# Vulnerabilities published in 2026


- [CVE-2026-98110](https://insights.sbomify.com/CVE-2026-98110/): Bluetooth: btintel: bound firmware ID by TLV length (high 7.1)
- [CVE-2026-9811](https://insights.sbomify.com/CVE-2026-9811/): Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector (medium 5.4)
- [CVE-2026-98109](https://insights.sbomify.com/CVE-2026-98109/): Bluetooth: hci_core: Fix race condition during device registration (medium 4.7)
- [CVE-2026-98108](https://insights.sbomify.com/CVE-2026-98108/): Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (high 7.5)
- [CVE-2026-98107](https://insights.sbomify.com/CVE-2026-98107/): Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (not scored)
- [CVE-2026-98106](https://insights.sbomify.com/CVE-2026-98106/): drm/pagemap: Prevent double migration of device pages (not scored)
- [CVE-2026-98105](https://insights.sbomify.com/CVE-2026-98105/): net: ethernet: oa_tc6: Improve the error recovery (not scored)
- [CVE-2026-98104](https://insights.sbomify.com/CVE-2026-98104/): net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted (not scored)
- [CVE-2026-98103](https://insights.sbomify.com/CVE-2026-98103/): igmp: convert struct ip_sf_list to RCU (not scored)
- [CVE-2026-98102](https://insights.sbomify.com/CVE-2026-98102/): ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() (not scored)
- [CVE-2026-98101](https://insights.sbomify.com/CVE-2026-98101/): ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() (not scored)
- [CVE-2026-9810](https://insights.sbomify.com/CVE-2026-9810/): AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth (critical 9.8)
- [CVE-2026-98099](https://insights.sbomify.com/CVE-2026-98099/): ipv6: mcast: use rcu_assign_pointer() for __rcu list updates (medium 4.7)
- [CVE-2026-98098](https://insights.sbomify.com/CVE-2026-98098/): tipc: fix NULL deref in tipc_named_node_up() on empty publication list (medium 5.5)
- [CVE-2026-98097](https://insights.sbomify.com/CVE-2026-98097/): tipc: Dont send random pad bytes in RESET/ACTIVATE messages (medium 5.3)
- [CVE-2026-98096](https://insights.sbomify.com/CVE-2026-98096/): ipv6: sr: restore network header before routing and forwarding (high 7.4)
- [CVE-2026-98095](https://insights.sbomify.com/CVE-2026-98095/): af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). (medium 5.5)
- [CVE-2026-98094](https://insights.sbomify.com/CVE-2026-98094/): staging: fbtft: make dirty_lock IRQ-safe (medium 5.5)
- [CVE-2026-98093](https://insights.sbomify.com/CVE-2026-98093/): ASoC: fsl_micfil: balance mclk enable/disable (high 7.8)
- [CVE-2026-98092](https://insights.sbomify.com/CVE-2026-98092/): ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (medium 5.5)
- [CVE-2026-98091](https://insights.sbomify.com/CVE-2026-98091/): btrfs: detach failed sprout device from transaction update list (medium 5.5)
- [CVE-2026-98090](https://insights.sbomify.com/CVE-2026-98090/): btrfs: restore active device pointers after failed sprout (medium 5.5)
- [CVE-2026-9809](https://insights.sbomify.com/CVE-2026-9809/): Mautic has Stored Cross-Site Scripting (XSS) in Projects Component (high 7.6)
- [CVE-2026-98089](https://insights.sbomify.com/CVE-2026-98089/): bonding: alb: fix uninitialized transport header access in alb_determine_nd() (not scored)
- [CVE-2026-98088](https://insights.sbomify.com/CVE-2026-98088/): scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() (not scored)
- [CVE-2026-98087](https://insights.sbomify.com/CVE-2026-98087/): sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (not scored)
- [CVE-2026-98086](https://insights.sbomify.com/CVE-2026-98086/): ALSA: ump: do not touch legacy_rmidi before it exists (not scored)
- [CVE-2026-98085](https://insights.sbomify.com/CVE-2026-98085/): bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge (not scored)
- [CVE-2026-98084](https://insights.sbomify.com/CVE-2026-98084/): bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks (not scored)
- [CVE-2026-98083](https://insights.sbomify.com/CVE-2026-98083/): btrfs: fix transaction use-after-free in raid stripe insertion (high 7.0)
- [CVE-2026-98082](https://insights.sbomify.com/CVE-2026-98082/): btrfs: fix the possible bioc_list memory leak during error (medium 5.5)
- [CVE-2026-98081](https://insights.sbomify.com/CVE-2026-98081/): btrfs: zoned: finish active block group cleanup if call_zone_finish() fails (not scored)
- [CVE-2026-98080](https://insights.sbomify.com/CVE-2026-98080/): btrfs: do not force reloc root creation during qgroup_account_snapshot() (medium 5.5)
- [CVE-2026-9808](https://insights.sbomify.com/CVE-2026-9808/): Mautic has an Authorization Bypass in API v2 Endpoints (high 7.1)
- [CVE-2026-98079](https://insights.sbomify.com/CVE-2026-98079/): btrfs: zstd: fix lost wakeup when waiting for a workspace (not scored)
- [CVE-2026-98078](https://insights.sbomify.com/CVE-2026-98078/): ipvs: fix reversed sequence option serialization (medium 4.4)
- [CVE-2026-98077](https://insights.sbomify.com/CVE-2026-98077/): netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (not scored)
- [CVE-2026-98076](https://insights.sbomify.com/CVE-2026-98076/): tracing/probes: Fix use-after-free on field name/type of events with multiple probes (not scored)
- [CVE-2026-98075](https://insights.sbomify.com/CVE-2026-98075/): bpf: reject BPF_PSEUDO_FUNC reference to the main program (not scored)
- [CVE-2026-98074](https://insights.sbomify.com/CVE-2026-98074/): bonding: do not clear curr_active_slave prematurely when releasing all slaves (not scored)
- [CVE-2026-98073](https://insights.sbomify.com/CVE-2026-98073/): net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). (high 7.8)
- [CVE-2026-98072](https://insights.sbomify.com/CVE-2026-98072/): net/rds: use wq_has_sleeper() in release_in_xmit() (not scored)
- [CVE-2026-98071](https://insights.sbomify.com/CVE-2026-98071/): net/rds: clear cp_flags bits individually in rds_conn_path_reset() (not scored)
- [CVE-2026-98070](https://insights.sbomify.com/CVE-2026-98070/): net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() (high 8.1)
- [CVE-2026-9807](https://insights.sbomify.com/CVE-2026-9807/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-98069](https://insights.sbomify.com/CVE-2026-98069/): net/rds: acquire the fastpath locks in rds_conn_shutdown() (high 8.1)
- [CVE-2026-98068](https://insights.sbomify.com/CVE-2026-98068/): net/rds: don't let rds_conn_shutdown() consume a concurrent drop (not scored)
- [CVE-2026-98067](https://insights.sbomify.com/CVE-2026-98067/): erofs: disable LZ4 rolling decompression for now (not scored)
- [CVE-2026-98066](https://insights.sbomify.com/CVE-2026-98066/): ALSA: caiaq: Fix potential double-free at error path (not scored)
- [CVE-2026-98065](https://insights.sbomify.com/CVE-2026-98065/): bpf: Reject key-less BTF for hash maps (not scored)
- [CVE-2026-98064](https://insights.sbomify.com/CVE-2026-98064/): bpf: Fix NULL-ptr-deref when showing a void BTF type (not scored)
- [CVE-2026-98063](https://insights.sbomify.com/CVE-2026-98063/): bpf: Fix NULL-ptr-deref in btf_var_show() (not scored)
- [CVE-2026-98062](https://insights.sbomify.com/CVE-2026-98062/): bpf: Mark signal tracepoint siginfo arguments as scalar (medium 5.5)
- [CVE-2026-98061](https://insights.sbomify.com/CVE-2026-98061/): bpf: Reject tail calls directly from callback frames (not scored)
- [CVE-2026-98060](https://insights.sbomify.com/CVE-2026-98060/): bpf: Reject resilient lock operations in rbtree callbacks (not scored)
- [CVE-2026-9806](https://insights.sbomify.com/CVE-2026-9806/): Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names (medium 6.3)
- [CVE-2026-98059](https://insights.sbomify.com/CVE-2026-98059/): bpf: Mark sched_process_wait argument as nullable (medium 5.5)
- [CVE-2026-98058](https://insights.sbomify.com/CVE-2026-98058/): bpf: Mark syscall helpers as sleepable (not scored)
- [CVE-2026-98057](https://insights.sbomify.com/CVE-2026-98057/): ring-buffer: Add checking nr_subbufs to persistent ring buffer validation (not scored)
- [CVE-2026-98056](https://insights.sbomify.com/CVE-2026-98056/): nvme: remove stale namespaces by NSID range during scan (high 7.5)
- [CVE-2026-98055](https://insights.sbomify.com/CVE-2026-98055/): ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (not scored)
- [CVE-2026-98054](https://insights.sbomify.com/CVE-2026-98054/): ASoC: Intel: avs: Fix unbalanced module reference count (medium 5.5)
- [CVE-2026-98053](https://insights.sbomify.com/CVE-2026-98053/): ASoC: Intel: avs: Refactor and fix init_config access (medium 5.5)
- [CVE-2026-98052](https://insights.sbomify.com/CVE-2026-98052/): net: bcmasp: clear txcb->last before writing each descriptor (high 7.8)
- [CVE-2026-98051](https://insights.sbomify.com/CVE-2026-98051/): net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times (medium 5.5)
- [CVE-2026-98050](https://insights.sbomify.com/CVE-2026-98050/): mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context (high 7.5)
- [CVE-2026-9805](https://insights.sbomify.com/CVE-2026-9805/): FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow (low 2.7)
- [CVE-2026-98049](https://insights.sbomify.com/CVE-2026-98049/): bpf: zero extend the result of an arena 32-bit cmpxchg (medium 5.5)
- [CVE-2026-98048](https://insights.sbomify.com/CVE-2026-98048/): bpf: don't rewrite bpf_fastcall patterns entered by a jump (not scored)
- [CVE-2026-98047](https://insights.sbomify.com/CVE-2026-98047/): bpf: Check ancestor frames for rbtree callbacks (not scored)
- [CVE-2026-98046](https://insights.sbomify.com/CVE-2026-98046/): bpf: Mark bpf_btf_find_by_name_kind() as sleepable (not scored)
- [CVE-2026-98045](https://insights.sbomify.com/CVE-2026-98045/): bpf: Mark faultable stack helpers as sleepable (not scored)
- [CVE-2026-98044](https://insights.sbomify.com/CVE-2026-98044/): bpf: Reject legacy packet loads from callbacks (not scored)
- [CVE-2026-98043](https://insights.sbomify.com/CVE-2026-98043/): bpf: Don't infer non-NULL from a pointer with an unbounded offset (not scored)
- [CVE-2026-98042](https://insights.sbomify.com/CVE-2026-98042/): bpf: Don't resurrect a scalar id dropped by collect_linked_regs() (not scored)
- [CVE-2026-98041](https://insights.sbomify.com/CVE-2026-98041/): bpf: Don't predict JMP32 pointer vs zero comparisons (high 7.0)
- [CVE-2026-98040](https://insights.sbomify.com/CVE-2026-98040/): bpf: Mark the zero register precise for a register-form NULL check (not scored)
- [CVE-2026-9804](https://insights.sbomify.com/CVE-2026-9804/): Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read (high 7.7)
- [CVE-2026-98039](https://insights.sbomify.com/CVE-2026-98039/): bpf: Require MEM_PERCPU for percpu kptr stores (not scored)
- [CVE-2026-98038](https://insights.sbomify.com/CVE-2026-98038/): bpf: Keep refcount_acquire nullable for borrowed RCU kptrs (not scored)
- [CVE-2026-98037](https://insights.sbomify.com/CVE-2026-98037/): bpf: Reject untrusted allocated-object pointers (not scored)
- [CVE-2026-98036](https://insights.sbomify.com/CVE-2026-98036/): bpf: Preserve special fields in recycled rhtab elements (not scored)
- [CVE-2026-98035](https://insights.sbomify.com/CVE-2026-98035/): bpf: Cancel special fields when recycling rhtab elements (not scored)
- [CVE-2026-98034](https://insights.sbomify.com/CVE-2026-98034/): bpf: Mark NULL kptr stores precise (not scored)
- [CVE-2026-98033](https://insights.sbomify.com/CVE-2026-98033/): bpf: Preserve inner map identity in callback frames (not scored)
- [CVE-2026-98032](https://insights.sbomify.com/CVE-2026-98032/): tracing: Fix subbuf resize races with trace_pipe_raw readers (not scored)
- [CVE-2026-98031](https://insights.sbomify.com/CVE-2026-98031/): nexthop: Initialize extack in remove_nh_grp_entry() (not scored)
- [CVE-2026-98030](https://insights.sbomify.com/CVE-2026-98030/): net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (high 7.0)
- [CVE-2026-9803](https://insights.sbomify.com/CVE-2026-9803/): Keycloak: keycloak: denial of service via malformed authorization header (medium 5.3)
- [CVE-2026-98029](https://insights.sbomify.com/CVE-2026-98029/): eth: nfp: bound the ntuple rule dump by the caller's buffer size (high 7.0)
- [CVE-2026-98028](https://insights.sbomify.com/CVE-2026-98028/): eth: nfp: drop the replaced rule from the list when reprogramming fails (not scored)
- [CVE-2026-98027](https://insights.sbomify.com/CVE-2026-98027/): net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size (high 7.0)
- [CVE-2026-98026](https://insights.sbomify.com/CVE-2026-98026/): net: bridge: mcast: properly convert mglist to rcu (not scored)
- [CVE-2026-98025](https://insights.sbomify.com/CVE-2026-98025/): net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (not scored)
- [CVE-2026-98024](https://insights.sbomify.com/CVE-2026-98024/): s390/ism: folio_put() after error (not scored)
- [CVE-2026-98023](https://insights.sbomify.com/CVE-2026-98023/): vxlan: reject dynamic fdb entries that reference a nexthop id (high 7.8)
- [CVE-2026-98022](https://insights.sbomify.com/CVE-2026-98022/): net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (not scored)
- [CVE-2026-98021](https://insights.sbomify.com/CVE-2026-98021/): net: reject oversized tx_queue_len at netlink parse time (not scored)
- [CVE-2026-98020](https://insights.sbomify.com/CVE-2026-98020/): pds_core: fix cmd_regs access racing BAR unmap on reset (not scored)
- [CVE-2026-9802](https://insights.sbomify.com/CVE-2026-9802/): Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/212/