Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 212 of 1013.
- CVE-2026-98110 Bluetooth: btintel: bound firmware ID by TLV length
- CVE-2026-9811 Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
- CVE-2026-98109 Bluetooth: hci_core: Fix race condition during device registration
- CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
- CVE-2026-98107 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
- CVE-2026-98106 drm/pagemap: Prevent double migration of device pages
- CVE-2026-98105 net: ethernet: oa_tc6: Improve the error recovery
- CVE-2026-98104 net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
- CVE-2026-98103 igmp: convert struct ip_sf_list to RCU
- CVE-2026-98102 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
- CVE-2026-98101 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
- CVE-2026-9810 AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth
- CVE-2026-98099 ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
- CVE-2026-98098 tipc: fix NULL deref in tipc_named_node_up() on empty publication list
- CVE-2026-98097 tipc: Dont send random pad bytes in RESET/ACTIVATE messages
- CVE-2026-98096 ipv6: sr: restore network header before routing and forwarding
- CVE-2026-98095 af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
- CVE-2026-98094 staging: fbtft: make dirty_lock IRQ-safe
- CVE-2026-98093 ASoC: fsl_micfil: balance mclk enable/disable
- CVE-2026-98092 ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()
- CVE-2026-98091 btrfs: detach failed sprout device from transaction update list
- CVE-2026-98090 btrfs: restore active device pointers after failed sprout
- CVE-2026-9809 Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
- CVE-2026-98089 bonding: alb: fix uninitialized transport header access in alb_determine_nd()
- CVE-2026-98088 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
- CVE-2026-98087 sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
- CVE-2026-98086 ALSA: ump: do not touch legacy_rmidi before it exists
- CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
- CVE-2026-98084 bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
- CVE-2026-98083 btrfs: fix transaction use-after-free in raid stripe insertion
- CVE-2026-98082 btrfs: fix the possible bioc_list memory leak during error
- CVE-2026-98081 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
- CVE-2026-98080 btrfs: do not force reloc root creation during qgroup_account_snapshot()
- CVE-2026-9808 Mautic has an Authorization Bypass in API v2 Endpoints
- CVE-2026-98079 btrfs: zstd: fix lost wakeup when waiting for a workspace
- CVE-2026-98078 ipvs: fix reversed sequence option serialization
- CVE-2026-98077 netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
- CVE-2026-98076 tracing/probes: Fix use-after-free on field name/type of events with multiple probes
- CVE-2026-98075 bpf: reject BPF_PSEUDO_FUNC reference to the main program
- CVE-2026-98074 bonding: do not clear curr_active_slave prematurely when releasing all slaves
- CVE-2026-98073 net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
- CVE-2026-98072 net/rds: use wq_has_sleeper() in release_in_xmit()
- CVE-2026-98071 net/rds: clear cp_flags bits individually in rds_conn_path_reset()
- CVE-2026-98070 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
- CVE-2026-9807 Incorrect Authorization in GitLab
- CVE-2026-98069 net/rds: acquire the fastpath locks in rds_conn_shutdown()
- CVE-2026-98068 net/rds: don't let rds_conn_shutdown() consume a concurrent drop
- CVE-2026-98067 erofs: disable LZ4 rolling decompression for now
- CVE-2026-98066 ALSA: caiaq: Fix potential double-free at error path
- CVE-2026-98065 bpf: Reject key-less BTF for hash maps
- CVE-2026-98064 bpf: Fix NULL-ptr-deref when showing a void BTF type
- CVE-2026-98063 bpf: Fix NULL-ptr-deref in btf_var_show()
- CVE-2026-98062 bpf: Mark signal tracepoint siginfo arguments as scalar
- CVE-2026-98061 bpf: Reject tail calls directly from callback frames
- CVE-2026-98060 bpf: Reject resilient lock operations in rbtree callbacks
- CVE-2026-9806 Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names
- CVE-2026-98059 bpf: Mark sched_process_wait argument as nullable
- CVE-2026-98058 bpf: Mark syscall helpers as sleepable
- CVE-2026-98057 ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
- CVE-2026-98056 nvme: remove stale namespaces by NSID range during scan
- CVE-2026-98055 ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
- CVE-2026-98054 ASoC: Intel: avs: Fix unbalanced module reference count
- CVE-2026-98053 ASoC: Intel: avs: Refactor and fix init_config access
- CVE-2026-98052 net: bcmasp: clear txcb->last before writing each descriptor
- CVE-2026-98051 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
- CVE-2026-98050 mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context
- CVE-2026-9805 FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow
- CVE-2026-98049 bpf: zero extend the result of an arena 32-bit cmpxchg
- CVE-2026-98048 bpf: don't rewrite bpf_fastcall patterns entered by a jump
- CVE-2026-98047 bpf: Check ancestor frames for rbtree callbacks
- CVE-2026-98046 bpf: Mark bpf_btf_find_by_name_kind() as sleepable
- CVE-2026-98045 bpf: Mark faultable stack helpers as sleepable
- CVE-2026-98044 bpf: Reject legacy packet loads from callbacks
- CVE-2026-98043 bpf: Don't infer non-NULL from a pointer with an unbounded offset
- CVE-2026-98042 bpf: Don't resurrect a scalar id dropped by collect_linked_regs()
- CVE-2026-98041 bpf: Don't predict JMP32 pointer vs zero comparisons
- CVE-2026-98040 bpf: Mark the zero register precise for a register-form NULL check
- CVE-2026-9804 Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read
- CVE-2026-98039 bpf: Require MEM_PERCPU for percpu kptr stores
- CVE-2026-98038 bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
- CVE-2026-98037 bpf: Reject untrusted allocated-object pointers
- CVE-2026-98036 bpf: Preserve special fields in recycled rhtab elements
- CVE-2026-98035 bpf: Cancel special fields when recycling rhtab elements
- CVE-2026-98034 bpf: Mark NULL kptr stores precise
- CVE-2026-98033 bpf: Preserve inner map identity in callback frames
- CVE-2026-98032 tracing: Fix subbuf resize races with trace_pipe_raw readers
- CVE-2026-98031 nexthop: Initialize extack in remove_nh_grp_entry()
- CVE-2026-98030 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
- CVE-2026-9803 Keycloak: keycloak: denial of service via malformed authorization header
- CVE-2026-98029 eth: nfp: bound the ntuple rule dump by the caller's buffer size
- CVE-2026-98028 eth: nfp: drop the replaced rule from the list when reprogramming fails
- CVE-2026-98027 net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
- CVE-2026-98026 net: bridge: mcast: properly convert mglist to rcu
- CVE-2026-98025 net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
- CVE-2026-98024 s390/ism: folio_put() after error
- CVE-2026-98023 vxlan: reject dynamic fdb entries that reference a nexthop id
- CVE-2026-98022 net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
- CVE-2026-98021 net: reject oversized tx_queue_len at netlink parse time
- CVE-2026-98020 pds_core: fix cmd_regs access racing BAR unmap on reset
- CVE-2026-9802 Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart