# Vulnerabilities published in 2026


- [CVE-2026-4804](https://insights.sbomify.com/CVE-2026-4804/): Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API (medium 6.4)
- [CVE-2026-48039](https://insights.sbomify.com/CVE-2026-48039/): Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token (critical 9.1)
- [CVE-2026-48038](https://insights.sbomify.com/CVE-2026-48038/): joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas (medium 5.3)
- [CVE-2026-48037](https://insights.sbomify.com/CVE-2026-48037/): Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture (medium 6.3)
- [CVE-2026-48036](https://insights.sbomify.com/CVE-2026-48036/): Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts (high 8.4)
- [CVE-2026-48035](https://insights.sbomify.com/CVE-2026-48035/): Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened (high 7.1)
- [CVE-2026-48034](https://insights.sbomify.com/CVE-2026-48034/): HULUMI-H5 bypass via decoy sibling resources targeting a different bucket (high 8.5)
- [CVE-2026-48033](https://insights.sbomify.com/CVE-2026-48033/): Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name (high 8.4)
- [CVE-2026-48032](https://insights.sbomify.com/CVE-2026-48032/): Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers (high 8.3)
- [CVE-2026-48031](https://insights.sbomify.com/CVE-2026-48031/): Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery (critical 9.1)
- [CVE-2026-48030](https://insights.sbomify.com/CVE-2026-48030/): Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78) (critical 9.9)
- [CVE-2026-4803](https://insights.sbomify.com/CVE-2026-4803/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (high 7.2)
- [CVE-2026-48029](https://insights.sbomify.com/CVE-2026-48029/): libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow (high 7.1)
- [CVE-2026-48028](https://insights.sbomify.com/CVE-2026-48028/): Mastodon: Removal of integrity-protected JSON entries from signed activities (medium 6.5)
- [CVE-2026-48027](https://insights.sbomify.com/CVE-2026-48027/): Nx Console Embedded Malicious Code (critical 9.3, exploited in the wild)
- [CVE-2026-48026](https://insights.sbomify.com/CVE-2026-48026/): lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML (high 8.7)
- [CVE-2026-48025](https://insights.sbomify.com/CVE-2026-48025/): nebula-mesh: Decrypted CA private key persists in heap after signing (medium 6.9)
- [CVE-2026-48024](https://insights.sbomify.com/CVE-2026-48024/): Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager (critical 9.1)
- [CVE-2026-48022](https://insights.sbomify.com/CVE-2026-48022/): @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects (medium 6.5)
- [CVE-2026-48021](https://insights.sbomify.com/CVE-2026-48021/): Weak cryptography in epa4all (critical 9.1)
- [CVE-2026-48020](https://insights.sbomify.com/CVE-2026-48020/): Traefik StripPrefix Route-Level Auth Bypass via Path Normalization (high 7.8)
- [CVE-2026-4802](https://insights.sbomify.com/CVE-2026-4802/): Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui (high 8.0)
- [CVE-2026-48019](https://insights.sbomify.com/CVE-2026-48019/): CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay (high 8.9)
- [CVE-2026-48017](https://insights.sbomify.com/CVE-2026-48017/): DbGate: Remote Code Execution via functionName injection in loadReader endpoint (high 8.8)
- [CVE-2026-48016](https://insights.sbomify.com/CVE-2026-48016/): Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment (medium 4.3)
- [CVE-2026-48015](https://insights.sbomify.com/CVE-2026-48015/): Shopware: Stored XSS via SVG file upload — no SVG sanitization (medium 4.9)
- [CVE-2026-48014](https://insights.sbomify.com/CVE-2026-48014/): Shopware: Admin API ACL Bypass in Order State Transition Endpoints (medium 6.5)
- [CVE-2026-48013](https://insights.sbomify.com/CVE-2026-48013/): Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation (medium 4.1)
- [CVE-2026-48012](https://insights.sbomify.com/CVE-2026-48012/): Shopware SSO referer trust leading to an arbitrary redirect target (medium 4.3)
- [CVE-2026-48011](https://insights.sbomify.com/CVE-2026-48011/): Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames (low 3.7)
- [CVE-2026-48010](https://insights.sbomify.com/CVE-2026-48010/): Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts (medium 6.5)
- [CVE-2026-4801](https://insights.sbomify.com/CVE-2026-4801/): Cross-site scripting in Page Builder Gutenberg Blocks – CoBlocks (medium 6.4)
- [CVE-2026-48009](https://insights.sbomify.com/CVE-2026-48009/): Shopware: Admin Account Takeover via User Recovery Hash Exposure (medium 6.8)
- [CVE-2026-48008](https://insights.sbomify.com/CVE-2026-48008/): Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass (medium 6.5)
- [CVE-2026-48007](https://insights.sbomify.com/CVE-2026-48007/): Element Call reports full URLs of visited pages to analytics server (high 8.6)
- [CVE-2026-48006](https://insights.sbomify.com/CVE-2026-48006/): Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (high 8.7)
- [CVE-2026-48005](https://insights.sbomify.com/CVE-2026-48005/): Apache HTTP Server: mod_auth_digest reauthentication attack (high 7.5)
- [CVE-2026-48001](https://insights.sbomify.com/CVE-2026-48001/): Adobe Commerce | Information Exposure (CWE-200) (low 3.7)
- [CVE-2026-48000](https://insights.sbomify.com/CVE-2026-48000/): Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (medium 6.1)
- [CVE-2026-4800](https://insights.sbomify.com/CVE-2026-4800/): lodash vulnerable to Code Injection via `_.template` imports key names (high 8.1)
- [CVE-2026-47999](https://insights.sbomify.com/CVE-2026-47999/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (medium 4.8)
- [CVE-2026-47998](https://insights.sbomify.com/CVE-2026-47998/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 5.9)
- [CVE-2026-47997](https://insights.sbomify.com/CVE-2026-47997/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 5.9)
- [CVE-2026-47996](https://insights.sbomify.com/CVE-2026-47996/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 6.8)
- [CVE-2026-47995](https://insights.sbomify.com/CVE-2026-47995/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.1)
- [CVE-2026-47994](https://insights.sbomify.com/CVE-2026-47994/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.7)
- [CVE-2026-47993](https://insights.sbomify.com/CVE-2026-47993/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47992](https://insights.sbomify.com/CVE-2026-47992/): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (high 7.2)
- [CVE-2026-47991](https://insights.sbomify.com/CVE-2026-47991/): Adobe Experience Manager | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (medium 6.1)
- [CVE-2026-47990](https://insights.sbomify.com/CVE-2026-47990/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-4799](https://insights.sbomify.com/CVE-2026-4799/): Open redirect vulnerability in Search Guard Kibana Plugin via manipulated requests (medium 4.3)
- [CVE-2026-47989](https://insights.sbomify.com/CVE-2026-47989/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47988](https://insights.sbomify.com/CVE-2026-47988/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 8.6)
- [CVE-2026-47987](https://insights.sbomify.com/CVE-2026-47987/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47986](https://insights.sbomify.com/CVE-2026-47986/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47985](https://insights.sbomify.com/CVE-2026-47985/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47984](https://insights.sbomify.com/CVE-2026-47984/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 8.2)
- [CVE-2026-47983](https://insights.sbomify.com/CVE-2026-47983/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47982](https://insights.sbomify.com/CVE-2026-47982/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47981](https://insights.sbomify.com/CVE-2026-47981/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47980](https://insights.sbomify.com/CVE-2026-47980/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-4798](https://insights.sbomify.com/CVE-2026-4798/): Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter (high 7.5)
- [CVE-2026-47979](https://insights.sbomify.com/CVE-2026-47979/): Media Encoder | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-47978](https://insights.sbomify.com/CVE-2026-47978/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47977](https://insights.sbomify.com/CVE-2026-47977/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47976](https://insights.sbomify.com/CVE-2026-47976/): Media Encoder | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-47975](https://insights.sbomify.com/CVE-2026-47975/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47974](https://insights.sbomify.com/CVE-2026-47974/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47973](https://insights.sbomify.com/CVE-2026-47973/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47972](https://insights.sbomify.com/CVE-2026-47972/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47971](https://insights.sbomify.com/CVE-2026-47971/): Media Encoder | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-47970](https://insights.sbomify.com/CVE-2026-47970/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47969](https://insights.sbomify.com/CVE-2026-47969/): Audition | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-47968](https://insights.sbomify.com/CVE-2026-47968/): Audition | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-47967](https://insights.sbomify.com/CVE-2026-47967/): Audition | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-47966](https://insights.sbomify.com/CVE-2026-47966/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47965](https://insights.sbomify.com/CVE-2026-47965/): Acrobat Reader | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-47964](https://insights.sbomify.com/CVE-2026-47964/): DNG SDK | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-47963](https://insights.sbomify.com/CVE-2026-47963/): DNG SDK | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-47962](https://insights.sbomify.com/CVE-2026-47962/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47961](https://insights.sbomify.com/CVE-2026-47961/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-47960](https://insights.sbomify.com/CVE-2026-47960/): ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (high 7.4)
- [CVE-2026-47959](https://insights.sbomify.com/CVE-2026-47959/): Acrobat Reader | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-47958](https://insights.sbomify.com/CVE-2026-47958/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47957](https://insights.sbomify.com/CVE-2026-47957/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47956](https://insights.sbomify.com/CVE-2026-47956/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47955](https://insights.sbomify.com/CVE-2026-47955/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-47954](https://insights.sbomify.com/CVE-2026-47954/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47953](https://insights.sbomify.com/CVE-2026-47953/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47952](https://insights.sbomify.com/CVE-2026-47952/): Acrobat Reader | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-47951](https://insights.sbomify.com/CVE-2026-47951/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47950](https://insights.sbomify.com/CVE-2026-47950/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-4795](https://insights.sbomify.com/CVE-2026-4795/): Missing authorization in GS1200-10v3 firmware (medium 6.5)
- [CVE-2026-47949](https://insights.sbomify.com/CVE-2026-47949/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47948](https://insights.sbomify.com/CVE-2026-47948/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47947](https://insights.sbomify.com/CVE-2026-47947/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47946](https://insights.sbomify.com/CVE-2026-47946/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47945](https://insights.sbomify.com/CVE-2026-47945/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47944](https://insights.sbomify.com/CVE-2026-47944/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-47943](https://insights.sbomify.com/CVE-2026-47943/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/597/