Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 208 of 1013.
- CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion
- CVE-2026-98486 net: ena: fix MMIO read buffer leak on probe failure
- CVE-2026-98485 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- CVE-2026-98484 netfilter: nf_tables: skip expired catchall elements on insert and delete
- CVE-2026-98483 nfc: fix use-after-free in nfc_get_local_general_bytes
- CVE-2026-98482 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- CVE-2026-98481 nfc: port100: reject frames whose declared length exceeds the received data
- CVE-2026-98480 nfc: trf7970a: power down on startup RX gain failure
- CVE-2026-9848 WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter
- CVE-2026-98479 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- CVE-2026-98478 scsi: ufs: core: Keep internal commands dispatchable during error handling
- CVE-2026-98477 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
- CVE-2026-98476 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- CVE-2026-98475 s390/cmf: Fix virtual vs physical address confusion
- CVE-2026-98474 s390/pci: Fix missing device lock in zpci_report_status()
- CVE-2026-98473 s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config
- CVE-2026-98472 KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
- CVE-2026-98471 KVM: SEV: Do cache maintenance on the source VM during intra-host migration
- CVE-2026-98470 KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
- CVE-2026-98469 KVM: arm64: Fix AArch32 DBGBXVR<n> handling
- CVE-2026-98468 KVM: arm64: Fix spurious warning for benign stage 2 teardown race
- CVE-2026-98467 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
- CVE-2026-98466 KVM: arm64: Transfer the hyp stack pages out of the host stage-2
- CVE-2026-98465 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
- CVE-2026-98464 RISC-V: KVM: Synchronize hrtimer callback during teardown
- CVE-2026-98463 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
- CVE-2026-98462 Bluetooth: hci_conn: fix CIS hold ownership on reuse
- CVE-2026-98461 Bluetooth: hci_sock: validate event length before filtering
- CVE-2026-98460 Bluetooth: hci_sock: reject out-of-range OCF values
- CVE-2026-98459 Bluetooth: ISO: balance the parent hold in hci_bind_bis()
- CVE-2026-98458 Bluetooth: ISO: release unused CIS holds after channel attach
- CVE-2026-98457 Bluetooth: L2CAP: validate frame length before control and FCS access
- CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()
- CVE-2026-98455 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- CVE-2026-98454 smb: client: fix create context out-of-bounds reads
- CVE-2026-98453 smb: client: close handle after create-context parsing failure
- CVE-2026-98452 smb: client: clean up failed cached directory opens
- CVE-2026-98451 smb: client: use finish_no_open() for non-regular inodes
- CVE-2026-98450 smb: client: close completed creates on compound wait errors
- CVE-2026-98449 smb: client: delete compound mids on send failure before unlock
- CVE-2026-98448 xfs: release orphanage dir inode if chown fails
- CVE-2026-98447 xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
- CVE-2026-98446 xfs: don't let hidden_space go negative in xfs_metafile_resv_init
- CVE-2026-98445 xfs: don't let memory failures leak blocks and kill repairs
- CVE-2026-98444 xfs: drop dquot flush lock when we can't find a buffer to flush
- CVE-2026-98443 xfs: fix cursor and pointer handling when recovering iunlink buckets
- CVE-2026-98442 net/sched: act_ct: fix helper UAF due to extensions realloc
- CVE-2026-98441 net/sched: act_ct: avoid modifying shared unconfirmed ct entry
- CVE-2026-98440 KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
- CVE-2026-9844 Vulnerability in navify® Digital Pathology
- CVE-2026-98439 smb/server: cancel async requests when closing connection
- CVE-2026-98438 mptcp: options: fix uninit-value in mptcp_write_data_fin
- CVE-2026-98437 media: qcom: iris: fix runtime PM reference leaks
- CVE-2026-98436 accel/amdxdna: Disable device buffer exporting
- CVE-2026-98435 EDAC/altera: Use parent device for devres in altr_portb_setup()
- CVE-2026-98434 sysctl: Check range in proc_dointvec_ms_jiffies_minmax
- CVE-2026-98433 KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
- CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period
- CVE-2026-98431 RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
- CVE-2026-98430 RDMA/efa: Keep admin queues alive while IRQ is registered
- CVE-2026-9843 Path traversal in Database for Contact Form 7, WPforms, Elementor forms
- CVE-2026-98429 RDMA/efa: Keep EQ resources alive while IRQ is registered
- CVE-2026-98428 ALSA: usb: 6fire: Avoid embedded URBs
- CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call
- CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
- CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan
- CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails
- CVE-2026-98423 wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
- CVE-2026-98422 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
- CVE-2026-98421 wifi: mac80211: require a peer station for TDLS setup confirm
- CVE-2026-98420 ksmbd: follow SMB2 session expiration semantics
- CVE-2026-9842 Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities
- CVE-2026-98419 drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
- CVE-2026-98418 sched/core: Avoid false migration warning for proxy donors
- CVE-2026-98417 net: xfrm: reject unrepresentable espintcp transport headers
- CVE-2026-98416 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
- CVE-2026-98415 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
- CVE-2026-98414 memcg: avoid charging the root memcg from obj_cgroup_charge_pages()
- CVE-2026-98413 selinux: always fill AVC decision in avc_has_perm_noaudit()
- CVE-2026-98412 power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
- CVE-2026-98411 power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
- CVE-2026-98410 watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
- CVE-2026-98409 watchdog: rtd119x: Avoid division by zero
- CVE-2026-98408 watchdog: rzv2h: Avoid division by zero
- CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal
- CVE-2026-98406 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
- CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()
- CVE-2026-98404 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
- CVE-2026-98403 s390/boot: Avoid IPL parameter append past command line
- CVE-2026-98402 net: icmp: avoid invalid transport header access in icmp_send tracepoint
- CVE-2026-98401 net: iptunnel: fix stale transport header during tunnel decapsulation
- CVE-2026-98400 s390/ipl: Fix NULL deref in kdump without re-IPL parm block
- CVE-2026-98399 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
- CVE-2026-98398 locking/lockdep: Invalidate stale class_cache entries for zapped classes
- CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
- CVE-2026-98396 powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
- CVE-2026-98395 powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
- CVE-2026-98394 af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.
- CVE-2026-98393 net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
- CVE-2026-98392 Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one