Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 697 of 1013.
- CVE-2026-34725 dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
- CVE-2026-34724 Zammad has a server-side template injection leading to RCE via AI Agent
- CVE-2026-34723 Zammad has incorrect access control in getting_started_controller
- CVE-2026-34722 Zammad is missing authorization in ticket create endpoint
- CVE-2026-34721 Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints
- CVE-2026-34720 Zammad has an origin validation error in SSO mechanism
- CVE-2026-3472 Markdown image rendering bypass in AI bot tool result posts in Mattermost
- CVE-2026-34719 Zammad has a Server-side request forgery (SSRF) via webhooks
- CVE-2026-34718 Zammad improperly neutralizes of script-related HTML tags in ticket articles
- CVE-2026-34717 OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
- CVE-2026-34716 AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
- CVE-2026-34715 ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)
- CVE-2026-34714 Code injection in Vim
- CVE-2026-34713 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-34712 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-34711 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-34710 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
- CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App
- CVE-2026-34709 Substance3D - Sampler | Out-of-bounds Write (CWE-787)
- CVE-2026-34708 InCopy | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-34707 InCopy | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-34706 InCopy | Out-of-bounds Write (CWE-787)
- CVE-2026-34705 InDesign Desktop | Out-of-bounds Read (CWE-125)
- CVE-2026-34704 InDesign Desktop | NULL Pointer Dereference (CWE-476)
- CVE-2026-34703 InDesign Desktop | NULL Pointer Dereference (CWE-476)
- CVE-2026-34702 InDesign Desktop | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-34701 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-34700 InDesign Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-3470 Other in Email Security
- CVE-2026-34699 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-34698 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-34697 InDesign Desktop | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-34696 InDesign Desktop | Use After Free (CWE-416)
- CVE-2026-34695 InDesign Desktop | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-34694 Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-34693 Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2026-34692 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-34691 Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-34690 After Effects | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-3469 Denial of service in Email Security
- CVE-2026-34689 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-34688 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-34687 Illustrator | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-34686 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-34685 Adobe Commerce | Improper Input Validation (CWE-20)
- CVE-2026-34684 Substance3D - Designer | Out-of-bounds Write (CWE-787)
- CVE-2026-34683 Substance3D - Designer | Out-of-bounds Write (CWE-787)
- CVE-2026-34682 Substance3D - Designer | Out-of-bounds Write (CWE-787)
- CVE-2026-34681 Substance3D - Designer | Out-of-bounds Write (CWE-787)
- CVE-2026-34680 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-3468 Cross-site scripting in Email Security
- CVE-2026-34679 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-34678 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-34677 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-34676 Substance3D - Painter | Out-of-bounds Write (CWE-787)
- CVE-2026-34675 Substance3D - Painter | Out-of-bounds Write (CWE-787)
- CVE-2026-34674 Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-34673 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-34672 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-34671 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-34670 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-34669 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-34668 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-34667 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
- CVE-2026-34666 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-34665 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-34664 Substance3D - Designer | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-34663 Illustrator | Out-of-bounds Read (CWE-125)
- CVE-2026-34662 Illustrator | NULL Pointer Dereference (CWE-476)
- CVE-2026-34661 Illustrator | Out-of-bounds Write (CWE-787)
- CVE-2026-34660 Adobe Connect | Incorrect Authorization (CWE-863)
- CVE-2026-3466 Cross-site scripting in dashlet title
- CVE-2026-34659 Adobe Connect | Deserialization of Untrusted Data (CWE-502)
- CVE-2026-34658 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-34657 CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-34656 Adobe Commerce | Improper Authorization (CWE-285)
- CVE-2026-34655 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-34654 Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)
- CVE-2026-34653 Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-34652 Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)
- CVE-2026-34651 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-34650 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-3465 Tuya App/SDK JSON Data Point denial of service
- CVE-2026-34649 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-34648 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-34647 Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-34646 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-34645 Adobe Commerce | Incorrect Authorization (CWE-863)
- CVE-2026-34644 After Effects | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-34643 After Effects | Out-of-bounds Write (CWE-787)
- CVE-2026-34642 After Effects | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-34641 Premiere Pro | Out-of-bounds Write (CWE-787)
- CVE-2026-34640 Media Encoder | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-3464 WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
- CVE-2026-34639 Media Encoder | Out-of-bounds Write (CWE-787)
- CVE-2026-34638 Premiere Pro | Use After Free (CWE-416)
- CVE-2026-34637 Premiere Pro | Out-of-bounds Write (CWE-787)
- CVE-2026-34636 Premiere Pro | Out-of-bounds Write (CWE-787)
- CVE-2026-34635 ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321)
- CVE-2026-34634 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)