# Vulnerabilities published in 2026


- [CVE-2026-9858](https://insights.sbomify.com/CVE-2026-9858/): Missing authorization in Partial Shipment for WooCommerce (medium 4.3)
- [CVE-2026-98579](https://insights.sbomify.com/CVE-2026-98579/): nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (not scored)
- [CVE-2026-98578](https://insights.sbomify.com/CVE-2026-98578/): nfc: st21nfca: validate ISO15693 inventory length (not scored)
- [CVE-2026-98577](https://insights.sbomify.com/CVE-2026-98577/): nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (not scored)
- [CVE-2026-98576](https://insights.sbomify.com/CVE-2026-98576/): nfc: llcp: fix slab-out-of-bounds reads when logging service names (not scored)
- [CVE-2026-98575](https://insights.sbomify.com/CVE-2026-98575/): nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (not scored)
- [CVE-2026-98574](https://insights.sbomify.com/CVE-2026-98574/): net: bcmgenet: stop Tx NAPI before disabling the queues (not scored)
- [CVE-2026-98573](https://insights.sbomify.com/CVE-2026-98573/): net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (not scored)
- [CVE-2026-98572](https://insights.sbomify.com/CVE-2026-98572/): bpf: Fix immediate JMP JEQ/JNE on MIPS32 (not scored)
- [CVE-2026-98571](https://insights.sbomify.com/CVE-2026-98571/): net: stmmac: clear stale buf->page after recycling on skb build failure (not scored)
- [CVE-2026-98570](https://insights.sbomify.com/CVE-2026-98570/): net: ipv6: keep room for the mac header in dst_dev_overhead() (not scored)
- [CVE-2026-9857](https://insights.sbomify.com/CVE-2026-9857/): Missing authorization in Invoice123 (medium 4.3)
- [CVE-2026-98569](https://insights.sbomify.com/CVE-2026-98569/): ip_gre: Reject enabling collect metadata through changelink (not scored)
- [CVE-2026-98568](https://insights.sbomify.com/CVE-2026-98568/): vxlan: use one headroom snapshot for neighbour replies (not scored)
- [CVE-2026-98567](https://insights.sbomify.com/CVE-2026-98567/): net: xps: reject an out of range traffic class (not scored)
- [CVE-2026-98566](https://insights.sbomify.com/CVE-2026-98566/): drm/imagination: clamp freelist reconstruction requests (not scored)
- [CVE-2026-98565](https://insights.sbomify.com/CVE-2026-98565/): net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 (not scored)
- [CVE-2026-98564](https://insights.sbomify.com/CVE-2026-98564/): net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq (not scored)
- [CVE-2026-98563](https://insights.sbomify.com/CVE-2026-98563/): net: phylink: record the PHY only once bringup cannot fail (not scored)
- [CVE-2026-98562](https://insights.sbomify.com/CVE-2026-98562/): net: libwx: fix races in Tx timestamp handling (not scored)
- [CVE-2026-98561](https://insights.sbomify.com/CVE-2026-98561/): nfp: hold IPsec RX state under the XArray lock (not scored)
- [CVE-2026-98560](https://insights.sbomify.com/CVE-2026-98560/): net/rds: size a connection's path set by the transport it ends up with (not scored)
- [CVE-2026-9856](https://insights.sbomify.com/CVE-2026-9856/): Path Traversal in huggingface/transformers (high 7.1)
- [CVE-2026-98559](https://insights.sbomify.com/CVE-2026-98559/): net/smc: fix UAF on lgr list traversal in smcr_port_err() (not scored)
- [CVE-2026-98558](https://insights.sbomify.com/CVE-2026-98558/): net: flush skb_defer_nodes in dev_cpu_dead() (not scored)
- [CVE-2026-98557](https://insights.sbomify.com/CVE-2026-98557/): gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO (not scored)
- [CVE-2026-98556](https://insights.sbomify.com/CVE-2026-98556/): gve: DQO: reject TSO packets with an out of range MSS (not scored)
- [CVE-2026-98555](https://insights.sbomify.com/CVE-2026-98555/): llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (high 7.5)
- [CVE-2026-98554](https://insights.sbomify.com/CVE-2026-98554/): vlan: ensure sufficient headroom in vlan_dev_hard_header() (not scored)
- [CVE-2026-98553](https://insights.sbomify.com/CVE-2026-98553/): autofs: fix sbi->pipe file reference leak in autofs_kill_sb() (not scored)
- [CVE-2026-98552](https://insights.sbomify.com/CVE-2026-98552/): perf/core: Fix a refcount leak in attach_perf_ctx_data() (not scored)
- [CVE-2026-98551](https://insights.sbomify.com/CVE-2026-98551/): perf/core: Fill branch entries with a single assignment (not scored)
- [CVE-2026-98550](https://insights.sbomify.com/CVE-2026-98550/): tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (high 7.5)
- [CVE-2026-9855](https://insights.sbomify.com/CVE-2026-9855/): Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter (medium 6.5)
- [CVE-2026-98549](https://insights.sbomify.com/CVE-2026-98549/): tcp: prevent collapsing skbs across boundary in rtx queue (critical 9.1)
- [CVE-2026-98548](https://insights.sbomify.com/CVE-2026-98548/): sctp: discard the rest of the packet on a stale-cookie error (critical 9.8)
- [CVE-2026-98547](https://insights.sbomify.com/CVE-2026-98547/): af_packet: fix integer overflow in prb_calc_retire_blk_tmo() (not scored)
- [CVE-2026-98546](https://insights.sbomify.com/CVE-2026-98546/): arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 (not scored)
- [CVE-2026-98545](https://insights.sbomify.com/CVE-2026-98545/): ata: libata-scsi: bound the ATA passthru sense descriptor writes (not scored)
- [CVE-2026-98544](https://insights.sbomify.com/CVE-2026-98544/): bna: prevent IOC timer rearm during teardown (not scored)
- [CVE-2026-98543](https://insights.sbomify.com/CVE-2026-98543/): bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir (high 7.3)
- [CVE-2026-98542](https://insights.sbomify.com/CVE-2026-98542/): cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict (not scored)
- [CVE-2026-98541](https://insights.sbomify.com/CVE-2026-98541/): fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT (not scored)
- [CVE-2026-98540](https://insights.sbomify.com/CVE-2026-98540/): fprobe: Terminate the fgraph_data list when the reservation is not filled (not scored)
- [CVE-2026-9854](https://insights.sbomify.com/CVE-2026-9854/): Privilege escalation in MicroSCADA SYS600 (high 8.5)
- [CVE-2026-98539](https://insights.sbomify.com/CVE-2026-98539/): fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga (not scored)
- [CVE-2026-98538](https://insights.sbomify.com/CVE-2026-98538/): writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes (not scored)
- [CVE-2026-98537](https://insights.sbomify.com/CVE-2026-98537/): workqueue: Fix NULL current_pwq deref in flush dependency check (not scored)
- [CVE-2026-98536](https://insights.sbomify.com/CVE-2026-98536/): writeback: report a Tasks-RCU quiescent state per cgwb drain pass (not scored)
- [CVE-2026-98535](https://insights.sbomify.com/CVE-2026-98535/): fsl/fman: Fix clk reference leak in read_dts_node() (not scored)
- [CVE-2026-98534](https://insights.sbomify.com/CVE-2026-98534/): ipe: fix use-after-free when auditing a newly loaded policy (not scored)
- [CVE-2026-98533](https://insights.sbomify.com/CVE-2026-98533/): ipe: protect the dm-verity root hash with RCU (not scored)
- [CVE-2026-98532](https://insights.sbomify.com/CVE-2026-98532/): ipv6: do not let ipv6_find_hdr() return an offset past the packet end (high 8.1)
- [CVE-2026-98531](https://insights.sbomify.com/CVE-2026-98531/): ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST (not scored)
- [CVE-2026-98530](https://insights.sbomify.com/CVE-2026-98530/): kprobes: Fix permanent hang when flushing the kprobe optimizer (not scored)
- [CVE-2026-9853](https://insights.sbomify.com/CVE-2026-9853/): Missing authorization in MicroSCADA SYS600 (high 8.5)
- [CVE-2026-98529](https://insights.sbomify.com/CVE-2026-98529/): gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (not scored)
- [CVE-2026-98528](https://insights.sbomify.com/CVE-2026-98528/): gpio: cdev: fix kernel stack leak to user-space in error path (not scored)
- [CVE-2026-98527](https://insights.sbomify.com/CVE-2026-98527/): gpio: zynq: fix runtime PM leak on request error path (not scored)
- [CVE-2026-98526](https://insights.sbomify.com/CVE-2026-98526/): llc: reserve device headroom for allocated frames (not scored)
- [CVE-2026-98525](https://insights.sbomify.com/CVE-2026-98525/): mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() (not scored)
- [CVE-2026-98524](https://insights.sbomify.com/CVE-2026-98524/): rds: ib: Clear the sg list when mapping an MR fails (high 7.8)
- [CVE-2026-98523](https://insights.sbomify.com/CVE-2026-98523/): drm/client: fix restore of partially initialized client (not scored)
- [CVE-2026-98522](https://insights.sbomify.com/CVE-2026-98522/): drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (not scored)
- [CVE-2026-98521](https://insights.sbomify.com/CVE-2026-98521/): drm/i915: fix incorrect RCU teardown order (not scored)
- [CVE-2026-98520](https://insights.sbomify.com/CVE-2026-98520/): drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping (high 7.8)
- [CVE-2026-9852](https://insights.sbomify.com/CVE-2026-9852/): Code injection in MicroSCADA SYS600 (medium 4.6)
- [CVE-2026-98519](https://insights.sbomify.com/CVE-2026-98519/): drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (not scored)
- [CVE-2026-98518](https://insights.sbomify.com/CVE-2026-98518/): drm/nouveau/dmem: pin VRAM for the whole registered range (high 7.0)
- [CVE-2026-98517](https://insights.sbomify.com/CVE-2026-98517/): drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (high 7.8)
- [CVE-2026-98516](https://insights.sbomify.com/CVE-2026-98516/): drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (not scored)
- [CVE-2026-98515](https://insights.sbomify.com/CVE-2026-98515/): drm/nouveau: fix double-free in nvif_vmm_dtor (high 7.8)
- [CVE-2026-98514](https://insights.sbomify.com/CVE-2026-98514/): drm/nouveau: Fix gem reference leak in validate_init() (not scored)
- [CVE-2026-98513](https://insights.sbomify.com/CVE-2026-98513/): drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (not scored)
- [CVE-2026-98512](https://insights.sbomify.com/CVE-2026-98512/): drm/nouveau: RCU-free the scheduler-containing nouveau_sched (high 7.1)
- [CVE-2026-98511](https://insights.sbomify.com/CVE-2026-98511/): drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (not scored)
- [CVE-2026-98510](https://insights.sbomify.com/CVE-2026-98510/): drm/xe/vm: nuke PTs only after unlinking contested VMAs (high 7.8)
- [CVE-2026-9851](https://insights.sbomify.com/CVE-2026-9851/): Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action (high 7.2)
- [CVE-2026-98509](https://insights.sbomify.com/CVE-2026-98509/): drm/virtio: fix memory leak of fence event on execbuffer failure (not scored)
- [CVE-2026-98508](https://insights.sbomify.com/CVE-2026-98508/): drm/virtio: fix NULL pointer dereference on fence allocation failure (not scored)
- [CVE-2026-98507](https://insights.sbomify.com/CVE-2026-98507/): mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish (high 7.8)
- [CVE-2026-98506](https://insights.sbomify.com/CVE-2026-98506/): mm/hugetlb: do not dissolve gigantic pages without runtime support (not scored)
- [CVE-2026-98505](https://insights.sbomify.com/CVE-2026-98505/): mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() (not scored)
- [CVE-2026-98504](https://insights.sbomify.com/CVE-2026-98504/): PCI: of_property: Omit bus properties without a subordinate bus (not scored)
- [CVE-2026-98503](https://insights.sbomify.com/CVE-2026-98503/): packet: use ubuf_info completion for TX_RING packets (not scored)
- [CVE-2026-98502](https://insights.sbomify.com/CVE-2026-98502/): HID: alps: unregister DualPoint Stick input device on remove (not scored)
- [CVE-2026-98501](https://insights.sbomify.com/CVE-2026-98501/): HID: alps: fix use-after-free on input2 registration failure (high 7.1)
- [CVE-2026-98500](https://insights.sbomify.com/CVE-2026-98500/): HID: hid-oxp: use cancel_delayed_work_sync() in remove (not scored)
- [CVE-2026-98499](https://insights.sbomify.com/CVE-2026-98499/): HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (high 8.1)
- [CVE-2026-98498](https://insights.sbomify.com/CVE-2026-98498/): net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() (not scored)
- [CVE-2026-98497](https://insights.sbomify.com/CVE-2026-98497/): net/mlx5e: fix swapped IPv6 IPsec policy masks (high 7.5)
- [CVE-2026-98496](https://insights.sbomify.com/CVE-2026-98496/): net: airoha: npu: cancel wdt_work after releasing the WDT IRQ (not scored)
- [CVE-2026-98495](https://insights.sbomify.com/CVE-2026-98495/): net: arp: terminate device name before lookup (not scored)
- [CVE-2026-98494](https://insights.sbomify.com/CVE-2026-98494/): net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read (not scored)
- [CVE-2026-98493](https://insights.sbomify.com/CVE-2026-98493/): net: ipconfig: bound DHCP option construction (not scored)
- [CVE-2026-98492](https://insights.sbomify.com/CVE-2026-98492/): net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths (not scored)
- [CVE-2026-98491](https://insights.sbomify.com/CVE-2026-98491/): net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (high 7.8)
- [CVE-2026-98490](https://insights.sbomify.com/CVE-2026-98490/): net: openvswitch: conntrack: fix helper UAF due to extensions realloc (critical 9.8)
- [CVE-2026-98489](https://insights.sbomify.com/CVE-2026-98489/): net: atl1c: fix soft lockup on out-of-range tpd_cons read (not scored)
- [CVE-2026-98488](https://insights.sbomify.com/CVE-2026-98488/): net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/207/