# Vulnerabilities published in 2026


- [CVE-2026-97475](https://insights.sbomify.com/CVE-2026-97475/): thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (not scored)
- [CVE-2026-97474](https://insights.sbomify.com/CVE-2026-97474/): wifi: iwlwifi: mld: purge async notifications upon nic error (high 7.4)
- [CVE-2026-97473](https://insights.sbomify.com/CVE-2026-97473/): powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked() (not scored)
- [CVE-2026-97472](https://insights.sbomify.com/CVE-2026-97472/): ipv6: addrconf: fix temp address generation after prefix deprecation (not scored)
- [CVE-2026-97471](https://insights.sbomify.com/CVE-2026-97471/): Information disclosure in Avada (Fusion) Builder (medium 5.3)
- [CVE-2026-97470](https://insights.sbomify.com/CVE-2026-97470/): Cross-site scripting in Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental (medium 6.4)
- [CVE-2026-9747](https://insights.sbomify.com/CVE-2026-9747/): Crafted cross-shard merge aggregation crashes MongoDB Server (high 7.1)
- [CVE-2026-97469](https://insights.sbomify.com/CVE-2026-97469/): PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink (medium 4.3)
- [CVE-2026-97468](https://insights.sbomify.com/CVE-2026-97468/): Apache CXF: Authentication bypass via weak cache keys for validated STS tokens (critical 9.1)
- [CVE-2026-9746](https://insights.sbomify.com/CVE-2026-9746/): Server crashes in case of the use of exchange (high 7.1)
- [CVE-2026-97456](https://insights.sbomify.com/CVE-2026-97456/): ACPICA: Fix condition check in acpi_ps_parse_loop() (not scored)
- [CVE-2026-97455](https://insights.sbomify.com/CVE-2026-97455/): ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (high 8.4)
- [CVE-2026-97454](https://insights.sbomify.com/CVE-2026-97454/): ACPICA: add boundary checks in acpi_ps_get_next_field() (high 7.7)
- [CVE-2026-97453](https://insights.sbomify.com/CVE-2026-97453/): ACPICA: validate byte_count in acpi_ps_get_next_package_length() (not scored)
- [CVE-2026-97452](https://insights.sbomify.com/CVE-2026-97452/): ACPICA: Prevent adding invalid references (high 8.4)
- [CVE-2026-97451](https://insights.sbomify.com/CVE-2026-97451/): ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (high 8.4)
- [CVE-2026-97450](https://insights.sbomify.com/CVE-2026-97450/): ACPICA: validate handler object type in two places (high 8.4)
- [CVE-2026-9745](https://insights.sbomify.com/CVE-2026-9745/): Vulnerabilities exists in IBM Netezza Software (medium 6.5)
- [CVE-2026-97449](https://insights.sbomify.com/CVE-2026-97449/): ACPICA: Add package limit checks in parser functions (not scored)
- [CVE-2026-97448](https://insights.sbomify.com/CVE-2026-97448/): ACPICA: Add validation for node in acpi_ns_build_normalized_path() (high 7.7)
- [CVE-2026-97447](https://insights.sbomify.com/CVE-2026-97447/): ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (not scored)
- [CVE-2026-97446](https://insights.sbomify.com/CVE-2026-97446/): ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (not scored)
- [CVE-2026-97445](https://insights.sbomify.com/CVE-2026-97445/): ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (high 7.7)
- [CVE-2026-97444](https://insights.sbomify.com/CVE-2026-97444/): ACPICA: add boundary checks in two places (high 7.7)
- [CVE-2026-97443](https://insights.sbomify.com/CVE-2026-97443/): perf/ftrace: Fix WARNING in __unregister_ftrace_function (not scored)
- [CVE-2026-97442](https://insights.sbomify.com/CVE-2026-97442/): wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (high 8.8)
- [CVE-2026-97441](https://insights.sbomify.com/CVE-2026-97441/): ata: ahci: fail probe if BAR too small for claimed ports (not scored)
- [CVE-2026-97440](https://insights.sbomify.com/CVE-2026-97440/): net: qrtr: fix node refcount leak on ctrl packet alloc failure (not scored)
- [CVE-2026-9744](https://insights.sbomify.com/CVE-2026-9744/): Vulnerabilities exists in IBM Netezza Software (medium 5.3)
- [CVE-2026-97439](https://insights.sbomify.com/CVE-2026-97439/): fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib (not scored)
- [CVE-2026-97438](https://insights.sbomify.com/CVE-2026-97438/): fs/ntfs3: validate index entry key bounds (high 7.1)
- [CVE-2026-97437](https://insights.sbomify.com/CVE-2026-97437/): ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() (high 7.1)
- [CVE-2026-97436](https://insights.sbomify.com/CVE-2026-97436/): dpaa2-switch: rework FDB management on the bridge leave path (not scored)
- [CVE-2026-97435](https://insights.sbomify.com/CVE-2026-97435/): net: dsa: sja1105: flower: reject cross-chip redirect (not scored)
- [CVE-2026-97434](https://insights.sbomify.com/CVE-2026-97434/): dpaa2-switch: fix handling of NAPI on the remove path (not scored)
- [CVE-2026-97433](https://insights.sbomify.com/CVE-2026-97433/): nvme: validate FDP configuration descriptor sizes (high 8.2)
- [CVE-2026-97432](https://insights.sbomify.com/CVE-2026-97432/): wifi: iwlwifi: mvm: fix P2P-Device binding handling (not scored)
- [CVE-2026-97431](https://insights.sbomify.com/CVE-2026-97431/): drm/amd/display: Avoid DPMS-on for phantom stream (not scored)
- [CVE-2026-97430](https://insights.sbomify.com/CVE-2026-97430/): xhci: Prevent queuing new commands if xhci is inaccessible (not scored)
- [CVE-2026-9743](https://insights.sbomify.com/CVE-2026-9743/): Aggregation sub-pipeline null dereference may allow DoS via crafted getMore (high 7.1)
- [CVE-2026-97429](https://insights.sbomify.com/CVE-2026-97429/): drm/amdkfd: fix UAF race in destroy_queue_cpsch (high 7.8)
- [CVE-2026-97428](https://insights.sbomify.com/CVE-2026-97428/): drm/amdgpu: harden FRU PIA parsing with bounded helpers (high 7.7)
- [CVE-2026-97427](https://insights.sbomify.com/CVE-2026-97427/): drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (not scored)
- [CVE-2026-97426](https://insights.sbomify.com/CVE-2026-97426/): drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error (not scored)
- [CVE-2026-97425](https://insights.sbomify.com/CVE-2026-97425/): drm/amdgpu: fix buffer overflow during vBIOS update (not scored)
- [CVE-2026-97424](https://insights.sbomify.com/CVE-2026-97424/): drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq (not scored)
- [CVE-2026-97423](https://insights.sbomify.com/CVE-2026-97423/): cxl/region: Validate partition index before array access (not scored)
- [CVE-2026-97422](https://insights.sbomify.com/CVE-2026-97422/): drm/amdkfd: fix SMI event cross-process information leak (not scored)
- [CVE-2026-97421](https://insights.sbomify.com/CVE-2026-97421/): RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (high 7.8)
- [CVE-2026-97420](https://insights.sbomify.com/CVE-2026-97420/): bpf: NUL-terminate replaced sysctl value (not scored)
- [CVE-2026-9742](https://insights.sbomify.com/CVE-2026-9742/): Authenticate command with specific mechanism parameter can trigger server crash (high 8.2)
- [CVE-2026-97419](https://insights.sbomify.com/CVE-2026-97419/): hsr: broadcast netlink notifications in the device's net namespace (not scored)
- [CVE-2026-97418](https://insights.sbomify.com/CVE-2026-97418/): ALSA: es18xx: check control allocation before private data setup (not scored)
- [CVE-2026-97417](https://insights.sbomify.com/CVE-2026-97417/): netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (high 7.5)
- [CVE-2026-97416](https://insights.sbomify.com/CVE-2026-97416/): btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (not scored)
- [CVE-2026-97415](https://insights.sbomify.com/CVE-2026-97415/): btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (high 7.8)
- [CVE-2026-97414](https://insights.sbomify.com/CVE-2026-97414/): ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (not scored)
- [CVE-2026-97413](https://insights.sbomify.com/CVE-2026-97413/): RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (critical 9.8)
- [CVE-2026-97412](https://insights.sbomify.com/CVE-2026-97412/): pds_core: quiesce DMA before freeing resources (not scored)
- [CVE-2026-97411](https://insights.sbomify.com/CVE-2026-97411/): net: ibm: emac: mal: fix potential system hang in mal_remove() (not scored)
- [CVE-2026-97410](https://insights.sbomify.com/CVE-2026-97410/): netconsole: take target_cleanup_list_lock in drop_netconsole_target() (not scored)
- [CVE-2026-9741](https://insights.sbomify.com/CVE-2026-9741/): Client side encryption fails to encrypt values in a $vectorSearch (high 7.1)
- [CVE-2026-97409](https://insights.sbomify.com/CVE-2026-97409/): nvme-fc: Do not cancel requests in io target before it is initialized (high 8.8)
- [CVE-2026-97408](https://insights.sbomify.com/CVE-2026-97408/): Bluetooth: L2CAP: validate connectionless PSM length (not scored)
- [CVE-2026-97407](https://insights.sbomify.com/CVE-2026-97407/): ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (not scored)
- [CVE-2026-97406](https://insights.sbomify.com/CVE-2026-97406/): Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting (critical 9.1)
- [CVE-2026-97404](https://insights.sbomify.com/CVE-2026-97404/): Auth bypass in Zaqar (critical 9.2)
- [CVE-2026-97400](https://insights.sbomify.com/CVE-2026-97400/): XML external entity in Eclipse OpenJ9 (medium 6.8)
- [CVE-2026-9740](https://insights.sbomify.com/CVE-2026-9740/): Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow (high 8.7)
- [CVE-2026-97399](https://insights.sbomify.com/CVE-2026-97399/): One-byte overread in strncasecmp on Power8 (low 3.7)
- [CVE-2026-97398](https://insights.sbomify.com/CVE-2026-97398/): Cross-site scripting in FV Flowplayer Video Player (high 7.2)
- [CVE-2026-97396](https://insights.sbomify.com/CVE-2026-97396/): Cross-site scripting in Email Marketing for WordPress and WooCommerce – Retainful (medium 6.4)
- [CVE-2026-97395](https://insights.sbomify.com/CVE-2026-97395/): Server-side request forgery in Apache Polaris (high 8.1)
- [CVE-2026-97394](https://insights.sbomify.com/CVE-2026-97394/): kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items (high 7.5)
- [CVE-2026-9739](https://insights.sbomify.com/CVE-2026-9739/): MCP Toolbox for Databases vulnerable to DNS rebinding attacks (critical 9.4)
- [CVE-2026-97381](https://insights.sbomify.com/CVE-2026-97381/): Legacy Update ActiveX control accepts unauthorized hosting origins (critical 9.9)
- [CVE-2026-97380](https://insights.sbomify.com/CVE-2026-97380/): MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges (high 8.8)
- [CVE-2026-9738](https://insights.sbomify.com/CVE-2026-9738/): Cross-site scripting in Print, PDF & Email by PrintFriendly (medium 4.4)
- [CVE-2026-97370](https://insights.sbomify.com/CVE-2026-97370/): Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction (high 7.5)
- [CVE-2026-9737](https://insights.sbomify.com/CVE-2026-9737/): Find command with $meta sort can lead to crash (high 7.1)
- [CVE-2026-97368](https://insights.sbomify.com/CVE-2026-97368/): chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization (medium 5.3)
- [CVE-2026-97366](https://insights.sbomify.com/CVE-2026-97366/): jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection (medium 5.3)
- [CVE-2026-97365](https://insights.sbomify.com/CVE-2026-97365/): chonkie-inc littrs lib.rs mount path traversal (medium 5.3)
- [CVE-2026-97363](https://insights.sbomify.com/CVE-2026-97363/): Monta monta.app Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-97362](https://insights.sbomify.com/CVE-2026-97362/): HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread (high 8.7)
- [CVE-2026-97360](https://insights.sbomify.com/CVE-2026-97360/): HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine (critical 10.0)
- [CVE-2026-9736](https://insights.sbomify.com/CVE-2026-9736/): Vulnerabilities exists in IBM Netezza Software (medium 5.3)
- [CVE-2026-97359](https://insights.sbomify.com/CVE-2026-97359/): HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection (critical 10.0)
- [CVE-2026-97354](https://insights.sbomify.com/CVE-2026-97354/): PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects (medium 4.1)
- [CVE-2026-97353](https://insights.sbomify.com/CVE-2026-97353/): News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form (medium 5.4)
- [CVE-2026-97352](https://insights.sbomify.com/CVE-2026-97352/): News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer (medium 4.3)
- [CVE-2026-9735](https://insights.sbomify.com/CVE-2026-9735/): Keyfile contents are in MongoDB Server logs (medium 6.8)
- [CVE-2026-97348](https://insights.sbomify.com/CVE-2026-97348/): Path traversal in SiteOrigin Widgets Bundle (medium 6.5)
- [CVE-2026-97347](https://insights.sbomify.com/CVE-2026-97347/): Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header (high 7.2)
- [CVE-2026-97344](https://insights.sbomify.com/CVE-2026-97344/): Cross-site scripting in Wp Social Login and Register Social Counter (medium 6.4)
- [CVE-2026-97343](https://insights.sbomify.com/CVE-2026-97343/): Auth bypass in Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (medium 4.3)
- [CVE-2026-97342](https://insights.sbomify.com/CVE-2026-97342/): Cross-site scripting in JetFormBuilder — Dynamic Blocks Form Builder (high 7.2)
- [CVE-2026-97341](https://insights.sbomify.com/CVE-2026-97341/): Cross-site scripting in Visitor Traffic Real Time Statistics (high 7.2)
- [CVE-2026-97340](https://insights.sbomify.com/CVE-2026-97340/): Cross-site scripting in Avada | Website Builder For WordPress & WooCommerce (medium 6.4)
- [CVE-2026-9734](https://insights.sbomify.com/CVE-2026-9734/): W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/218/