# Vulnerabilities published in 2026


- [CVE-2026-34633](https://insights.sbomify.com/CVE-2026-34633/): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (high 7.7)
- [CVE-2026-34632](https://insights.sbomify.com/CVE-2026-34632/): Photoshop Installer | CWE-427: Uncontrolled Search Path Element (high 8.6)
- [CVE-2026-34631](https://insights.sbomify.com/CVE-2026-34631/): InCopy | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34630](https://insights.sbomify.com/CVE-2026-34630/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-3463](https://insights.sbomify.com/CVE-2026-3463/): xlnt-community xlnt Compound Document binary.hpp append heap-based overflow (medium 4.8)
- [CVE-2026-34629](https://insights.sbomify.com/CVE-2026-34629/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34628](https://insights.sbomify.com/CVE-2026-34628/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34627](https://insights.sbomify.com/CVE-2026-34627/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-34626](https://insights.sbomify.com/CVE-2026-34626/): Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) (medium 6.3)
- [CVE-2026-34625](https://insights.sbomify.com/CVE-2026-34625/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-34624](https://insights.sbomify.com/CVE-2026-34624/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-34623](https://insights.sbomify.com/CVE-2026-34623/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-34622](https://insights.sbomify.com/CVE-2026-34622/): Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) (high 8.6)
- [CVE-2026-34621](https://insights.sbomify.com/CVE-2026-34621/): Adobe Acrobat and Reader Prototype Pollution (high 8.6, exploited in the wild)
- [CVE-2026-34620](https://insights.sbomify.com/CVE-2026-34620/): DNG SDK | Out-of-bounds Write (CWE-787) (medium 5.5)
- [CVE-2026-3462](https://insights.sbomify.com/CVE-2026-3462/): Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification (medium 6.5)
- [CVE-2026-34619](https://insights.sbomify.com/CVE-2026-34619/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 7.7)
- [CVE-2026-34618](https://insights.sbomify.com/CVE-2026-34618/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-34617](https://insights.sbomify.com/CVE-2026-34617/): Adobe Connect | Cross-site Scripting (XSS) (CWE-79) (high 8.7)
- [CVE-2026-34616](https://insights.sbomify.com/CVE-2026-34616/): DNG SDK | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-34615](https://insights.sbomify.com/CVE-2026-34615/): Adobe Connect | Deserialization of Untrusted Data (CWE-502) (critical 9.3)
- [CVE-2026-34614](https://insights.sbomify.com/CVE-2026-34614/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2026-34613](https://insights.sbomify.com/CVE-2026-34613/): AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins (medium 6.5)
- [CVE-2026-34612](https://insights.sbomify.com/CVE-2026-34612/): Kestra: Remote Code Execution via SQL Injection (critical 10.0)
- [CVE-2026-34611](https://insights.sbomify.com/CVE-2026-34611/): AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users (medium 6.5)
- [CVE-2026-34610](https://insights.sbomify.com/CVE-2026-34610/): leancrypto: Integer truncation in X.509 name parser enables certificate identity impersonation (medium 5.9)
- [CVE-2026-3461](https://insights.sbomify.com/CVE-2026-3461/): Visa Acceptance Solutions <= 2.1.0 - Unauthenticated Authentication Bypass via Billing Email (critical 9.8)
- [CVE-2026-34608](https://insights.sbomify.com/CVE-2026-34608/): nanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB Read (medium 4.9)
- [CVE-2026-34607](https://insights.sbomify.com/CVE-2026-34607/): Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE (high 7.2)
- [CVE-2026-34606](https://insights.sbomify.com/CVE-2026-34606/): Stored XSS in Frappe LMS (medium 6.9)
- [CVE-2026-34605](https://insights.sbomify.com/CVE-2026-34605/): SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated ) (high 8.6)
- [CVE-2026-34604](https://insights.sbomify.com/CVE-2026-34604/): @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions (high 7.1)
- [CVE-2026-34603](https://insights.sbomify.com/CVE-2026-34603/): @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions (high 7.1)
- [CVE-2026-34602](https://insights.sbomify.com/CVE-2026-34602/): Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses (high 7.1)
- [CVE-2026-34601](https://insights.sbomify.com/CVE-2026-34601/): xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion (high 7.5)
- [CVE-2026-34600](https://insights.sbomify.com/CVE-2026-34600/): Joplin Server delta API returns note content after share access is revoked (medium 5.7)
- [CVE-2026-3460](https://insights.sbomify.com/CVE-2026-3460/): Missing authorization in REST API TO MiniProgram (medium 5.3)
- [CVE-2026-34599](https://insights.sbomify.com/CVE-2026-34599/): Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component (high 8.8)
- [CVE-2026-34598](https://insights.sbomify.com/CVE-2026-34598/): YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" (high 7.1)
- [CVE-2026-34597](https://insights.sbomify.com/CVE-2026-34597/): Coolify: Authenticated Host RCE (high 8.8)
- [CVE-2026-34596](https://insights.sbomify.com/CVE-2026-34596/): Sandboxie-Plus local privilege escalation via TOCTOU race condition in UpdUtil addon installation (medium 5.4)
- [CVE-2026-34595](https://insights.sbomify.com/CVE-2026-34595/): Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value (medium 5.3)
- [CVE-2026-34594](https://insights.sbomify.com/CVE-2026-34594/): Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management (high 8.8)
- [CVE-2026-34593](https://insights.sbomify.com/CVE-2026-34593/): Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash (high 8.2)
- [CVE-2026-34592](https://insights.sbomify.com/CVE-2026-34592/): Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure (high 7.7)
- [CVE-2026-34591](https://insights.sbomify.com/CVE-2026-34591/): Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write (high 7.1)
- [CVE-2026-34590](https://insights.sbomify.com/CVE-2026-34590/): Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation (medium 5.4)
- [CVE-2026-3459](https://insights.sbomify.com/CVE-2026-3459/): Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload (high 8.1)
- [CVE-2026-34589](https://insights.sbomify.com/CVE-2026-34589/): OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write (high 8.4)
- [CVE-2026-34588](https://insights.sbomify.com/CVE-2026-34588/): OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write (high 8.6)
- [CVE-2026-34587](https://insights.sbomify.com/CVE-2026-34587/): Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering (high 7.6)
- [CVE-2026-34586](https://insights.sbomify.com/CVE-2026-34586/): PdfDing: Shared PDF Expiration, Max Views, and Deletion Bypass via Serve/Download Endpoints (medium 6.5)
- [CVE-2026-34585](https://insights.sbomify.com/CVE-2026-34585/): SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution (high 8.6)
- [CVE-2026-34584](https://insights.sbomify.com/CVE-2026-34584/): listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) (medium 5.4)
- [CVE-2026-34582](https://insights.sbomify.com/CVE-2026-34582/): Botan has a TLS 1.3 certificate authentication bypass (high 8.7)
- [CVE-2026-34581](https://insights.sbomify.com/CVE-2026-34581/): goshs has Auth Bypass via Share Token (high 8.1)
- [CVE-2026-34580](https://insights.sbomify.com/CVE-2026-34580/): Botan has a certificate authentication bypass due to trust anchor confusion (critical 9.3)
- [CVE-2026-34579](https://insights.sbomify.com/CVE-2026-34579/): MantisBT has an authorization bypass via private issue monitoring (medium 5.3)
- [CVE-2026-34578](https://insights.sbomify.com/CVE-2026-34578/): OPNsense has an LDAP Injection via Unsanitized Username in Authentication (high 8.2)
- [CVE-2026-34577](https://insights.sbomify.com/CVE-2026-34577/): Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check (high 8.6)
- [CVE-2026-34576](https://insights.sbomify.com/CVE-2026-34576/): Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata (high 8.3)
- [CVE-2026-34574](https://insights.sbomify.com/CVE-2026-34574/): Parse Server: Session field immutability bypass via falsy-value guard (medium 5.3)
- [CVE-2026-34573](https://insights.sbomify.com/CVE-2026-34573/): Parse Server: GraphQL complexity validator exponential fragment traversal DoS (high 8.2)
- [CVE-2026-34572](https://insights.sbomify.com/CVE-2026-34572/): CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) (high 8.8)
- [CVE-2026-34571](https://insights.sbomify.com/CVE-2026-34571/): CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise (critical 10.0)
- [CVE-2026-34570](https://insights.sbomify.com/CVE-2026-34570/): CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) (high 8.8)
- [CVE-2026-3457](https://insights.sbomify.com/CVE-2026-3457/): Stored XSS vulnerability in Sentinel ACC (high 7.0)
- [CVE-2026-34569](https://insights.sbomify.com/CVE-2026-34569/): CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 10.0)
- [CVE-2026-34568](https://insights.sbomify.com/CVE-2026-34568/): CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-34567](https://insights.sbomify.com/CVE-2026-34567/): CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-34566](https://insights.sbomify.com/CVE-2026-34566/): CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-34565](https://insights.sbomify.com/CVE-2026-34565/): CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-34564](https://insights.sbomify.com/CVE-2026-34564/): CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-34563](https://insights.sbomify.com/CVE-2026-34563/): CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS (critical 9.1)
- [CVE-2026-34562](https://insights.sbomify.com/CVE-2026-34562/): CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (medium 4.7)
- [CVE-2026-34561](https://insights.sbomify.com/CVE-2026-34561/): CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (medium 4.7)
- [CVE-2026-34560](https://insights.sbomify.com/CVE-2026-34560/): CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-3456](https://insights.sbomify.com/CVE-2026-3456/): SQL injection in GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content (high 7.5)
- [CVE-2026-34559](https://insights.sbomify.com/CVE-2026-34559/): CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-34558](https://insights.sbomify.com/CVE-2026-34558/): CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-34557](https://insights.sbomify.com/CVE-2026-34557/): CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.1)
- [CVE-2026-34556](https://insights.sbomify.com/CVE-2026-34556/): iccDEV: HBO in icAnsiToUtf8() (medium 6.2)
- [CVE-2026-34555](https://insights.sbomify.com/CVE-2026-34555/): iccDEV: SBO in CIccTagFixedNum::GetValues() (medium 6.2)
- [CVE-2026-34554](https://insights.sbomify.com/CVE-2026-34554/): iccDEV: HBO in CIccApplyCmmSearch::costFunc() (medium 6.2)
- [CVE-2026-34553](https://insights.sbomify.com/CVE-2026-34553/): iccDEV: DoS in CIccCLUT::Iterate() & CIccMBB::Describe() (medium 4.0)
- [CVE-2026-34552](https://insights.sbomify.com/CVE-2026-34552/): iccDEV: UB at IccTagLut.cpp (medium 6.2)
- [CVE-2026-34551](https://insights.sbomify.com/CVE-2026-34551/): iccDEV: NPD in CIccTagLut16::Write() (medium 6.2)
- [CVE-2026-34550](https://insights.sbomify.com/CVE-2026-34550/): iccDEV: UB at IccIO.cpp (medium 6.2)
- [CVE-2026-3455](https://insights.sbomify.com/CVE-2026-3455/): mailparser vulnerable to Cross-site Scripting (medium 5.1)
- [CVE-2026-34549](https://insights.sbomify.com/CVE-2026-34549/): iccDEV: UB at IccUtil.cpp (medium 6.2)
- [CVE-2026-34548](https://insights.sbomify.com/CVE-2026-34548/): iccDEV: UB at IccUtilXml.cpp (medium 6.2)
- [CVE-2026-34547](https://insights.sbomify.com/CVE-2026-34547/): iccDEV: UB at IccUtil.cpp (medium 6.2)
- [CVE-2026-34546](https://insights.sbomify.com/CVE-2026-34546/): iccDEV: UB at TiffImg.h (medium 6.2)
- [CVE-2026-34545](https://insights.sbomify.com/CVE-2026-34545/): OpenEXR: integer overflow lead to OOB in HTJ2K decoder (high 8.4)
- [CVE-2026-34544](https://insights.sbomify.com/CVE-2026-34544/): OpenEXR: integer overflow to OOB write in uncompress_b44_impl() (high 8.4)
- [CVE-2026-34543](https://insights.sbomify.com/CVE-2026-34543/): OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl) (high 8.7)
- [CVE-2026-34542](https://insights.sbomify.com/CVE-2026-34542/): iccDEV: SBO in CIccCalculatorFunc::Apply() (medium 6.2)
- [CVE-2026-34541](https://insights.sbomify.com/CVE-2026-34541/): iccDEV: UB in CIccCombinedConnectionConditions::CIccCombinedConnectionConditions() (medium 6.2)
- [CVE-2026-34540](https://insights.sbomify.com/CVE-2026-34540/): iccDEV: HBO in icMemDump() (medium 6.2)
- [CVE-2026-3454](https://insights.sbomify.com/CVE-2026-3454/): Missing authorization in GenerateBlocks (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/698/