Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 244 of 1013.
- CVE-2026-93101 media: v4l2-async: Unregister sub-device if asc_list is empty
- CVE-2026-93100 fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
- CVE-2026-93099 fs/resctrl: Fix UAF from worker threads when domains are removed
- CVE-2026-93098 rpmsg: glink: fix deadlock in endpoint destroy during driver detach
- CVE-2026-93097 cxl/mbox: Break poison list loop on an empty payload
- CVE-2026-93096 cxl/features: Serialize multi-part Get/Set Feature transfers
- CVE-2026-93095 hfsplus: validate thread record before delete key rebuild
- CVE-2026-93094 wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback
- CVE-2026-93093 firmware: arm_scmi: Publish channel state before callbacks
- CVE-2026-93092 firmware: arm_scmi: Unregister device notifier before IDR teardown
- CVE-2026-93091 firmware: arm_scmi: Quiesce notifications before teardown
- CVE-2026-93090 firmware: arm_scmi: Clean up channels on setup failure
- CVE-2026-9309 Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection
- CVE-2026-93089 firmware: arm_scmi: Free transport channel on IDR failure
- CVE-2026-93088 CVE-2026-93088
- CVE-2026-93086 firmware: arm_scmi: Avoid IDR updates while cleaning channels
- CVE-2026-93085 firmware: arm_scmi: Reject out of range DT protocol IDs
- CVE-2026-93084 firmware: arm_scmi: Drop handle on protocol bind failures
- CVE-2026-93083 firmware: arm_scmi: Unwind TX receiver mailbox setup failure
- CVE-2026-93082 firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
- CVE-2026-93081 firmware: arm_scmi: Fix SCMI device destroy lifetimes
- CVE-2026-93080 firmware: arm_scmi: Fix transport device teardown lookup
- CVE-2026-9308 Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order
- CVE-2026-93079 cxl/features: Reject Get Feature count larger than the output buffer
- CVE-2026-93078 cxl/features: Reject Set Features output buffer smaller than the header
- CVE-2026-93077 cxl/features: Clamp Get Feature output size to the remaining buffer
- CVE-2026-93076 dax/fsdev: clear vmemmap_shift when binding static pgmap
- CVE-2026-93075 dax/fsdev: clear pgmap ops and owner on unbind
- CVE-2026-93074 dax/fsdev: use __va(phys) for kaddr in direct_access
- CVE-2026-93073 dax: read holder_ops once in dax_holder_notify_failure()
- CVE-2026-93072 irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
- CVE-2026-93071 media: bcm2835-unicam: Fix asc leaked in error/remove path
- CVE-2026-93070 media: ipu6: Do not free aux device pdata after init
- CVE-2026-9307 Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities
- CVE-2026-93069 OPP: Fix cleanup ordering
- CVE-2026-93068 drm/amd/display: Fix DM I2C teardown race
- CVE-2026-93067 drm/bridge: tc358767: clamp the reported AUX read size to the request
- CVE-2026-93066 x86/mm/pat: Take cpa_lock around large-page collapse
- CVE-2026-93065 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
- CVE-2026-93064 wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
- CVE-2026-93063 wifi: iwlwifi: mei: check SAP message length before reading it
- CVE-2026-93062 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
- CVE-2026-93061 gpu: host1x: Avoid stack over-read in debug output helpers
- CVE-2026-93060 drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()
- CVE-2026-9306 QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization
- CVE-2026-93059 drm/msm: Fix task_struct reference leak in recover_worker
- CVE-2026-93058 drm/msm: Only fini scheduler after successful init
- CVE-2026-93057 scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context
- CVE-2026-93056 usb: gadget: f_uac1_legacy: remove broken string configfs attributes
- CVE-2026-93055 UDF symlink pathComponent header OOB read
- CVE-2026-93054 uio: Fix stale info pointer in failed registration path
- CVE-2026-93053 speakup: keyhelp: guard letter_offsets possible out-of-range indexing
- CVE-2026-93052 misc: bcm-vk: Use acquire/release for msgq_inited
- CVE-2026-93051 misc: ad525x_dpot: use driver core groups for sysfs files
- CVE-2026-93050 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
- CVE-2026-9305 QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection
- CVE-2026-93049 mtd: mtdswap: Avoid freeing registered blktrans device twice
- CVE-2026-93048 mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
- CVE-2026-93047 drm/v3d: Associate BOs with every job that accesses them
- CVE-2026-93046 software node: Fix software_node_get_reference_args() with index -1
- CVE-2026-93045 bpf: Reject arena frees below the arena base
- CVE-2026-93044 bpf: Disallow interpreter fallback for arena-related insns
- CVE-2026-93043 bpf: Disallow interpreter fallback for gotox insn
- CVE-2026-93042 dmaengine: dw-edma: Terminate all descriptors without callbacks
- CVE-2026-93041 dmaengine: dw-edma: Serialize abort state updates
- CVE-2026-93040 dmaengine: dw-edma: Serialize channel state checks
- CVE-2026-9304 calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
- CVE-2026-93039 ASoC: meson: Keep link pointers valid on realloc failure
- CVE-2026-93038 iio: dac: ad5686: missing NULL check on match data
- CVE-2026-93037 RDMA/hfi1: Propagate sdma_txinit_ahg() errors
- CVE-2026-93034 CVE-2026-93034
- CVE-2026-93031 File upload in Share-one-Drive | OneDrive & SharePoint plugin for WordPress
- CVE-2026-93030 XML external entity in IBM Financial Transaction Manager (FTM) for Redhat OpenShift
- CVE-2026-9303 calcom cal.diy cross-site request forgery
- CVE-2026-93029 Cross-site scripting in WP Squared
- CVE-2026-93026 Missing authorization in Backup and Replication
- CVE-2026-9302 546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection
- CVE-2026-93019 Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
- CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in
- CVE-2026-93017 Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader
- CVE-2026-93015 BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write
- CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
- CVE-2026-93013 RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal
- CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envel
- CVE-2026-93011 Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
- CVE-2026-93010 Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
- CVE-2026-9301 omec-project amf NGReset Message memory corruption
- CVE-2026-93009 Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
- CVE-2026-93008 Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations
- CVE-2026-93007 Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
- CVE-2026-93006 Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content
- CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields
- CVE-2026-93000 SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search
- CVE-2026-9300 omec-project amf NGSetupRequest memory corruption
- CVE-2026-92999 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action
- CVE-2026-92998 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters
- CVE-2026-92997 Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter
- CVE-2026-92996 Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done
- CVE-2026-92995 Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file
- CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API