Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 207 of 1013.
- CVE-2026-9858 Missing authorization in Partial Shipment for WooCommerce
- CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
- CVE-2026-98578 nfc: st21nfca: validate ISO15693 inventory length
- CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
- CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names
- CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
- CVE-2026-98574 net: bcmgenet: stop Tx NAPI before disabling the queues
- CVE-2026-98573 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
- CVE-2026-98572 bpf: Fix immediate JMP JEQ/JNE on MIPS32
- CVE-2026-98571 net: stmmac: clear stale buf->page after recycling on skb build failure
- CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead()
- CVE-2026-9857 Missing authorization in Invoice123
- CVE-2026-98569 ip_gre: Reject enabling collect metadata through changelink
- CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies
- CVE-2026-98567 net: xps: reject an out of range traffic class
- CVE-2026-98566 drm/imagination: clamp freelist reconstruction requests
- CVE-2026-98565 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
- CVE-2026-98564 net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
- CVE-2026-98563 net: phylink: record the PHY only once bringup cannot fail
- CVE-2026-98562 net: libwx: fix races in Tx timestamp handling
- CVE-2026-98561 nfp: hold IPsec RX state under the XArray lock
- CVE-2026-98560 net/rds: size a connection's path set by the transport it ends up with
- CVE-2026-9856 Path Traversal in huggingface/transformers
- CVE-2026-98559 net/smc: fix UAF on lgr list traversal in smcr_port_err()
- CVE-2026-98558 net: flush skb_defer_nodes in dev_cpu_dead()
- CVE-2026-98557 gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
- CVE-2026-98556 gve: DQO: reject TSO packets with an out of range MSS
- CVE-2026-98555 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
- CVE-2026-98554 vlan: ensure sufficient headroom in vlan_dev_hard_header()
- CVE-2026-98553 autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
- CVE-2026-98552 perf/core: Fix a refcount leak in attach_perf_ctx_data()
- CVE-2026-98551 perf/core: Fill branch entries with a single assignment
- CVE-2026-98550 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
- CVE-2026-9855 Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
- CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue
- CVE-2026-98548 sctp: discard the rest of the packet on a stale-cookie error
- CVE-2026-98547 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
- CVE-2026-98546 arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
- CVE-2026-98545 ata: libata-scsi: bound the ATA passthru sense descriptor writes
- CVE-2026-98544 bna: prevent IOC timer rearm during teardown
- CVE-2026-98543 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
- CVE-2026-98542 cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict
- CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
- CVE-2026-98540 fprobe: Terminate the fgraph_data list when the reservation is not filled
- CVE-2026-9854 Privilege escalation in MicroSCADA SYS600
- CVE-2026-98539 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
- CVE-2026-98538 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
- CVE-2026-98537 workqueue: Fix NULL current_pwq deref in flush dependency check
- CVE-2026-98536 writeback: report a Tasks-RCU quiescent state per cgwb drain pass
- CVE-2026-98535 fsl/fman: Fix clk reference leak in read_dts_node()
- CVE-2026-98534 ipe: fix use-after-free when auditing a newly loaded policy
- CVE-2026-98533 ipe: protect the dm-verity root hash with RCU
- CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end
- CVE-2026-98531 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
- CVE-2026-98530 kprobes: Fix permanent hang when flushing the kprobe optimizer
- CVE-2026-9853 Missing authorization in MicroSCADA SYS600
- CVE-2026-98529 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
- CVE-2026-98528 gpio: cdev: fix kernel stack leak to user-space in error path
- CVE-2026-98527 gpio: zynq: fix runtime PM leak on request error path
- CVE-2026-98526 llc: reserve device headroom for allocated frames
- CVE-2026-98525 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
- CVE-2026-98524 rds: ib: Clear the sg list when mapping an MR fails
- CVE-2026-98523 drm/client: fix restore of partially initialized client
- CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
- CVE-2026-98521 drm/i915: fix incorrect RCU teardown order
- CVE-2026-98520 drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
- CVE-2026-9852 Code injection in MicroSCADA SYS600
- CVE-2026-98519 drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
- CVE-2026-98518 drm/nouveau/dmem: pin VRAM for the whole registered range
- CVE-2026-98517 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
- CVE-2026-98516 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
- CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor
- CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()
- CVE-2026-98513 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
- CVE-2026-98512 drm/nouveau: RCU-free the scheduler-containing nouveau_sched
- CVE-2026-98511 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
- CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs
- CVE-2026-9851 Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action
- CVE-2026-98509 drm/virtio: fix memory leak of fence event on execbuffer failure
- CVE-2026-98508 drm/virtio: fix NULL pointer dereference on fence allocation failure
- CVE-2026-98507 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
- CVE-2026-98506 mm/hugetlb: do not dissolve gigantic pages without runtime support
- CVE-2026-98505 mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
- CVE-2026-98504 PCI: of_property: Omit bus properties without a subordinate bus
- CVE-2026-98503 packet: use ubuf_info completion for TX_RING packets
- CVE-2026-98502 HID: alps: unregister DualPoint Stick input device on remove
- CVE-2026-98501 HID: alps: fix use-after-free on input2 registration failure
- CVE-2026-98500 HID: hid-oxp: use cancel_delayed_work_sync() in remove
- CVE-2026-98499 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
- CVE-2026-98498 net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
- CVE-2026-98497 net/mlx5e: fix swapped IPv6 IPsec policy masks
- CVE-2026-98496 net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
- CVE-2026-98495 net: arp: terminate device name before lookup
- CVE-2026-98494 net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
- CVE-2026-98493 net: ipconfig: bound DHCP option construction
- CVE-2026-98492 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
- CVE-2026-98491 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
- CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc
- CVE-2026-98489 net: atl1c: fix soft lockup on out-of-range tpd_cons read
- CVE-2026-98488 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read