# Vulnerabilities published in 2026 - [CVE-2026-21293](https://insights.sbomify.com/CVE-2026-21293/): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (medium 5.5) - [CVE-2026-21292](https://insights.sbomify.com/CVE-2026-21292/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4) - [CVE-2026-21291](https://insights.sbomify.com/CVE-2026-21291/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (medium 4.8) - [CVE-2026-21290](https://insights.sbomify.com/CVE-2026-21290/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.7) - [CVE-2026-2129](https://insights.sbomify.com/CVE-2026-2129/): D-Link DIR-823X set_ac_status os command injection (high 8.6) - [CVE-2026-21289](https://insights.sbomify.com/CVE-2026-21289/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 7.5) - [CVE-2026-21288](https://insights.sbomify.com/CVE-2026-21288/): Illustrator | NULL Pointer Dereference (CWE-476) (medium 5.5) - [CVE-2026-21287](https://insights.sbomify.com/CVE-2026-21287/): Substance3D - Stager | Use After Free (CWE-416) (high 7.8) - [CVE-2026-21286](https://insights.sbomify.com/CVE-2026-21286/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 5.3) - [CVE-2026-21285](https://insights.sbomify.com/CVE-2026-21285/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 4.3) - [CVE-2026-21284](https://insights.sbomify.com/CVE-2026-21284/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.1) - [CVE-2026-21283](https://insights.sbomify.com/CVE-2026-21283/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8) - [CVE-2026-21282](https://insights.sbomify.com/CVE-2026-21282/): Adobe Commerce | Improper Input Validation (CWE-20) (medium 5.3) - [CVE-2026-21281](https://insights.sbomify.com/CVE-2026-21281/): InCopy | Heap-based Buffer Overflow (CWE-122) (high 7.8) - [CVE-2026-21280](https://insights.sbomify.com/CVE-2026-21280/): Illustrator | Untrusted Search Path (CWE-426) (high 8.6) - [CVE-2026-2128](https://insights.sbomify.com/CVE-2026-2128/): Information disclosure in Breeze Cache (medium 5.3) - [CVE-2026-21279](https://insights.sbomify.com/CVE-2026-21279/): ColdFusion | Improper Input Validation (CWE-20) (high 8.2) - [CVE-2026-21278](https://insights.sbomify.com/CVE-2026-21278/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5) - [CVE-2026-21277](https://insights.sbomify.com/CVE-2026-21277/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8) - [CVE-2026-21276](https://insights.sbomify.com/CVE-2026-21276/): InDesign Desktop | Access of Uninitialized Pointer (CWE-824) (high 7.8) - [CVE-2026-21275](https://insights.sbomify.com/CVE-2026-21275/): InDesign Desktop | Access of Uninitialized Pointer (CWE-824) (high 7.8) - [CVE-2026-21274](https://insights.sbomify.com/CVE-2026-21274/): Dreamweaver Desktop | Incorrect Authorization (CWE-863) (high 7.8) - [CVE-2026-21273](https://insights.sbomify.com/CVE-2026-21273/): ColdFusion | Improper Input Validation (CWE-20) (high 8.7) - [CVE-2026-21272](https://insights.sbomify.com/CVE-2026-21272/): Dreamweaver Desktop | Improper Input Validation (CWE-20) (high 8.6) - [CVE-2026-21271](https://insights.sbomify.com/CVE-2026-21271/): Dreamweaver Desktop | Improper Input Validation (CWE-20) (high 8.6) - [CVE-2026-2127](https://insights.sbomify.com/CVE-2026-2127/): Missing authorization in SiteOrigin Widgets Bundle (medium 5.4) - [CVE-2026-21269](https://insights.sbomify.com/CVE-2026-21269/): ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) (medium 4.6) - [CVE-2026-21268](https://insights.sbomify.com/CVE-2026-21268/): Dreamweaver Desktop | Improper Input Validation (CWE-20) (high 8.6) - [CVE-2026-21267](https://insights.sbomify.com/CVE-2026-21267/): Command injection in Adobe Dreamweaver Desktop (high 8.6) - [CVE-2026-21265](https://insights.sbomify.com/CVE-2026-21265/): Secure Boot Certificate Expiration Security Feature Bypass Vulnerability (medium 6.4) - [CVE-2026-21264](https://insights.sbomify.com/CVE-2026-21264/): Microsoft Account Spoofing Vulnerability (critical 9.3) - [CVE-2026-21262](https://insights.sbomify.com/CVE-2026-21262/): SQL Server Elevation of Privilege Vulnerability (high 8.8) - [CVE-2026-21261](https://insights.sbomify.com/CVE-2026-21261/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-21260](https://insights.sbomify.com/CVE-2026-21260/): Microsoft Outlook Spoofing Vulnerability (high 7.5) - [CVE-2026-2126](https://insights.sbomify.com/CVE-2026-2126/): Missing authorization in User Submitted Posts – Enable Users to Submit Posts from the Front End (medium 5.3) - [CVE-2026-21259](https://insights.sbomify.com/CVE-2026-21259/): Microsoft Excel Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21258](https://insights.sbomify.com/CVE-2026-21258/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-21257](https://insights.sbomify.com/CVE-2026-21257/): GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability (high 8.0) - [CVE-2026-21256](https://insights.sbomify.com/CVE-2026-21256/): GitHub Copilot and Visual Studio Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-21255](https://insights.sbomify.com/CVE-2026-21255/): Windows Hyper-V Security Feature Bypass Vulnerability (high 8.8) - [CVE-2026-21253](https://insights.sbomify.com/CVE-2026-21253/): Mailslot File System Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-21251](https://insights.sbomify.com/CVE-2026-21251/): Cluster Client Failover (CCF) Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21250](https://insights.sbomify.com/CVE-2026-21250/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21249](https://insights.sbomify.com/CVE-2026-21249/): Windows NTLM Spoofing Vulnerability (low 3.3) - [CVE-2026-21248](https://insights.sbomify.com/CVE-2026-21248/): Windows Hyper-V Remote Code Execution Vulnerability (high 7.3) - [CVE-2026-21247](https://insights.sbomify.com/CVE-2026-21247/): Windows Hyper-V Remote Code Execution Vulnerability (high 7.3) - [CVE-2026-21246](https://insights.sbomify.com/CVE-2026-21246/): Windows Graphics Component Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21245](https://insights.sbomify.com/CVE-2026-21245/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21244](https://insights.sbomify.com/CVE-2026-21244/): Windows Hyper-V Remote Code Execution Vulnerability (high 7.3) - [CVE-2026-21243](https://insights.sbomify.com/CVE-2026-21243/): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (high 7.5) - [CVE-2026-21242](https://insights.sbomify.com/CVE-2026-21242/): Windows Subsystem for Linux Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-21241](https://insights.sbomify.com/CVE-2026-21241/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-21240](https://insights.sbomify.com/CVE-2026-21240/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21239](https://insights.sbomify.com/CVE-2026-21239/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21238](https://insights.sbomify.com/CVE-2026-21238/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21237](https://insights.sbomify.com/CVE-2026-21237/): Windows Subsystem for Linux Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-21236](https://insights.sbomify.com/CVE-2026-21236/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21235](https://insights.sbomify.com/CVE-2026-21235/): Windows Graphics Component Elevation of Privilege Vulnerability (high 7.3) - [CVE-2026-21234](https://insights.sbomify.com/CVE-2026-21234/): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-21232](https://insights.sbomify.com/CVE-2026-21232/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21231](https://insights.sbomify.com/CVE-2026-21231/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-2123](https://insights.sbomify.com/CVE-2026-2123/): Privilege escalation vulnerability in Operations Agent (high 8.6) - [CVE-2026-21229](https://insights.sbomify.com/CVE-2026-21229/): Power BI Remote Code Execution Vulnerability (high 8.0) - [CVE-2026-21228](https://insights.sbomify.com/CVE-2026-21228/): Azure Local Remote Code Execution Vulnerability (high 8.1) - [CVE-2026-21227](https://insights.sbomify.com/CVE-2026-21227/): Azure Logic Apps Elevation of Privilege Vulnerability (high 8.2) - [CVE-2026-21226](https://insights.sbomify.com/CVE-2026-21226/): Azure Core shared client library for Python Remote Code Execution Vulnerability (high 7.5) - [CVE-2026-21224](https://insights.sbomify.com/CVE-2026-21224/): Azure Connected Machine Agent Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-21223](https://insights.sbomify.com/CVE-2026-21223/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (high 7.1) - [CVE-2026-21222](https://insights.sbomify.com/CVE-2026-21222/): Windows Kernel Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-21221](https://insights.sbomify.com/CVE-2026-21221/): Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-2122](https://insights.sbomify.com/CVE-2026-2122/): Xiaopi Panel WAF Firewall demo.php sql injection (medium 5.3) - [CVE-2026-21219](https://insights.sbomify.com/CVE-2026-21219/): Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability (high 7.0) - [CVE-2026-21218](https://insights.sbomify.com/CVE-2026-21218/): .NET Spoofing Vulnerability (high 7.5) - [CVE-2026-2121](https://insights.sbomify.com/CVE-2026-2121/): Cross-site scripting in Weaver Show Posts (medium 4.4) - [CVE-2026-2120](https://insights.sbomify.com/CVE-2026-2120/): D-Link DIR-823X Configuration Parameter set_server_settings os command injection (high 8.6) - [CVE-2026-2118](https://insights.sbomify.com/CVE-2026-2118/): UTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injection (high 8.6) - [CVE-2026-2117](https://insights.sbomify.com/CVE-2026-2117/): itsourcecode Society Management System edit_activity.php sql injection (medium 6.9) - [CVE-2026-2116](https://insights.sbomify.com/CVE-2026-2116/): itsourcecode Society Management System edit_expenses.php sql injection (medium 6.9) - [CVE-2026-21157](https://insights.sbomify.com/CVE-2026-21157/): Other in Bixby (high 8.3) - [CVE-2026-2115](https://insights.sbomify.com/CVE-2026-2115/): itsourcecode Society Management System delete_expenses.php sql injection (medium 6.9) - [CVE-2026-21140](https://insights.sbomify.com/CVE-2026-21140/): Missing authorization in Samsung Mobile Devices (medium 6.9) - [CVE-2026-2114](https://insights.sbomify.com/CVE-2026-2114/): itsourcecode Society Management System edit_admin.php sql injection (medium 6.9) - [CVE-2026-21139](https://insights.sbomify.com/CVE-2026-21139/): Missing authorization in Samsung Continuity Service for windows (high 7.3) - [CVE-2026-21138](https://insights.sbomify.com/CVE-2026-21138/): Security feature bypass in Smart Switch (medium 6.9) - [CVE-2026-21137](https://insights.sbomify.com/CVE-2026-21137/): Path traversal in Smart Switch (medium 5.1) - [CVE-2026-21136](https://insights.sbomify.com/CVE-2026-21136/): Missing authorization in Smart Switch (medium 6.8) - [CVE-2026-21135](https://insights.sbomify.com/CVE-2026-21135/): Missing authorization in Samsung Internet (medium 5.9) - [CVE-2026-21134](https://insights.sbomify.com/CVE-2026-21134/): Auth bypass in Samsung Flow (medium 6.1) - [CVE-2026-21133](https://insights.sbomify.com/CVE-2026-21133/): Path traversal in Samsung Flow (medium 5.1) - [CVE-2026-21132](https://insights.sbomify.com/CVE-2026-21132/): Cross-site scripting in Samsung Internet (medium 6.0) - [CVE-2026-21131](https://insights.sbomify.com/CVE-2026-21131/): Misconfiguration in Samsung Flow (low 2.1) - [CVE-2026-21130](https://insights.sbomify.com/CVE-2026-21130/): Other in Samsung Checkout (medium 5.1) - [CVE-2026-2113](https://insights.sbomify.com/CVE-2026-2113/): yuan1994 tpadmin WebUploader preview.php deserialization (medium 6.9) - [CVE-2026-21129](https://insights.sbomify.com/CVE-2026-21129/): Other in Samsung Checkout (medium 5.1) - [CVE-2026-21128](https://insights.sbomify.com/CVE-2026-21128/): Other in Samsung Checkout (medium 5.1) - [CVE-2026-21127](https://insights.sbomify.com/CVE-2026-21127/): Missing authorization in Samsung Account (medium 6.9) - [CVE-2026-21126](https://insights.sbomify.com/CVE-2026-21126/): Memory corruption in Samsung Mobile Devices (medium 6.9) - [CVE-2026-21125](https://insights.sbomify.com/CVE-2026-21125/): Memory corruption in Samsung Mobile Devices (high 8.6) - [CVE-2026-21124](https://insights.sbomify.com/CVE-2026-21124/): Memory corruption in Samsung Mobile Devices (high 8.6) - [CVE-2026-21123](https://insights.sbomify.com/CVE-2026-21123/): Privilege escalation in Samsung Mobile Devices (medium 6.7) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/808/