# Vulnerabilities published in 2026


- [CVE-2026-93818](https://insights.sbomify.com/CVE-2026-93818/): PCI: plda: Protect root bus removal with rescan lock (not scored)
- [CVE-2026-93817](https://insights.sbomify.com/CVE-2026-93817/): perf: Fix addr_filter_ranges lifetime (high 7.8)
- [CVE-2026-93816](https://insights.sbomify.com/CVE-2026-93816/): f2fs: validate inline dentry name lengths before conversion (high 7.1)
- [CVE-2026-93815](https://insights.sbomify.com/CVE-2026-93815/): net: au1000: move free_irq out of the close-time spinlocked section (not scored)
- [CVE-2026-93814](https://insights.sbomify.com/CVE-2026-93814/): spi: core: Abort active target transfer on controller suspend (not scored)
- [CVE-2026-93813](https://insights.sbomify.com/CVE-2026-93813/): btrfs: tree-checker: validate INODE_REF's namelen (high 7.8)
- [CVE-2026-93812](https://insights.sbomify.com/CVE-2026-93812/): ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr (not scored)
- [CVE-2026-93811](https://insights.sbomify.com/CVE-2026-93811/): ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling (not scored)
- [CVE-2026-93810](https://insights.sbomify.com/CVE-2026-93810/): cachefiles: Fix double fput (high 7.0)
- [CVE-2026-9381](https://insights.sbomify.com/CVE-2026-9381/): Edimax BR-6675nD POST Request formPPPoESetup buffer overflow (high 8.7)
- [CVE-2026-93809](https://insights.sbomify.com/CVE-2026-93809/): drm/amdgpu: flush pending RCU callbacks on module unload (not scored)
- [CVE-2026-93808](https://insights.sbomify.com/CVE-2026-93808/): ALSA: usb-audio: caiaq: validate EP1 reply lengths (not scored)
- [CVE-2026-93807](https://insights.sbomify.com/CVE-2026-93807/): wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (not scored)
- [CVE-2026-93806](https://insights.sbomify.com/CVE-2026-93806/): wifi: cfg80211: validate assoc response length before status and IE access (high 8.8)
- [CVE-2026-93805](https://insights.sbomify.com/CVE-2026-93805/): wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (not scored)
- [CVE-2026-93804](https://insights.sbomify.com/CVE-2026-93804/): wifi: mac80211: ibss: wait for in-flight TX on disconnect (not scored)
- [CVE-2026-93803](https://insights.sbomify.com/CVE-2026-93803/): wifi: libipw: fix key index receive bound checks (not scored)
- [CVE-2026-93802](https://insights.sbomify.com/CVE-2026-93802/): wifi: rsi: validate beacon length before fixed buffer copy (not scored)
- [CVE-2026-93801](https://insights.sbomify.com/CVE-2026-93801/): smb/client: zero-initialize stack-allocated cifs_open_info_data (high 7.0)
- [CVE-2026-93800](https://insights.sbomify.com/CVE-2026-93800/): btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (not scored)
- [CVE-2026-9380](https://insights.sbomify.com/CVE-2026-9380/): Edimax BR-6675nD POST Request formL2TPSetup buffer overflow (high 8.7)
- [CVE-2026-93799](https://insights.sbomify.com/CVE-2026-93799/): wifi: iwlwifi: mvm: validate sta_id in BA window status notif (high 8.8)
- [CVE-2026-93798](https://insights.sbomify.com/CVE-2026-93798/): btrfs: fix reloc root cleanup in merge_reloc_roots() (high 7.8)
- [CVE-2026-93797](https://insights.sbomify.com/CVE-2026-93797/): wifi: iwlwifi: mvm: fix an off-by-1 boundary check (not scored)
- [CVE-2026-93796](https://insights.sbomify.com/CVE-2026-93796/): wifi: iwlwifi: pcie: null RX pointers after free (high 7.0)
- [CVE-2026-93795](https://insights.sbomify.com/CVE-2026-93795/): blk-cgroup: fix leaks and online flag on radix_tree_insert failure (not scored)
- [CVE-2026-93794](https://insights.sbomify.com/CVE-2026-93794/): smb/client: flush dirty data before punching a hole (not scored)
- [CVE-2026-93793](https://insights.sbomify.com/CVE-2026-93793/): wifi: iwlwifi: mvm: validate TX_CMD response layout (high 8.8)
- [CVE-2026-93792](https://insights.sbomify.com/CVE-2026-93792/): wifi: iwlwifi: mvm: fix a possible underflow (not scored)
- [CVE-2026-93791](https://insights.sbomify.com/CVE-2026-93791/): wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (not scored)
- [CVE-2026-93790](https://insights.sbomify.com/CVE-2026-93790/): wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (high 8.8)
- [CVE-2026-9379](https://insights.sbomify.com/CVE-2026-9379/): Edimax BR-6675nD POST Request formWpsStart command injection (medium 5.3)
- [CVE-2026-93789](https://insights.sbomify.com/CVE-2026-93789/): wifi: iwlwifi: bound aligned TLV advance in FW parser (not scored)
- [CVE-2026-93788](https://insights.sbomify.com/CVE-2026-93788/): wifi: iwlwifi: acpi: validate WGDS table revision index (not scored)
- [CVE-2026-93787](https://insights.sbomify.com/CVE-2026-93787/): smb: client: bound dirent name against end of SMB response in cifs_filldir (high 8.1)
- [CVE-2026-93786](https://insights.sbomify.com/CVE-2026-93786/): ksmbd: preserve VFS inherited POSIX ACL mask (high 8.1)
- [CVE-2026-93785](https://insights.sbomify.com/CVE-2026-93785/): cifs: validate idmap key payload length (not scored)
- [CVE-2026-93784](https://insights.sbomify.com/CVE-2026-93784/): wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (not scored)
- [CVE-2026-93783](https://insights.sbomify.com/CVE-2026-93783/): Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (not scored)
- [CVE-2026-93782](https://insights.sbomify.com/CVE-2026-93782/): vhost-scsi: flush backend after device ioctls (high 7.8)
- [CVE-2026-93781](https://insights.sbomify.com/CVE-2026-93781/): scsi: core: Do not block on tag allocation in scsi_eh_lock_door() (not scored)
- [CVE-2026-9378](https://insights.sbomify.com/CVE-2026-9378/): Edimax BR-6675nD POST Request formHwSet command injection (medium 5.3)
- [CVE-2026-93778](https://insights.sbomify.com/CVE-2026-93778/): Cross-site scripting in WP Yelp Review Slider (high 7.2)
- [CVE-2026-93775](https://insights.sbomify.com/CVE-2026-93775/): Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook (high 7.2)
- [CVE-2026-93774](https://insights.sbomify.com/CVE-2026-93774/): WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-93773](https://insights.sbomify.com/CVE-2026-93773/): WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-93772](https://insights.sbomify.com/CVE-2026-93772/): WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-93771](https://insights.sbomify.com/CVE-2026-93771/): WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-93770](https://insights.sbomify.com/CVE-2026-93770/): WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9377](https://insights.sbomify.com/CVE-2026-9377/): SourceCodester SUP Online Shopping productedit.php cross site scripting (medium 4.8)
- [CVE-2026-93769](https://insights.sbomify.com/CVE-2026-93769/): Cross-site scripting in Humhub (high 7.2)
- [CVE-2026-93767](https://insights.sbomify.com/CVE-2026-93767/): Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter (medium 6.5)
- [CVE-2026-93765](https://insights.sbomify.com/CVE-2026-93765/): Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation (high 8.3)
- [CVE-2026-93764](https://insights.sbomify.com/CVE-2026-93764/): Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation (high 7.1)
- [CVE-2026-93763](https://insights.sbomify.com/CVE-2026-93763/): Silent plaintext persistence via unresolved callable database name in encryption schema map (high 7.1)
- [CVE-2026-93762](https://insights.sbomify.com/CVE-2026-93762/): Data deletion and attribute disclosure via field-name method injection in in-memory queries (critical 9.2)
- [CVE-2026-93761](https://insights.sbomify.com/CVE-2026-93761/): Denial of service via unbounded regex matching in Mongoid's in-memory query matcher (high 8.7)
- [CVE-2026-93760](https://insights.sbomify.com/CVE-2026-93760/): NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard (high 8.3)
- [CVE-2026-9376](https://insights.sbomify.com/CVE-2026-9376/): JPress UCenter Article Submission Endpoint doWriteSave improper authorization (medium 5.3)
- [CVE-2026-93759](https://insights.sbomify.com/CVE-2026-93759/): Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist (high 8.8)
- [CVE-2026-93758](https://insights.sbomify.com/CVE-2026-93758/): Cross-principal document update, theft, and deletion via unvalidated id in nested attributes (high 8.6)
- [CVE-2026-93757](https://insights.sbomify.com/CVE-2026-93757/): Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite (high 7.5)
- [CVE-2026-93756](https://insights.sbomify.com/CVE-2026-93756/): Cross-site scripting in Smash Balloon Social Post Feed – Simple Social Feeds for WordPress (high 7.2)
- [CVE-2026-93753](https://insights.sbomify.com/CVE-2026-93753/): deepmerge through 4.3.1 Prototype Poisoning via mergeObject (high 8.7)
- [CVE-2026-93752](https://insights.sbomify.com/CVE-2026-93752/): CSSOM through 0.5.0 Denial of Service via length Property (high 8.7)
- [CVE-2026-93751](https://insights.sbomify.com/CVE-2026-93751/): uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars (medium 6.9)
- [CVE-2026-93750](https://insights.sbomify.com/CVE-2026-93750/): http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard (high 8.2)
- [CVE-2026-93749](https://insights.sbomify.com/CVE-2026-93749/): source-map-js through 1.2.1 Event Loop Denial of Service (high 8.7)
- [CVE-2026-93748](https://insights.sbomify.com/CVE-2026-93748/): http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale (high 8.7)
- [CVE-2026-93747](https://insights.sbomify.com/CVE-2026-93747/): wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field (medium 6.4)
- [CVE-2026-93746](https://insights.sbomify.com/CVE-2026-93746/): Missing authorization in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels (high 7.5)
- [CVE-2026-93744](https://insights.sbomify.com/CVE-2026-93744/): IBM i Improper Authentication (medium 6.5)
- [CVE-2026-93742](https://insights.sbomify.com/CVE-2026-93742/): Totolink A3002MU formWsc command injection (critical 9.4)
- [CVE-2026-93741](https://insights.sbomify.com/CVE-2026-93741/): Totolink A3002MU formWlWds buffer overflow (critical 10.0)
- [CVE-2026-93740](https://insights.sbomify.com/CVE-2026-93740/): Totolink A3002MU formWlEncrypt buffer overflow (critical 10.0)
- [CVE-2026-9374](https://insights.sbomify.com/CVE-2026-9374/): yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload (medium 5.3)
- [CVE-2026-93739](https://insights.sbomify.com/CVE-2026-93739/): Totolink A3002MU formWlAc buffer overflow (critical 9.4)
- [CVE-2026-93738](https://insights.sbomify.com/CVE-2026-93738/): Totolink A3002MU formSchedule buffer overflow (critical 9.4)
- [CVE-2026-93737](https://insights.sbomify.com/CVE-2026-93737/): Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet (high 7.1)
- [CVE-2026-93736](https://insights.sbomify.com/CVE-2026-93736/): Mealie before 3.21.0 Information Disclosure via Ratings Endpoint (medium 5.3)
- [CVE-2026-9373](https://insights.sbomify.com/CVE-2026-9373/): JeecgBoot OpenAPI Endpoint call improper authentication (medium 6.3)
- [CVE-2026-9372](https://insights.sbomify.com/CVE-2026-9372/): ItzCrazyKns Vane Model Provider API route.ts server-side request forgery (medium 6.9)
- [CVE-2026-93712](https://insights.sbomify.com/CVE-2026-93712/): Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. (high 7.5)
- [CVE-2026-93711](https://insights.sbomify.com/CVE-2026-93711/): Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array (medium 6.5)
- [CVE-2026-93710](https://insights.sbomify.com/CVE-2026-93710/): Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. (high 7.5)
- [CVE-2026-9371](https://insights.sbomify.com/CVE-2026-9371/): ItzCrazyKns Vane API route.ts missing authentication (medium 6.3)
- [CVE-2026-93709](https://insights.sbomify.com/CVE-2026-93709/): Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. (medium 5.3)
- [CVE-2026-9370](https://insights.sbomify.com/CVE-2026-9370/): ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt (medium 6.3)
- [CVE-2026-93699](https://insights.sbomify.com/CVE-2026-93699/): Command injection in WP Toolkit (high 8.5)
- [CVE-2026-93698](https://insights.sbomify.com/CVE-2026-93698/): Command injection in WP Squared (critical 9.9)
- [CVE-2026-93697](https://insights.sbomify.com/CVE-2026-93697/): Cross-site scripting in WP Squared (critical 9.0)
- [CVE-2026-93695](https://insights.sbomify.com/CVE-2026-93695/): Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService (high 7.4)
- [CVE-2026-93694](https://insights.sbomify.com/CVE-2026-93694/): Server-side request forgery in ShareFile Storage Zones Controller (medium 4.0)
- [CVE-2026-93693](https://insights.sbomify.com/CVE-2026-93693/): Server-side request forgery in ShareFile Storage Zones Controller (medium 6.5)
- [CVE-2026-93690](https://insights.sbomify.com/CVE-2026-93690/): uri-js through 4.4.1 Denial of Service via removeDotSegments (high 8.7)
- [CVE-2026-9369](https://insights.sbomify.com/CVE-2026-9369/): NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparison (medium 4.8)
- [CVE-2026-93689](https://insights.sbomify.com/CVE-2026-93689/): WinFsp through 2.2.26215 NULL Pointer Dereference via Fast I/O (medium 6.8)
- [CVE-2026-93688](https://insights.sbomify.com/CVE-2026-93688/): SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room (high 8.7)
- [CVE-2026-93687](https://insights.sbomify.com/CVE-2026-93687/): braces through 3.0.3 Stack Overflow via Deeply Nested Patterns (high 8.7)
- [CVE-2026-93685](https://insights.sbomify.com/CVE-2026-93685/): Information disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/238/