# Vulnerabilities published in 2026


- [CVE-2026-21386](https://insights.sbomify.com/CVE-2026-21386/): Private channel enumeration via /mute slash command (medium 4.3)
- [CVE-2026-21385](https://insights.sbomify.com/CVE-2026-21385/): Qualcomm Multiple Chipsets Memory Corruption (high 7.8, exploited in the wild)
- [CVE-2026-21384](https://insights.sbomify.com/CVE-2026-21384/): Out-of-bounds Write in Camera Driver (medium 5.3)
- [CVE-2026-21383](https://insights.sbomify.com/CVE-2026-21383/): Reusing a Nonce, Key Pair in Encryption in HLOS (high 7.1)
- [CVE-2026-21382](https://insights.sbomify.com/CVE-2026-21382/): Buffer Copy Without Checking Size of Input in Power Management IC (high 7.8)
- [CVE-2026-21381](https://insights.sbomify.com/CVE-2026-21381/): Buffer Over-read in WLAN Firmware (high 7.6)
- [CVE-2026-21380](https://insights.sbomify.com/CVE-2026-21380/): Use After Free in DSP Service (high 7.8)
- [CVE-2026-2138](https://insights.sbomify.com/CVE-2026-2138/): Tenda TX9 SetStaticRouteCfg sub_42D03C buffer overflow (high 8.7)
- [CVE-2026-21379](https://insights.sbomify.com/CVE-2026-21379/): Buffer Over-read in Windows Compute (high 7.8)
- [CVE-2026-21378](https://insights.sbomify.com/CVE-2026-21378/): Buffer Over-read in Camera (high 7.8)
- [CVE-2026-21376](https://insights.sbomify.com/CVE-2026-21376/): Buffer Over-read in Camera (high 7.8)
- [CVE-2026-21375](https://insights.sbomify.com/CVE-2026-21375/): Buffer Over-read in Camera (high 7.8)
- [CVE-2026-21374](https://insights.sbomify.com/CVE-2026-21374/): Buffer Over-read in Camera (high 7.8)
- [CVE-2026-21373](https://insights.sbomify.com/CVE-2026-21373/): Buffer Over-read in Camera (high 7.8)
- [CVE-2026-21372](https://insights.sbomify.com/CVE-2026-21372/): Heap-Based Buffer Overflow in Power Management IC (high 7.8)
- [CVE-2026-21371](https://insights.sbomify.com/CVE-2026-21371/): Buffer Over-read in WinBlast Driver (high 7.8)
- [CVE-2026-21370](https://insights.sbomify.com/CVE-2026-21370/): Out-of-bounds Write in Camera Driver (medium 5.3)
- [CVE-2026-2137](https://insights.sbomify.com/CVE-2026-2137/): Tenda TX3 SetIpMacBind buffer overflow (high 8.7)
- [CVE-2026-21369](https://insights.sbomify.com/CVE-2026-21369/): Out-of-bounds Write in Camera Driver (medium 5.3)
- [CVE-2026-21368](https://insights.sbomify.com/CVE-2026-21368/): Out-of-bounds Write in Camera Driver (medium 5.3)
- [CVE-2026-21367](https://insights.sbomify.com/CVE-2026-21367/): Buffer Over-read in WLAN Firmware (high 7.6)
- [CVE-2026-21366](https://insights.sbomify.com/CVE-2026-21366/): Integer Overflow or Wraparound in Data Network Stack & Connectivity (high 7.8)
- [CVE-2026-21365](https://insights.sbomify.com/CVE-2026-21365/): Substance3D - Painter | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21364](https://insights.sbomify.com/CVE-2026-21364/): Substance3D - Painter | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-21363](https://insights.sbomify.com/CVE-2026-21363/): Substance3D - Painter | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-21362](https://insights.sbomify.com/CVE-2026-21362/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21361](https://insights.sbomify.com/CVE-2026-21361/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.1)
- [CVE-2026-21360](https://insights.sbomify.com/CVE-2026-21360/): Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 6.8)
- [CVE-2026-2136](https://insights.sbomify.com/CVE-2026-2136/): projectworlds Online Food Ordering System view-ticket.php sql injection (medium 6.9)
- [CVE-2026-21359](https://insights.sbomify.com/CVE-2026-21359/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 4.7)
- [CVE-2026-21358](https://insights.sbomify.com/CVE-2026-21358/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (medium 5.5)
- [CVE-2026-21357](https://insights.sbomify.com/CVE-2026-21357/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-21355](https://insights.sbomify.com/CVE-2026-21355/): DNG SDK | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21354](https://insights.sbomify.com/CVE-2026-21354/): DNG SDK | Integer Overflow or Wraparound (CWE-190) (medium 5.5)
- [CVE-2026-21353](https://insights.sbomify.com/CVE-2026-21353/): DNG SDK | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-21352](https://insights.sbomify.com/CVE-2026-21352/): DNG SDK | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21351](https://insights.sbomify.com/CVE-2026-21351/): After Effects | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-21350](https://insights.sbomify.com/CVE-2026-21350/): After Effects | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-2135](https://insights.sbomify.com/CVE-2026-2135/): UTT HiPER 810 formPdbUpConfig sub_43F020 command injection (medium 5.3)
- [CVE-2026-21349](https://insights.sbomify.com/CVE-2026-21349/): Lightroom Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21348](https://insights.sbomify.com/CVE-2026-21348/): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21347](https://insights.sbomify.com/CVE-2026-21347/): Bridge | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-21346](https://insights.sbomify.com/CVE-2026-21346/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21345](https://insights.sbomify.com/CVE-2026-21345/): Substance3D - Stager | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-21344](https://insights.sbomify.com/CVE-2026-21344/): Substance3D - Stager | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-21343](https://insights.sbomify.com/CVE-2026-21343/): Substance3D - Stager | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-21342](https://insights.sbomify.com/CVE-2026-21342/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21341](https://insights.sbomify.com/CVE-2026-21341/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21340](https://insights.sbomify.com/CVE-2026-21340/): Substance3D - Designer | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-2134](https://insights.sbomify.com/CVE-2026-2134/): PHPGurukul Hospital Management System manage-doctors.php sql injection (medium 5.1)
- [CVE-2026-21339](https://insights.sbomify.com/CVE-2026-21339/): Substance3D - Designer | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21338](https://insights.sbomify.com/CVE-2026-21338/): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-21337](https://insights.sbomify.com/CVE-2026-21337/): Substance3D - Designer | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21336](https://insights.sbomify.com/CVE-2026-21336/): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-21335](https://insights.sbomify.com/CVE-2026-21335/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21334](https://insights.sbomify.com/CVE-2026-21334/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21333](https://insights.sbomify.com/CVE-2026-21333/): Illustrator | Untrusted Search Path (CWE-426) (high 8.6)
- [CVE-2026-21332](https://insights.sbomify.com/CVE-2026-21332/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21331](https://insights.sbomify.com/CVE-2026-21331/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2026-21330](https://insights.sbomify.com/CVE-2026-21330/): After Effects | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843) (high 7.8)
- [CVE-2026-2133](https://insights.sbomify.com/CVE-2026-2133/): code-projects Online Music Site AdminUpdateCategory.php unrestricted upload (medium 6.9)
- [CVE-2026-21329](https://insights.sbomify.com/CVE-2026-21329/): After Effects | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-21328](https://insights.sbomify.com/CVE-2026-21328/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21327](https://insights.sbomify.com/CVE-2026-21327/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21326](https://insights.sbomify.com/CVE-2026-21326/): After Effects | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-21325](https://insights.sbomify.com/CVE-2026-21325/): After Effects | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-21324](https://insights.sbomify.com/CVE-2026-21324/): After Effects | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-21323](https://insights.sbomify.com/CVE-2026-21323/): After Effects | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-21322](https://insights.sbomify.com/CVE-2026-21322/): After Effects | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-21321](https://insights.sbomify.com/CVE-2026-21321/): After Effects | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-21320](https://insights.sbomify.com/CVE-2026-21320/): After Effects | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-2132](https://insights.sbomify.com/CVE-2026-2132/): code-projects Online Music Site AdminUpdateCategory.php sql injection (medium 6.9)
- [CVE-2026-21319](https://insights.sbomify.com/CVE-2026-21319/): After Effects | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21318](https://insights.sbomify.com/CVE-2026-21318/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21317](https://insights.sbomify.com/CVE-2026-21317/): Audition | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21316](https://insights.sbomify.com/CVE-2026-21316/): Audition | Access of Memory Location After End of Buffer (CWE-788) (medium 5.5)
- [CVE-2026-21315](https://insights.sbomify.com/CVE-2026-21315/): Audition | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21314](https://insights.sbomify.com/CVE-2026-21314/): Audition | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21313](https://insights.sbomify.com/CVE-2026-21313/): Audition | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21312](https://insights.sbomify.com/CVE-2026-21312/): Audition | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21311](https://insights.sbomify.com/CVE-2026-21311/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.0)
- [CVE-2026-21310](https://insights.sbomify.com/CVE-2026-21310/): Adobe Commerce | Improper Input Validation (CWE-20) (medium 5.3)
- [CVE-2026-2131](https://insights.sbomify.com/CVE-2026-2131/): XixianLiang HarmonyOS-mcp-server input_text os command injection (medium 5.3)
- [CVE-2026-21309](https://insights.sbomify.com/CVE-2026-21309/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 7.5)
- [CVE-2026-21308](https://insights.sbomify.com/CVE-2026-21308/): Substance3D - Designer | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21307](https://insights.sbomify.com/CVE-2026-21307/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21306](https://insights.sbomify.com/CVE-2026-21306/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21305](https://insights.sbomify.com/CVE-2026-21305/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21304](https://insights.sbomify.com/CVE-2026-21304/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-21303](https://insights.sbomify.com/CVE-2026-21303/): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21302](https://insights.sbomify.com/CVE-2026-21302/): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-21301](https://insights.sbomify.com/CVE-2026-21301/): Substance3D - Modeler | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-21300](https://insights.sbomify.com/CVE-2026-21300/): Substance3D - Modeler | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-2130](https://insights.sbomify.com/CVE-2026-2130/): BurtTheCoder mcp-maigret search_username index.ts command injection (medium 5.3)
- [CVE-2026-21299](https://insights.sbomify.com/CVE-2026-21299/): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21298](https://insights.sbomify.com/CVE-2026-21298/): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-21297](https://insights.sbomify.com/CVE-2026-21297/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 4.3)
- [CVE-2026-21296](https://insights.sbomify.com/CVE-2026-21296/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 4.3)
- [CVE-2026-21295](https://insights.sbomify.com/CVE-2026-21295/): Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (low 3.1)
- [CVE-2026-21294](https://insights.sbomify.com/CVE-2026-21294/): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/807/