Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 218 of 1013.
- CVE-2026-97475 thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
- CVE-2026-97474 wifi: iwlwifi: mld: purge async notifications upon nic error
- CVE-2026-97473 powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()
- CVE-2026-97472 ipv6: addrconf: fix temp address generation after prefix deprecation
- CVE-2026-97471 Information disclosure in Avada (Fusion) Builder
- CVE-2026-97470 Cross-site scripting in Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
- CVE-2026-9747 Crafted cross-shard merge aggregation crashes MongoDB Server
- CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink
- CVE-2026-97468 Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
- CVE-2026-9746 Server crashes in case of the use of exchange
- CVE-2026-97456 ACPICA: Fix condition check in acpi_ps_parse_loop()
- CVE-2026-97455 ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
- CVE-2026-97454 ACPICA: add boundary checks in acpi_ps_get_next_field()
- CVE-2026-97453 ACPICA: validate byte_count in acpi_ps_get_next_package_length()
- CVE-2026-97452 ACPICA: Prevent adding invalid references
- CVE-2026-97451 ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
- CVE-2026-97450 ACPICA: validate handler object type in two places
- CVE-2026-9745 Vulnerabilities exists in IBM Netezza Software
- CVE-2026-97449 ACPICA: Add package limit checks in parser functions
- CVE-2026-97448 ACPICA: Add validation for node in acpi_ns_build_normalized_path()
- CVE-2026-97447 ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
- CVE-2026-97446 ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
- CVE-2026-97445 ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
- CVE-2026-97444 ACPICA: add boundary checks in two places
- CVE-2026-97443 perf/ftrace: Fix WARNING in __unregister_ftrace_function
- CVE-2026-97442 wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
- CVE-2026-97441 ata: ahci: fail probe if BAR too small for claimed ports
- CVE-2026-97440 net: qrtr: fix node refcount leak on ctrl packet alloc failure
- CVE-2026-9744 Vulnerabilities exists in IBM Netezza Software
- CVE-2026-97439 fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib
- CVE-2026-97438 fs/ntfs3: validate index entry key bounds
- CVE-2026-97437 ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
- CVE-2026-97436 dpaa2-switch: rework FDB management on the bridge leave path
- CVE-2026-97435 net: dsa: sja1105: flower: reject cross-chip redirect
- CVE-2026-97434 dpaa2-switch: fix handling of NAPI on the remove path
- CVE-2026-97433 nvme: validate FDP configuration descriptor sizes
- CVE-2026-97432 wifi: iwlwifi: mvm: fix P2P-Device binding handling
- CVE-2026-97431 drm/amd/display: Avoid DPMS-on for phantom stream
- CVE-2026-97430 xhci: Prevent queuing new commands if xhci is inaccessible
- CVE-2026-9743 Aggregation sub-pipeline null dereference may allow DoS via crafted getMore
- CVE-2026-97429 drm/amdkfd: fix UAF race in destroy_queue_cpsch
- CVE-2026-97428 drm/amdgpu: harden FRU PIA parsing with bounded helpers
- CVE-2026-97427 drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
- CVE-2026-97426 drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error
- CVE-2026-97425 drm/amdgpu: fix buffer overflow during vBIOS update
- CVE-2026-97424 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq
- CVE-2026-97423 cxl/region: Validate partition index before array access
- CVE-2026-97422 drm/amdkfd: fix SMI event cross-process information leak
- CVE-2026-97421 RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
- CVE-2026-97420 bpf: NUL-terminate replaced sysctl value
- CVE-2026-9742 Authenticate command with specific mechanism parameter can trigger server crash
- CVE-2026-97419 hsr: broadcast netlink notifications in the device's net namespace
- CVE-2026-97418 ALSA: es18xx: check control allocation before private data setup
- CVE-2026-97417 netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
- CVE-2026-97416 btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
- CVE-2026-97415 btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
- CVE-2026-97414 ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()
- CVE-2026-97413 RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
- CVE-2026-97412 pds_core: quiesce DMA before freeing resources
- CVE-2026-97411 net: ibm: emac: mal: fix potential system hang in mal_remove()
- CVE-2026-97410 netconsole: take target_cleanup_list_lock in drop_netconsole_target()
- CVE-2026-9741 Client side encryption fails to encrypt values in a $vectorSearch
- CVE-2026-97409 nvme-fc: Do not cancel requests in io target before it is initialized
- CVE-2026-97408 Bluetooth: L2CAP: validate connectionless PSM length
- CVE-2026-97407 ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
- CVE-2026-97406 Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
- CVE-2026-97404 Auth bypass in Zaqar
- CVE-2026-97400 XML external entity in Eclipse OpenJ9
- CVE-2026-9740 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow
- CVE-2026-97399 One-byte overread in strncasecmp on Power8
- CVE-2026-97398 Cross-site scripting in FV Flowplayer Video Player
- CVE-2026-97396 Cross-site scripting in Email Marketing for WordPress and WooCommerce – Retainful
- CVE-2026-97395 Server-side request forgery in Apache Polaris
- CVE-2026-97394 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
- CVE-2026-9739 MCP Toolbox for Databases vulnerable to DNS rebinding attacks
- CVE-2026-97381 Legacy Update ActiveX control accepts unauthorized hosting origins
- CVE-2026-97380 MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
- CVE-2026-9738 Cross-site scripting in Print, PDF & Email by PrintFriendly
- CVE-2026-97370 Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
- CVE-2026-9737 Find command with $meta sort can lead to crash
- CVE-2026-97368 chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization
- CVE-2026-97366 jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection
- CVE-2026-97365 chonkie-inc littrs lib.rs mount path traversal
- CVE-2026-97363 Monta monta.app Improper Restriction of Excessive Authentication Attempts
- CVE-2026-97362 HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread
- CVE-2026-97360 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
- CVE-2026-9736 Vulnerabilities exists in IBM Netezza Software
- CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
- CVE-2026-97354 PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects
- CVE-2026-97353 News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form
- CVE-2026-97352 News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer
- CVE-2026-9735 Keyfile contents are in MongoDB Server logs
- CVE-2026-97348 Path traversal in SiteOrigin Widgets Bundle
- CVE-2026-97347 Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
- CVE-2026-97344 Cross-site scripting in Wp Social Login and Register Social Counter
- CVE-2026-97343 Auth bypass in Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
- CVE-2026-97342 Cross-site scripting in JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-97341 Cross-site scripting in Visitor Traffic Real Time Statistics
- CVE-2026-97340 Cross-site scripting in Avada | Website Builder For WordPress & WooCommerce
- CVE-2026-9734 W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update