# Vulnerabilities published in 2026


- [CVE-2026-34725](https://insights.sbomify.com/CVE-2026-34725/): dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration (high 8.3)
- [CVE-2026-34724](https://insights.sbomify.com/CVE-2026-34724/): Zammad has a server-side template injection leading to RCE via AI Agent (high 8.7)
- [CVE-2026-34723](https://insights.sbomify.com/CVE-2026-34723/): Zammad has incorrect access control in getting_started_controller (high 8.7)
- [CVE-2026-34722](https://insights.sbomify.com/CVE-2026-34722/): Zammad is missing authorization in ticket create endpoint (medium 6.9)
- [CVE-2026-34721](https://insights.sbomify.com/CVE-2026-34721/): Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints (medium 5.9)
- [CVE-2026-34720](https://insights.sbomify.com/CVE-2026-34720/): Zammad has an origin validation error in SSO mechanism (low 2.3)
- [CVE-2026-3472](https://insights.sbomify.com/CVE-2026-3472/): Markdown image rendering bypass in AI bot tool result posts in Mattermost (low 3.5)
- [CVE-2026-34719](https://insights.sbomify.com/CVE-2026-34719/): Zammad has a Server-side request forgery (SSRF) via webhooks (high 8.3)
- [CVE-2026-34718](https://insights.sbomify.com/CVE-2026-34718/): Zammad improperly neutralizes of script-related HTML tags in ticket articles (medium 5.3)
- [CVE-2026-34717](https://insights.sbomify.com/CVE-2026-34717/): OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string (critical 9.9)
- [CVE-2026-34716](https://insights.sbomify.com/CVE-2026-34716/): AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification (medium 6.4)
- [CVE-2026-34715](https://insights.sbomify.com/CVE-2026-34715/): ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting) (medium 5.3)
- [CVE-2026-34714](https://insights.sbomify.com/CVE-2026-34714/): Code injection in Vim (critical 9.2)
- [CVE-2026-34713](https://insights.sbomify.com/CVE-2026-34713/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-34712](https://insights.sbomify.com/CVE-2026-34712/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-34711](https://insights.sbomify.com/CVE-2026-34711/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (high 7.5)
- [CVE-2026-34710](https://insights.sbomify.com/CVE-2026-34710/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-3471](https://insights.sbomify.com/CVE-2026-3471/): Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App (medium 6.5)
- [CVE-2026-34709](https://insights.sbomify.com/CVE-2026-34709/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34708](https://insights.sbomify.com/CVE-2026-34708/): InCopy | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-34707](https://insights.sbomify.com/CVE-2026-34707/): InCopy | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34706](https://insights.sbomify.com/CVE-2026-34706/): InCopy | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34705](https://insights.sbomify.com/CVE-2026-34705/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-34704](https://insights.sbomify.com/CVE-2026-34704/): InDesign Desktop | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-34703](https://insights.sbomify.com/CVE-2026-34703/): InDesign Desktop | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-34702](https://insights.sbomify.com/CVE-2026-34702/): InDesign Desktop | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-34701](https://insights.sbomify.com/CVE-2026-34701/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34700](https://insights.sbomify.com/CVE-2026-34700/): InDesign Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-3470](https://insights.sbomify.com/CVE-2026-3470/): Other in Email Security (low 3.8)
- [CVE-2026-34699](https://insights.sbomify.com/CVE-2026-34699/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34698](https://insights.sbomify.com/CVE-2026-34698/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34697](https://insights.sbomify.com/CVE-2026-34697/): InDesign Desktop | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-34696](https://insights.sbomify.com/CVE-2026-34696/): InDesign Desktop | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-34695](https://insights.sbomify.com/CVE-2026-34695/): InDesign Desktop | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-34694](https://insights.sbomify.com/CVE-2026-34694/): Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79) (medium 4.8)
- [CVE-2026-34693](https://insights.sbomify.com/CVE-2026-34693/): Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79) (high 8.0)
- [CVE-2026-34692](https://insights.sbomify.com/CVE-2026-34692/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-34691](https://insights.sbomify.com/CVE-2026-34691/): Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-34690](https://insights.sbomify.com/CVE-2026-34690/): After Effects | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-3469](https://insights.sbomify.com/CVE-2026-3469/): Denial of service in Email Security (low 2.7)
- [CVE-2026-34689](https://insights.sbomify.com/CVE-2026-34689/): Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 8.6)
- [CVE-2026-34688](https://insights.sbomify.com/CVE-2026-34688/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.2)
- [CVE-2026-34687](https://insights.sbomify.com/CVE-2026-34687/): Illustrator | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34686](https://insights.sbomify.com/CVE-2026-34686/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.7)
- [CVE-2026-34685](https://insights.sbomify.com/CVE-2026-34685/): Adobe Commerce | Improper Input Validation (CWE-20) (low 3.4)
- [CVE-2026-34684](https://insights.sbomify.com/CVE-2026-34684/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34683](https://insights.sbomify.com/CVE-2026-34683/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34682](https://insights.sbomify.com/CVE-2026-34682/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34681](https://insights.sbomify.com/CVE-2026-34681/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34680](https://insights.sbomify.com/CVE-2026-34680/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (medium 6.2)
- [CVE-2026-3468](https://insights.sbomify.com/CVE-2026-3468/): Cross-site scripting in Email Security (medium 4.8)
- [CVE-2026-34679](https://insights.sbomify.com/CVE-2026-34679/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.2)
- [CVE-2026-34678](https://insights.sbomify.com/CVE-2026-34678/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (medium 6.2)
- [CVE-2026-34677](https://insights.sbomify.com/CVE-2026-34677/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (medium 6.2)
- [CVE-2026-34676](https://insights.sbomify.com/CVE-2026-34676/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34675](https://insights.sbomify.com/CVE-2026-34675/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34674](https://insights.sbomify.com/CVE-2026-34674/): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34673](https://insights.sbomify.com/CVE-2026-34673/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (medium 6.2)
- [CVE-2026-34672](https://insights.sbomify.com/CVE-2026-34672/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 6.2)
- [CVE-2026-34671](https://insights.sbomify.com/CVE-2026-34671/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (medium 6.2)
- [CVE-2026-34670](https://insights.sbomify.com/CVE-2026-34670/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.2)
- [CVE-2026-34669](https://insights.sbomify.com/CVE-2026-34669/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.2)
- [CVE-2026-34668](https://insights.sbomify.com/CVE-2026-34668/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.2)
- [CVE-2026-34667](https://insights.sbomify.com/CVE-2026-34667/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 6.2)
- [CVE-2026-34666](https://insights.sbomify.com/CVE-2026-34666/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.2)
- [CVE-2026-34665](https://insights.sbomify.com/CVE-2026-34665/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-34664](https://insights.sbomify.com/CVE-2026-34664/): Substance3D - Designer | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 6.3)
- [CVE-2026-34663](https://insights.sbomify.com/CVE-2026-34663/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-34662](https://insights.sbomify.com/CVE-2026-34662/): Illustrator | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-34661](https://insights.sbomify.com/CVE-2026-34661/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34660](https://insights.sbomify.com/CVE-2026-34660/): Adobe Connect | Incorrect Authorization (CWE-863) (critical 9.3)
- [CVE-2026-3466](https://insights.sbomify.com/CVE-2026-3466/): Cross-site scripting in dashlet title (high 8.5)
- [CVE-2026-34659](https://insights.sbomify.com/CVE-2026-34659/): Adobe Connect | Deserialization of Untrusted Data (CWE-502) (critical 9.6)
- [CVE-2026-34658](https://insights.sbomify.com/CVE-2026-34658/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (medium 4.8)
- [CVE-2026-34657](https://insights.sbomify.com/CVE-2026-34657/): CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 5.5)
- [CVE-2026-34656](https://insights.sbomify.com/CVE-2026-34656/): Adobe Commerce | Improper Authorization (CWE-285) (medium 4.3)
- [CVE-2026-34655](https://insights.sbomify.com/CVE-2026-34655/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (medium 4.8)
- [CVE-2026-34654](https://insights.sbomify.com/CVE-2026-34654/): Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) (medium 5.3)
- [CVE-2026-34653](https://insights.sbomify.com/CVE-2026-34653/): Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 8.7)
- [CVE-2026-34652](https://insights.sbomify.com/CVE-2026-34652/): Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) (high 7.5)
- [CVE-2026-34651](https://insights.sbomify.com/CVE-2026-34651/): Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-34650](https://insights.sbomify.com/CVE-2026-34650/): Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-3465](https://insights.sbomify.com/CVE-2026-3465/): Tuya App/SDK JSON Data Point denial of service (low 2.3)
- [CVE-2026-34649](https://insights.sbomify.com/CVE-2026-34649/): Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-34648](https://insights.sbomify.com/CVE-2026-34648/): Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-34647](https://insights.sbomify.com/CVE-2026-34647/): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (high 7.4)
- [CVE-2026-34646](https://insights.sbomify.com/CVE-2026-34646/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 7.5)
- [CVE-2026-34645](https://insights.sbomify.com/CVE-2026-34645/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 7.5)
- [CVE-2026-34644](https://insights.sbomify.com/CVE-2026-34644/): After Effects | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-34643](https://insights.sbomify.com/CVE-2026-34643/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34642](https://insights.sbomify.com/CVE-2026-34642/): After Effects | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34641](https://insights.sbomify.com/CVE-2026-34641/): Premiere Pro | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34640](https://insights.sbomify.com/CVE-2026-34640/): Media Encoder | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-3464](https://insights.sbomify.com/CVE-2026-3464/): WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file (high 8.8)
- [CVE-2026-34639](https://insights.sbomify.com/CVE-2026-34639/): Media Encoder | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34638](https://insights.sbomify.com/CVE-2026-34638/): Premiere Pro | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-34637](https://insights.sbomify.com/CVE-2026-34637/): Premiere Pro | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34636](https://insights.sbomify.com/CVE-2026-34636/): Premiere Pro | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34635](https://insights.sbomify.com/CVE-2026-34635/): ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321) (high 8.4)
- [CVE-2026-34634](https://insights.sbomify.com/CVE-2026-34634/): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/697/