Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 243 of 1013.
- CVE-2026-93196 nvdimm: virtio_pmem: refcount requests for token lifetime
- CVE-2026-93195 drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
- CVE-2026-93194 drm/rockchip: dw_dp: Release core resources
- CVE-2026-93193 drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup
- CVE-2026-93192 drm/v3d: Clear queue->active_job when v3d_fence_create() fails
- CVE-2026-93191 smack: fix incorrect task context in smack_msg_queue_msgrcv
- CVE-2026-93190 platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
- CVE-2026-9319 IBM WebSphere Application Server is affected by a remote code execution vulnerability
- CVE-2026-93189 HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
- CVE-2026-93188 HID: roccat: bound device-supplied profile index
- CVE-2026-93187 ASoC: SOF: ipc4-topology: Return error for invalid number of formats
- CVE-2026-93186 cxl/mbox: Clamp mailbox output allocation to the payload size
- CVE-2026-93185 ASoC: rt700-sdw: always drain jack work on remove
- CVE-2026-93184 ASoC: fsl_audmix: rework runtime PM handling in probe
- CVE-2026-93183 drm/lima: call drm_mm_init() with a valid allocation range
- CVE-2026-93182 sched/fair: Fix overflow in update_tg_cfs_runnable()
- CVE-2026-93181 perf/x86/intel/uncore: Fix uncore_box ref/unref ordering
- CVE-2026-93180 drm/panthor: Fix NPD issue on partial unmap of an evicted BO
- CVE-2026-9318 tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title
- CVE-2026-93179 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
- CVE-2026-93178 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
- CVE-2026-93177 drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
- CVE-2026-93176 drm/amd/display: Fix dangling pointer in plane reset function
- CVE-2026-93175 drm/amd/display: Fix dangling pointer in CRTC reset function
- CVE-2026-93174 bpf: Copy per-CPU map value padding in copy_map_value_long()
- CVE-2026-93173 bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks
- CVE-2026-93172 mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
- CVE-2026-93171 leds: lp5860: Fix a potential double-unlock
- CVE-2026-93170 dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
- CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server
- CVE-2026-93169 dmaengine: zynqmp_dma: fix race between runtime PM and device removal
- CVE-2026-93168 dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
- CVE-2026-93167 csky: Fix a4/a5 restoration in syscall trace path
- CVE-2026-93166 wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()
- CVE-2026-93165 platform/chrome: sensorhub: Fix memory overread in ring handler
- CVE-2026-93164 uprobes/x86: Move optimized uprobe from nop5 to nop10
- CVE-2026-93163 hwrng: core - fix rng list on registration error
- CVE-2026-93162 crypto: qat - cancel work on re-enable SR-IOV timeout
- CVE-2026-93161 crypto: qat - clear AES key schedule from stack
- CVE-2026-93160 crypto: atmel-ecc - reject hardware ECDH without a public key
- CVE-2026-93159 crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
- CVE-2026-93158 crypto: sa2ul - stop probe if context pool creation fails
- CVE-2026-93157 hwrng: xilinx-trng - propagate timeout before any data is read
- CVE-2026-93156 crypto: rk3288 - fail ahash requests on HASH idle timeout
- CVE-2026-93155 crypto: keembay - Fix AEAD unregister count in error path
- CVE-2026-93154 RDMA/irdma: Add refcounting to user ring MRs
- CVE-2026-93153 RDMA/bng_re: return a timeout when firmware responses stall
- CVE-2026-93152 nvme-apple: Use acquire/release for queue enabled state
- CVE-2026-93151 nvmet-rdma: fix response resource leak on queue teardown
- CVE-2026-93150 cgroup/cpuset: Make nr_deadline_tasks an atomic_t
- CVE-2026-93149 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
- CVE-2026-93148 bpf: Reject MEM_ALLOC BTF accesses past object bounds
- CVE-2026-93147 s390/bpf: Replace ly instruction with llgf
- CVE-2026-93146 time/namespace: Validate nanosecond field in proc_timens_set_offset()
- CVE-2026-93145 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
- CVE-2026-93144 bpf: Reject writes through untrusted BTF pointers
- CVE-2026-93143 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
- CVE-2026-93142 thermal/drivers/rcar: Fix error checking in probe()
- CVE-2026-93141 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
- CVE-2026-93140 udf: Mark LVID buffer as uptodate before marking it dirty
- CVE-2026-93139 drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC
- CVE-2026-93138 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
- CVE-2026-93137 bpf: Fix use-after-free on mm_struct in bpf_find_vma()
- CVE-2026-93136 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
- CVE-2026-93135 bpf: Reject programs with inlined helpers if JIT is not available
- CVE-2026-93134 printk: Fix possible console use-after-free
- CVE-2026-93133 ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()
- CVE-2026-93132 ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling
- CVE-2026-93131 platform/x86: dell-privacy: Fix race condition
- CVE-2026-93130 platform/x86: dell-wmi-base: Fix resource leak on module load failure
- CVE-2026-93129 platform/x86: dell-wmi-base: Fix handling of ultra performance key
- CVE-2026-93128 platform/x86: lg-laptop: Fix LED resource handling
- CVE-2026-93127 bpf: Drop scalar id on sign-extending narrowing stack fills
- CVE-2026-93126 remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
- CVE-2026-93125 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
- CVE-2026-93124 platform/x86: asus-wireless: Fail probe when there is no ACPI match
- CVE-2026-93123 serial: qcom-geni: do not advance stale DMA completions
- CVE-2026-93122 usb: gadget: uac: validate rate list length before storing
- CVE-2026-93121 usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
- CVE-2026-93120 usb: gadget: configfs: fix out-of-bounds read of qw_sign
- CVE-2026-9312 Server-side request forgery in Enterprise Server
- CVE-2026-93119 usb: ljca: bound bank_num in ljca_enumerate_gpio()
- CVE-2026-93118 usb: gadget: aspeed_udc: check endpoint DMA allocation
- CVE-2026-93117 usb: fix UAF when probe runs concurrent to dyn ID removal
- CVE-2026-93116 platform/x86: asus-wmi: fix resource leaks on probe failure
- CVE-2026-93115 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
- CVE-2026-93114 platform/surface: acpi-notify: Check ACPI companion before use
- CVE-2026-93113 clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
- CVE-2026-93112 bpf: Require a BPF cpumask for bpf_cpumask_populate()
- CVE-2026-93111 bpf: Mark tracing_multi trampolines as ftrace managed
- CVE-2026-93110 RDMA/core: Wait for RCU callbacks before unloading ib_core
- CVE-2026-9311 IBM WebSphere Application Server is affected by remote code execution
- CVE-2026-93109 RDMA/mlx5: Drain RCU callbacks during module teardown
- CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown
- CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
- CVE-2026-93106 crash_dump: release keyring reference at the correct time
- CVE-2026-93105 esp: do not unref managed frag pages in esp_ssg_unref()
- CVE-2026-93104 RDMA/rvt: Return NULL after port allocation failure
- CVE-2026-93103 RDMA/hfi1: Preserve unit 0 on allocation failure
- CVE-2026-93102 RDMA/hfi1: Free RX data on late probe failure