Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 209 of 1013.
- CVE-2026-98391 drm/xe: Guard page-fault worker with runtime PM check
- CVE-2026-98390 x86/amd_node: Avoid divide by zero on virtualized systems
- CVE-2026-98389 drm/amdgpu: skip gfx switch_power_profile during GPU reset
- CVE-2026-98388 exec: do_close_on_exec() before taking exec_update_lock
- CVE-2026-98387 s390/crypto: Fix skcipher_walk return code handling in aes_s390
- CVE-2026-98386 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
- CVE-2026-98385 sched/cache: Decouple sched_cache_group from mm to fix UAF
- CVE-2026-98384 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
- CVE-2026-98383 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
- CVE-2026-98382 bpf: Reject dev-bound-only programs on other devices
- CVE-2026-98381 veth: manage XDP program pointers during channel resize
- CVE-2026-98380 net/sched: reject IDR error pointers when deleting actions
- CVE-2026-9838 ICS Calendar <= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter
- CVE-2026-98379 netfilter: ip6t_rpfilter: reject routes without inet6_dev
- CVE-2026-98378 bpf: Skip unsettled links in link iterator
- CVE-2026-98377 vlan: require the MAC header to be present in __vlan_insert_inner_tag()
- CVE-2026-98376 bpf: Use array_map_meta_equal for percpu array inner map replacement
- CVE-2026-98375 xen/netfront: drop RX packets with a short Ethernet header
- CVE-2026-98374 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
- CVE-2026-98373 mm/hugetlb: preserve mremap address delta when skipping page tables
- CVE-2026-98372 xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
- CVE-2026-98371 xfrm: iptfs: fix runt reassembly panic from short inner tot_len
- CVE-2026-98370 xfrm: fix compat ALLOCSPI request use-after-free
- CVE-2026-98369 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
- CVE-2026-98368 esp: downgrade zerocopy managed frags before mutating skb frags
- CVE-2026-98367 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
- CVE-2026-98366 RDMA/rxe: validate access flags before swapping the MR's PD
- CVE-2026-98365 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
- CVE-2026-98364 xfrm: hold net_device reference under RCU in bundle creation
- CVE-2026-98363 firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
- CVE-2026-98362 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
- CVE-2026-98361 RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
- CVE-2026-98360 RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
- CVE-2026-9836 IBM DataStage Flow Designer application is affected by an information disclosure vulnerability
- CVE-2026-98359 RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
- CVE-2026-98358 IB/iser: reject a remote invalidation of an unregistered direction
- CVE-2026-98357 IB/isert: wait for deferred control PDU completions before releasing the connection
- CVE-2026-98356 RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
- CVE-2026-98355 RDMA/rtrs: guard against null kobj name
- CVE-2026-98354 RDMA/mad: Fix receive buffer leak when PKey enforcement fails
- CVE-2026-98353 RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
- CVE-2026-98352 RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
- CVE-2026-98351 wifi: virt_wifi: free skb when disconnected
- CVE-2026-98350 wifi: brcmfmac: cyw: pass PMKID to firmware if present
- CVE-2026-98349 wifi: libipw: reject too-short beacon and probe responses
- CVE-2026-98348 wifi: libipw: reject too-short association responses
- CVE-2026-98347 IB/IPoIB: Avoid restoring OPER_UP after multicast flush
- CVE-2026-98346 wifi: cfg80211: don't get the radio mask for netdev-less wdevs
- CVE-2026-98345 wifi: cfg80211: check IP header size in cfg80211_classify8021d()
- CVE-2026-98344 dmaengine: Fix device kref underflow in dma_chan_put()
- CVE-2026-98343 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
- CVE-2026-98342 dmaengine: wait for RCU readers before releasing dma_device
- CVE-2026-98341 wifi: cfg80211: don't free driver-owned scan requests
- CVE-2026-98340 wifi: cfg80211: only group hidden BSSes with beacon entries
- CVE-2026-9834 WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter
- CVE-2026-98339 wifi: cfg80211: don't filter by BSS type when removing stale entries
- CVE-2026-98338 wifi: cfg80211: ibss: ref BSS entry for joined event
- CVE-2026-98337 wifi: mac80211: don't start a ROC while scanning
- CVE-2026-98336 wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
- CVE-2026-98335 wifi: mac80211: abort chanswitch when leaving a mesh
- CVE-2026-98334 wifi: mac80211: reset state when starting AP fails
- CVE-2026-98333 wifi: mac80211: reset the LED state when ifup fails
- CVE-2026-98332 wifi: mac80211: only operate on TDLS peers in the TDLS code
- CVE-2026-98331 wifi: mac80211: unlist vifs when their netdev is unregistered
- CVE-2026-98330 wifi: cfg80211: get the wiphy out of a dying network namespace
- CVE-2026-9833 Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter
- CVE-2026-98329 wifi: mac80211: don't allow injecting frames wider than the chanctx
- CVE-2026-98328 wifi: mac80211: add HE 6 GHz capability in the scan elems len
- CVE-2026-98327 wifi: mac80211: mesh: reset the CSA state when leaving
- CVE-2026-98326 wifi: mac80211: mesh: release the channel if start fails
- CVE-2026-98325 wifi: mac80211: set up the TX info early to fix failure paths
- CVE-2026-98324 dmaengine: pxa: fix double counting of the hw descriptors
- CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length
- CVE-2026-98322 netfilter: nft_nat: fully initialise new_addr in netmap setup
- CVE-2026-98321 netfilter: nf_nat: unregister and release hooks on error
- CVE-2026-98320 netfilter: flowtable: hold reference on ct until flow is released
- CVE-2026-9832 Security feature bypass in Payment Gateway of Stripe for WooCommerce
- CVE-2026-98319 drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
- CVE-2026-98318 smb: client: validate absolute native symlink targets before NT fixups
- CVE-2026-98317 neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.
- CVE-2026-98316 ALSA: bcd2000: Fix race between rawmidi and disconnect
- CVE-2026-98315 ntfs: protect runlist updates with the runlist lock
- CVE-2026-98314 ALSA: pcm: set timer->private_data before registering the PCM timer
- CVE-2026-98313 drm/msm/dp: skip PUSH_IDLE when the link was never enabled
- CVE-2026-98312 ALSA: 6fire: fix OOB write from device-reported iso length
- CVE-2026-98311 wifi: virt_wifi: don't transfer operstate before register
- CVE-2026-98310 drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory
- CVE-2026-9831 ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition
- CVE-2026-98309 drm/vc4: Use managed KMS polling to fix UAF on unbind
- CVE-2026-98308 ALSA: hda: trace PCM open only after assigning a stream
- CVE-2026-98307 wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
- CVE-2026-98306 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
- CVE-2026-98305 net: dsa: mxl862xx: disable the stats poll on teardown
- CVE-2026-98304 net: bcmgenet: restore the hardware filters on open
- CVE-2026-98303 ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
- CVE-2026-98302 net: fddi: skfp: fix NULL deref when setting the MAC address while down
- CVE-2026-98301 net: bridge: mst: move switchdev call outside rcu
- CVE-2026-98300 tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
- CVE-2026-9830 BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug
- CVE-2026-98299 tcp: do not let tcp_rmem be set below 4096