Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 757 of 1013.
- CVE-2026-27273 Substance3D - Stager | Out-of-bounds Write (CWE-787)
- CVE-2026-27272 Illustrator | Out-of-bounds Write (CWE-787)
- CVE-2026-27271 Illustrator | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27270 Illustrator | Out-of-bounds Read (CWE-125)
- CVE-2026-27269 Premiere Pro | Out-of-bounds Read (CWE-125)
- CVE-2026-27268 Illustrator | Out-of-bounds Read (CWE-125)
- CVE-2026-27267 Illustrator | Stack-based Buffer Overflow (CWE-121)
- CVE-2026-27266 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27265 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27262 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-2726 Incorrect Authorization in GitLab
- CVE-2026-27258 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27257 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27256 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27255 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27254 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27253 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27252 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27251 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27250 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-2725 Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"
- CVE-2026-27249 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27248 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27247 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-27246 Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-27245 Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2026-27244 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27243 Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2026-27242 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27241 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27240 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-2724 Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields
- CVE-2026-27239 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27238 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2026-27237 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27236 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27235 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27234 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27233 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27232 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27231 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27230 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-2723 Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
- CVE-2026-27229 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27228 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27227 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27226 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27225 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27224 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27223 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27222 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-27221 Acrobat Reader | Improper Certificate Validation (CWE-295)
- CVE-2026-27220 Acrobat Reader | Use After Free (CWE-416)
- CVE-2026-2722 Stock Ticker <= 3.26.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Template
- CVE-2026-27219 Substance3D - Painter | Out-of-bounds Read (CWE-125)
- CVE-2026-27218 Substance3D - Painter | NULL Pointer Dereference (CWE-476)
- CVE-2026-27217 Substance3D - Painter | NULL Pointer Dereference (CWE-476)
- CVE-2026-27216 Substance3D - Painter | Out-of-bounds Read (CWE-125)
- CVE-2026-27215 Substance3D - Painter | NULL Pointer Dereference (CWE-476)
- CVE-2026-27214 Substance3D - Painter | NULL Pointer Dereference (CWE-476)
- CVE-2026-27212 Swiper has a Prototype Pollution Vulnerability
- CVE-2026-27211 Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse
- CVE-2026-27210 Pannellum has a XSS vulnerability in hot spot attributes
- CVE-2026-2721 MailArchiver <= 4.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
- CVE-2026-27208 api-gateway-deploy Affected by Exploitable Command Injection via Unprivileged Root Execution
- CVE-2026-27206 Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
- CVE-2026-27205 Flask session does not add `Vary: Cookie` header when accessed in some ways
- CVE-2026-27204 Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
- CVE-2026-27203 eBay API MCP Server Affected by Environment Variable Injection
- CVE-2026-27202 GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability
- CVE-2026-2720 Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure
- CVE-2026-27199 Werkzeug safe_join() allows Windows special device names
- CVE-2026-27198 Formwork Improperly Manages Privileges During User Creation
- CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking
- CVE-2026-27196 Statamic affected by privilege escalation via stored Cross-site Scripting
- CVE-2026-27195 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future
- CVE-2026-27194 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint
- CVE-2026-27193 Feathers exposes internal headers via unencrypted session cookie
- CVE-2026-27192 Feathers has an origin validation bypass via prefix matching
- CVE-2026-27191 Feathers: Open Redirect in OAuth callback enables account takeover
- CVE-2026-27190 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
- CVE-2026-2719 Private WP suite <= 0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting
- CVE-2026-27189 OpenSift: Race-prone local persistence could cause state corruption/loss
- CVE-2026-27183 OpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch
- CVE-2026-27182 Saturn Remote Mouse Server UDP Command Injection RCE
- CVE-2026-27181 MajorDoMo Unauthenticated Module Uninstall via Market Endpoint
- CVE-2026-27180 MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning
- CVE-2026-2718 Dealia <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes
- CVE-2026-27179 MajorDoMo Unauthenticated SQL Injection in Commands Module
- CVE-2026-27178 MajorDoMo Stored Cross-Site Scripting via Method Parameters to Shoutbox
- CVE-2026-27177 MajorDoMo Stored Cross-Site Scripting via Property Set Endpoint
- CVE-2026-27176 MajorDoMo Reflected Cross-Site Scripting in command.php
- CVE-2026-27175 MajorDoMo Command Injection in rc/index.php via Race Condition
- CVE-2026-27174 MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
- CVE-2026-27173 Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments
- CVE-2026-27172 Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data
- CVE-2026-27171 Denial of service in zlib
- CVE-2026-27170 OpenSift: SSRF risk in URL ingestion endpoint
- CVE-2026-2717 HTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values
- CVE-2026-27169 OpenSift: Persistent XSS Chat Tool Rendering