CVE-2026-48404 Lightroom Classic | Out-of-bounds Write (CWE-787)
- CVE-2026-4840 Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection
- CVE-2026-48399 Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657)
- CVE-2026-48398 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-48397 Lightroom Classic | Deserialization of Untrusted Data (CWE-502)
- CVE-2026-48396 Bridge | Incorrect Authorization (CWE-863)
- CVE-2026-48395 Bridge | Untrusted Search Path (CWE-426)
- CVE-2026-48394 Bridge | Out-of-bounds Write (CWE-787)
- CVE-2026-48393 Bridge | Out-of-bounds Write (CWE-787)
- CVE-2026-48392 Bridge | Out-of-bounds Write (CWE-787)
- CVE-2026-48391 Bridge | Untrusted Search Path (CWE-426)
- CVE-2026-48390 Bridge | Incorrect Authorization (CWE-863)
- CVE-2026-4839 SourceCodester Food Ordering System Parameter purchase.php sql injection
- CVE-2026-48389 DNG SDK | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-48388 Photoshop Installer | CWE-427: Uncontrolled Search Path Element
- CVE-2026-48387 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-48386 ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
- CVE-2026-48385 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-48384 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-48383 Adobe Experience Manager | Incorrect Authorization (CWE-863)
- CVE-2026-48382 Adobe Experience Manager | Incorrect Authorization (CWE-863)
- CVE-2026-48381 SQL injection in Adobe Campaign Classic
- CVE-2026-48380 Substance3D - Painter | Out-of-bounds Read (CWE-125)
- CVE-2026-4838 SourceCodester Malawi Online Market display.php sql injection
- CVE-2026-48379 Substance3D - Painter | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-48378 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-48377 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-48376 ColdFusion | Improper Encoding or Escaping of Output (CWE-116)
- CVE-2026-48375 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-48374 Bridge | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-48373 Acrobat Reader | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48372 Format Plugins | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-48371 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-48370 Media Encoder | Out-of-bounds Write (CWE-787)
- CVE-2026-4837 Eval Injection in Rapid7 Insight Agent
- CVE-2026-48369 Premiere Pro | Out-of-bounds Write (CWE-787)
- CVE-2026-48368 Audition | Out-of-bounds Write (CWE-787)
- CVE-2026-48367 After Effects | Out-of-bounds Write (CWE-787)
- CVE-2026-48366 Media Encoder | Out-of-bounds Write (CWE-787)
- CVE-2026-48365 Audition | Out-of-bounds Write (CWE-787)
- CVE-2026-48364 ColdFusion | Uncontrolled Search Path Element (CWE-427)
- CVE-2026-48363 ColdFusion | Uncontrolled Search Path Element (CWE-427)
- CVE-2026-48362 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-48361 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-48360 Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-4836 code-projects Accounting System delete.php sql injection
- CVE-2026-48359 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- CVE-2026-48358 Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)
- CVE-2026-48357 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type
- CVE-2026-48355 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-48354 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-48353 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-48352 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-48351 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-48350 Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-4835 code-projects Accounting System Web Application add_costumer.php cross site scripting
- CVE-2026-48349 Animate | Incorrect Authorization (CWE-863)
- CVE-2026-48348 Animate | Incorrect Authorization (CWE-863)
- CVE-2026-48347 Animate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-48346 Animate | Untrusted Search Path (CWE-426)
- CVE-2026-48345 Animate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-48344 GoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
- CVE-2026-48343 Bridge | Out-of-bounds Write (CWE-787)
- CVE-2026-48342 Bridge | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-48341 Bridge | Out-of-bounds Write (CWE-787)
- CVE-2026-48340 Bridge | Untrusted Pointer Dereference (CWE-822)
- CVE-2026-4834 WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter