# Vulnerabilities published in 2026


- [CVE-2026-48339](https://insights.sbomify.com/CVE-2026-48339/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48338](https://insights.sbomify.com/CVE-2026-48338/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 6.8)
- [CVE-2026-48337](https://insights.sbomify.com/CVE-2026-48337/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48336](https://insights.sbomify.com/CVE-2026-48336/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48335](https://insights.sbomify.com/CVE-2026-48335/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48334](https://insights.sbomify.com/CVE-2026-48334/): Illustrator | Improper Input Validation (CWE-20) (critical 9.3)
- [CVE-2026-48333](https://insights.sbomify.com/CVE-2026-48333/): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (critical 9.8)
- [CVE-2026-48332](https://insights.sbomify.com/CVE-2026-48332/): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (high 7.7)
- [CVE-2026-48331](https://insights.sbomify.com/CVE-2026-48331/): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (critical 10.0)
- [CVE-2026-48330](https://insights.sbomify.com/CVE-2026-48330/): SQL injection in Adobe Campaign Classic (critical 10.0)
- [CVE-2026-4833](https://insights.sbomify.com/CVE-2026-4833/): Orc discount Markdown markdown.c compile recursion (medium 4.8)
- [CVE-2026-48329](https://insights.sbomify.com/CVE-2026-48329/): ColdFusion | Insufficient Session Expiration (CWE-613) (low 2.7)
- [CVE-2026-48328](https://insights.sbomify.com/CVE-2026-48328/): ColdFusion | Improper Input Validation (CWE-20) (high 7.7)
- [CVE-2026-48327](https://insights.sbomify.com/CVE-2026-48327/): ColdFusion | Incorrect Authorization (CWE-863) (critical 9.0)
- [CVE-2026-48326](https://insights.sbomify.com/CVE-2026-48326/): SQL injection in Adobe Campaign Classic (critical 9.9)
- [CVE-2026-48325](https://insights.sbomify.com/CVE-2026-48325/): ColdFusion | Missing Authentication for Critical Function (CWE-306) (critical 9.3)
- [CVE-2026-48324](https://insights.sbomify.com/CVE-2026-48324/): ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (critical 9.1)
- [CVE-2026-48323](https://insights.sbomify.com/CVE-2026-48323/): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) (critical 10.0)
- [CVE-2026-48322](https://insights.sbomify.com/CVE-2026-48322/): ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 9.9)
- [CVE-2026-48321](https://insights.sbomify.com/CVE-2026-48321/): ColdFusion | Incorrect Authorization (CWE-863) (critical 9.3)
- [CVE-2026-48320](https://insights.sbomify.com/CVE-2026-48320/): ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) (high 8.5)
- [CVE-2026-4832](https://insights.sbomify.com/CVE-2026-4832/): Hardcoded credentials in Easergy MiCOM P14x (medium 6.9)
- [CVE-2026-48319](https://insights.sbomify.com/CVE-2026-48319/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (critical 9.1)
- [CVE-2026-48318](https://insights.sbomify.com/CVE-2026-48318/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (critical 9.9)
- [CVE-2026-48317](https://insights.sbomify.com/CVE-2026-48317/): Code injection in Adobe Campaign Classic (critical 9.6)
- [CVE-2026-48316](https://insights.sbomify.com/CVE-2026-48316/): ColdFusion | Improper Input Validation (CWE-20) (critical 10.0)
- [CVE-2026-48315](https://insights.sbomify.com/CVE-2026-48315/): ColdFusion | Improper Input Validation (CWE-20) (critical 9.3)
- [CVE-2026-48314](https://insights.sbomify.com/CVE-2026-48314/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 6.5)
- [CVE-2026-48313](https://insights.sbomify.com/CVE-2026-48313/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (critical 9.3)
- [CVE-2026-48312](https://insights.sbomify.com/CVE-2026-48312/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.8)
- [CVE-2026-48311](https://insights.sbomify.com/CVE-2026-48311/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48310](https://insights.sbomify.com/CVE-2026-48310/): Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 8.6)
- [CVE-2026-4831](https://insights.sbomify.com/CVE-2026-4831/): kalcaddle kodbox Password-protected Share auth.class.php can improper authentication (medium 6.3)
- [CVE-2026-48309](https://insights.sbomify.com/CVE-2026-48309/): Audition | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48308](https://insights.sbomify.com/CVE-2026-48308/): Premiere Pro | Improper Input Validation (CWE-20) (medium 5.9)
- [CVE-2026-48307](https://insights.sbomify.com/CVE-2026-48307/): ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) (high 8.8)
- [CVE-2026-48306](https://insights.sbomify.com/CVE-2026-48306/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48305](https://insights.sbomify.com/CVE-2026-48305/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48304](https://insights.sbomify.com/CVE-2026-48304/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48303](https://insights.sbomify.com/CVE-2026-48303/): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-48302](https://insights.sbomify.com/CVE-2026-48302/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.2)
- [CVE-2026-48301](https://insights.sbomify.com/CVE-2026-48301/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48300](https://insights.sbomify.com/CVE-2026-48300/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-4830](https://insights.sbomify.com/CVE-2026-4830/): kalcaddle kodbox Public Share userShare.class.php add privilege escalation (medium 6.3)
- [CVE-2026-48299](https://insights.sbomify.com/CVE-2026-48299/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48298](https://insights.sbomify.com/CVE-2026-48298/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 6.2)
- [CVE-2026-48297](https://insights.sbomify.com/CVE-2026-48297/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48296](https://insights.sbomify.com/CVE-2026-48296/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 6.2)
- [CVE-2026-48295](https://insights.sbomify.com/CVE-2026-48295/): CAI Content Credentials | Insufficiently Protected Credentials (CWE-522) (high 7.5)
- [CVE-2026-48294](https://insights.sbomify.com/CVE-2026-48294/): Cross-site scripting in Adobe Acrobat PDF Extension (Chrome) (high 7.4)
- [CVE-2026-48293](https://insights.sbomify.com/CVE-2026-48293/): InDesign Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48292](https://insights.sbomify.com/CVE-2026-48292/): Format Plugins | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48291](https://insights.sbomify.com/CVE-2026-48291/): Format Plugins | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48290](https://insights.sbomify.com/CVE-2026-48290/): CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918) (high 8.2)
- [CVE-2026-4829](https://insights.sbomify.com/CVE-2026-4829/): Auth bypass in Server (medium 5.4)
- [CVE-2026-48289](https://insights.sbomify.com/CVE-2026-48289/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2026-48288](https://insights.sbomify.com/CVE-2026-48288/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2026-48287](https://insights.sbomify.com/CVE-2026-48287/): CAI Content Credentials | Untrusted Search Path (CWE-426) (high 7.4)
- [CVE-2026-48286](https://insights.sbomify.com/CVE-2026-48286/): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-48285](https://insights.sbomify.com/CVE-2026-48285/): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (high 8.6)
- [CVE-2026-48284](https://insights.sbomify.com/CVE-2026-48284/): ColdFusion | Improper Input Validation (CWE-20) (critical 9.6)
- [CVE-2026-48283](https://insights.sbomify.com/CVE-2026-48283/): ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) (critical 10.0)
- [CVE-2026-48282](https://insights.sbomify.com/CVE-2026-48282/): Adobe ColdFusion Path Traversal (critical 10.0, exploited in the wild)
- [CVE-2026-48281](https://insights.sbomify.com/CVE-2026-48281/): ColdFusion | Improper Input Validation (CWE-20) (critical 10.0)
- [CVE-2026-48280](https://insights.sbomify.com/CVE-2026-48280/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-4828](https://insights.sbomify.com/CVE-2026-4828/): Auth bypass in Server (high 8.2)
- [CVE-2026-48277](https://insights.sbomify.com/CVE-2026-48277/): ColdFusion | Improper Input Validation (CWE-20) (critical 10.0)
- [CVE-2026-48276](https://insights.sbomify.com/CVE-2026-48276/): ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) (critical 10.0)
- [CVE-2026-48275](https://insights.sbomify.com/CVE-2026-48275/): Illustrator | Untrusted Search Path (CWE-426) (high 8.6)
- [CVE-2026-48274](https://insights.sbomify.com/CVE-2026-48274/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-48273](https://insights.sbomify.com/CVE-2026-48273/): ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) (critical 9.9)
- [CVE-2026-48272](https://insights.sbomify.com/CVE-2026-48272/): Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427) (high 7.8)
- [CVE-2026-48271](https://insights.sbomify.com/CVE-2026-48271/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48270](https://insights.sbomify.com/CVE-2026-48270/): Premiere Pro | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-4827](https://insights.sbomify.com/CVE-2026-4827/): Insufficient Entropy vulnerability on Multiple Products (high 8.7)
- [CVE-2026-48269](https://insights.sbomify.com/CVE-2026-48269/): Premiere Pro | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-48268](https://insights.sbomify.com/CVE-2026-48268/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48267](https://insights.sbomify.com/CVE-2026-48267/): DNG SDK | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-48266](https://insights.sbomify.com/CVE-2026-48266/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48265](https://insights.sbomify.com/CVE-2026-48265/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48264](https://insights.sbomify.com/CVE-2026-48264/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48263](https://insights.sbomify.com/CVE-2026-48263/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48262](https://insights.sbomify.com/CVE-2026-48262/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48261](https://insights.sbomify.com/CVE-2026-48261/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48260](https://insights.sbomify.com/CVE-2026-48260/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-4826](https://insights.sbomify.com/CVE-2026-4826/): SourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injection (medium 5.3)
- [CVE-2026-48259](https://insights.sbomify.com/CVE-2026-48259/): Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918) (critical 9.6)
- [CVE-2026-48258](https://insights.sbomify.com/CVE-2026-48258/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48257](https://insights.sbomify.com/CVE-2026-48257/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48256](https://insights.sbomify.com/CVE-2026-48256/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48255](https://insights.sbomify.com/CVE-2026-48255/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48254](https://insights.sbomify.com/CVE-2026-48254/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48253](https://insights.sbomify.com/CVE-2026-48253/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48252](https://insights.sbomify.com/CVE-2026-48252/): Adobe Experience Manager | Missing Authentication for Critical Function (CWE-306) (high 8.6)
- [CVE-2026-48251](https://insights.sbomify.com/CVE-2026-48251/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-48250](https://insights.sbomify.com/CVE-2026-48250/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-4825](https://insights.sbomify.com/CVE-2026-4825/): SourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injection (medium 5.3)
- [CVE-2026-48249](https://insights.sbomify.com/CVE-2026-48249/): Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in rm/incs/mobile_login.inc.php (high 8.2)
- [CVE-2026-48248](https://insights.sbomify.com/CVE-2026-48248/): Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/login.inc.php (high 8.2)
- [CVE-2026-48247](https://insights.sbomify.com/CVE-2026-48247/): Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/functions.inc.php (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/594/