# Vulnerabilities published in 2026


- [CVE-2026-48433](https://insights.sbomify.com/CVE-2026-48433/): Substance3D - Designer | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48432](https://insights.sbomify.com/CVE-2026-48432/): Substance3D - Designer | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48431](https://insights.sbomify.com/CVE-2026-48431/): Substance3D - Designer | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48430](https://insights.sbomify.com/CVE-2026-48430/): Substance3D - Designer | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-4843](https://insights.sbomify.com/CVE-2026-4843/): GSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset (medium 4.3)
- [CVE-2026-48429](https://insights.sbomify.com/CVE-2026-48429/): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-48428](https://insights.sbomify.com/CVE-2026-48428/): Substance3D - Designer | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48427](https://insights.sbomify.com/CVE-2026-48427/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48426](https://insights.sbomify.com/CVE-2026-48426/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48425](https://insights.sbomify.com/CVE-2026-48425/): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48424](https://insights.sbomify.com/CVE-2026-48424/): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48423](https://insights.sbomify.com/CVE-2026-48423/): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48422](https://insights.sbomify.com/CVE-2026-48422/): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48421](https://insights.sbomify.com/CVE-2026-48421/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48420](https://insights.sbomify.com/CVE-2026-48420/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-4842](https://insights.sbomify.com/CVE-2026-4842/): itsourcecode Online Enrollment System Parameter index.php sql injection (medium 6.9)
- [CVE-2026-48419](https://insights.sbomify.com/CVE-2026-48419/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48418](https://insights.sbomify.com/CVE-2026-48418/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48417](https://insights.sbomify.com/CVE-2026-48417/): Substance3D - Sampler | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-48416](https://insights.sbomify.com/CVE-2026-48416/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 7.5)
- [CVE-2026-48415](https://insights.sbomify.com/CVE-2026-48415/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 7.6)
- [CVE-2026-48414](https://insights.sbomify.com/CVE-2026-48414/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 7.7)
- [CVE-2026-48413](https://insights.sbomify.com/CVE-2026-48413/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.7)
- [CVE-2026-48412](https://insights.sbomify.com/CVE-2026-48412/): Adobe Commerce | Incorrect Authorization (CWE-863) (low 2.7)
- [CVE-2026-48411](https://insights.sbomify.com/CVE-2026-48411/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 6.5)
- [CVE-2026-48410](https://insights.sbomify.com/CVE-2026-48410/): Lightroom Classic | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-4841](https://insights.sbomify.com/CVE-2026-4841/): code-projects Online Food Ordering System Shopping Cart cart.php sql injection (medium 6.9)
- [CVE-2026-48409](https://insights.sbomify.com/CVE-2026-48409/): Lightroom Classic | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48408](https://insights.sbomify.com/CVE-2026-48408/): Lightroom Classic | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48407](https://insights.sbomify.com/CVE-2026-48407/): Lightroom Classic | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48406](https://insights.sbomify.com/CVE-2026-48406/): Lightroom Classic | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48405](https://insights.sbomify.com/CVE-2026-48405/): Lightroom Classic | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48404](https://insights.sbomify.com/CVE-2026-48404/): Lightroom Classic | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-4840](https://insights.sbomify.com/CVE-2026-4840/): Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection (high 8.7)
- [CVE-2026-48399](https://insights.sbomify.com/CVE-2026-48399/): Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657) (high 7.5)
- [CVE-2026-48398](https://insights.sbomify.com/CVE-2026-48398/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48397](https://insights.sbomify.com/CVE-2026-48397/): Lightroom Classic | Deserialization of Untrusted Data (CWE-502) (high 8.6)
- [CVE-2026-48396](https://insights.sbomify.com/CVE-2026-48396/): Bridge | Incorrect Authorization (CWE-863) (high 8.6)
- [CVE-2026-48395](https://insights.sbomify.com/CVE-2026-48395/): Bridge | Untrusted Search Path (CWE-426) (high 8.6)
- [CVE-2026-48394](https://insights.sbomify.com/CVE-2026-48394/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48393](https://insights.sbomify.com/CVE-2026-48393/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48392](https://insights.sbomify.com/CVE-2026-48392/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48391](https://insights.sbomify.com/CVE-2026-48391/): Bridge | Untrusted Search Path (CWE-426) (high 8.2)
- [CVE-2026-48390](https://insights.sbomify.com/CVE-2026-48390/): Bridge | Incorrect Authorization (CWE-863) (high 8.2)
- [CVE-2026-4839](https://insights.sbomify.com/CVE-2026-4839/): SourceCodester Food Ordering System Parameter purchase.php sql injection (medium 6.9)
- [CVE-2026-48389](https://insights.sbomify.com/CVE-2026-48389/): DNG SDK | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-48388](https://insights.sbomify.com/CVE-2026-48388/): Photoshop Installer | CWE-427: Uncontrolled Search Path Element (high 8.6)
- [CVE-2026-48387](https://insights.sbomify.com/CVE-2026-48387/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (medium 6.2)
- [CVE-2026-48386](https://insights.sbomify.com/CVE-2026-48386/): ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327) (high 7.5)
- [CVE-2026-48385](https://insights.sbomify.com/CVE-2026-48385/): ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (high 7.7)
- [CVE-2026-48384](https://insights.sbomify.com/CVE-2026-48384/): ColdFusion | Improper Input Validation (CWE-20) (medium 4.9)
- [CVE-2026-48383](https://insights.sbomify.com/CVE-2026-48383/): Adobe Experience Manager | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-48382](https://insights.sbomify.com/CVE-2026-48382/): Adobe Experience Manager | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-48381](https://insights.sbomify.com/CVE-2026-48381/): SQL injection in Adobe Campaign Classic (critical 9.0)
- [CVE-2026-48380](https://insights.sbomify.com/CVE-2026-48380/): Substance3D - Painter | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-4838](https://insights.sbomify.com/CVE-2026-4838/): SourceCodester Malawi Online Market display.php sql injection (medium 6.9)
- [CVE-2026-48379](https://insights.sbomify.com/CVE-2026-48379/): Substance3D - Painter | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-48378](https://insights.sbomify.com/CVE-2026-48378/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 5.3)
- [CVE-2026-48377](https://insights.sbomify.com/CVE-2026-48377/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 5.3)
- [CVE-2026-48376](https://insights.sbomify.com/CVE-2026-48376/): ColdFusion | Improper Encoding or Escaping of Output (CWE-116) (medium 5.4)
- [CVE-2026-48375](https://insights.sbomify.com/CVE-2026-48375/): ColdFusion | Incorrect Authorization (CWE-863) (medium 6.5)
- [CVE-2026-48374](https://insights.sbomify.com/CVE-2026-48374/): Bridge | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 7.8)
- [CVE-2026-48373](https://insights.sbomify.com/CVE-2026-48373/): Acrobat Reader | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48372](https://insights.sbomify.com/CVE-2026-48372/): Format Plugins | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48371](https://insights.sbomify.com/CVE-2026-48371/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48370](https://insights.sbomify.com/CVE-2026-48370/): Media Encoder | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-4837](https://insights.sbomify.com/CVE-2026-4837/): Eval Injection in Rapid7 Insight Agent (medium 6.6)
- [CVE-2026-48369](https://insights.sbomify.com/CVE-2026-48369/): Premiere Pro | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48368](https://insights.sbomify.com/CVE-2026-48368/): Audition | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48367](https://insights.sbomify.com/CVE-2026-48367/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48366](https://insights.sbomify.com/CVE-2026-48366/): Media Encoder | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48365](https://insights.sbomify.com/CVE-2026-48365/): Audition | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48364](https://insights.sbomify.com/CVE-2026-48364/): ColdFusion | Uncontrolled Search Path Element (CWE-427) (high 8.2)
- [CVE-2026-48363](https://insights.sbomify.com/CVE-2026-48363/): ColdFusion | Uncontrolled Search Path Element (CWE-427) (high 8.2)
- [CVE-2026-48362](https://insights.sbomify.com/CVE-2026-48362/): ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (critical 10.0)
- [CVE-2026-48361](https://insights.sbomify.com/CVE-2026-48361/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (medium 6.1)
- [CVE-2026-48360](https://insights.sbomify.com/CVE-2026-48360/): Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 9.6)
- [CVE-2026-4836](https://insights.sbomify.com/CVE-2026-4836/): code-projects Accounting System delete.php sql injection (medium 5.3)
- [CVE-2026-48359](https://insights.sbomify.com/CVE-2026-48359/): Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (critical 9.6)
- [CVE-2026-48358](https://insights.sbomify.com/CVE-2026-48358/): Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) (critical 9.1)
- [CVE-2026-48357](https://insights.sbomify.com/CVE-2026-48357/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (medium 6.2)
- [CVE-2026-48356](https://insights.sbomify.com/CVE-2026-48356/): Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type (critical 9.3, exploited in the wild)
- [CVE-2026-48355](https://insights.sbomify.com/CVE-2026-48355/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48354](https://insights.sbomify.com/CVE-2026-48354/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (medium 6.2)
- [CVE-2026-48353](https://insights.sbomify.com/CVE-2026-48353/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 5.5)
- [CVE-2026-48352](https://insights.sbomify.com/CVE-2026-48352/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-48351](https://insights.sbomify.com/CVE-2026-48351/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-48350](https://insights.sbomify.com/CVE-2026-48350/): Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 8.6)
- [CVE-2026-4835](https://insights.sbomify.com/CVE-2026-4835/): code-projects Accounting System Web Application add_costumer.php cross site scripting (medium 5.1)
- [CVE-2026-48349](https://insights.sbomify.com/CVE-2026-48349/): Animate | Incorrect Authorization (CWE-863) (high 8.1)
- [CVE-2026-48348](https://insights.sbomify.com/CVE-2026-48348/): Animate | Incorrect Authorization (CWE-863) (high 7.7)
- [CVE-2026-48347](https://insights.sbomify.com/CVE-2026-48347/): Animate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (high 7.7)
- [CVE-2026-48346](https://insights.sbomify.com/CVE-2026-48346/): Animate | Untrusted Search Path (CWE-426) (high 7.9)
- [CVE-2026-48345](https://insights.sbomify.com/CVE-2026-48345/): Animate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (high 8.2)
- [CVE-2026-48344](https://insights.sbomify.com/CVE-2026-48344/): GoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) (high 7.8)
- [CVE-2026-48343](https://insights.sbomify.com/CVE-2026-48343/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48342](https://insights.sbomify.com/CVE-2026-48342/): Bridge | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-48341](https://insights.sbomify.com/CVE-2026-48341/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48340](https://insights.sbomify.com/CVE-2026-48340/): Bridge | Untrusted Pointer Dereference (CWE-822) (high 7.8)
- [CVE-2026-4834](https://insights.sbomify.com/CVE-2026-4834/): WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/593/