# Vulnerabilities published in 2026


- [CVE-2026-93101](https://insights.sbomify.com/CVE-2026-93101/): media: v4l2-async: Unregister sub-device if asc_list is empty (not scored)
- [CVE-2026-93100](https://insights.sbomify.com/CVE-2026-93100/): fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() (not scored)
- [CVE-2026-93099](https://insights.sbomify.com/CVE-2026-93099/): fs/resctrl: Fix UAF from worker threads when domains are removed (not scored)
- [CVE-2026-93098](https://insights.sbomify.com/CVE-2026-93098/): rpmsg: glink: fix deadlock in endpoint destroy during driver detach (not scored)
- [CVE-2026-93097](https://insights.sbomify.com/CVE-2026-93097/): cxl/mbox: Break poison list loop on an empty payload (not scored)
- [CVE-2026-93096](https://insights.sbomify.com/CVE-2026-93096/): cxl/features: Serialize multi-part Get/Set Feature transfers (not scored)
- [CVE-2026-93095](https://insights.sbomify.com/CVE-2026-93095/): hfsplus: validate thread record before delete key rebuild (high 7.8)
- [CVE-2026-93094](https://insights.sbomify.com/CVE-2026-93094/): wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback (not scored)
- [CVE-2026-93093](https://insights.sbomify.com/CVE-2026-93093/): firmware: arm_scmi: Publish channel state before callbacks (not scored)
- [CVE-2026-93092](https://insights.sbomify.com/CVE-2026-93092/): firmware: arm_scmi: Unregister device notifier before IDR teardown (not scored)
- [CVE-2026-93091](https://insights.sbomify.com/CVE-2026-93091/): firmware: arm_scmi: Quiesce notifications before teardown (not scored)
- [CVE-2026-93090](https://insights.sbomify.com/CVE-2026-93090/): firmware: arm_scmi: Clean up channels on setup failure (not scored)
- [CVE-2026-9309](https://insights.sbomify.com/CVE-2026-9309/): Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection (medium 5.4)
- [CVE-2026-93089](https://insights.sbomify.com/CVE-2026-93089/): firmware: arm_scmi: Free transport channel on IDR failure (not scored)
- [CVE-2026-93088](https://insights.sbomify.com/CVE-2026-93088/): CVE-2026-93088 (critical 9.8)
- [CVE-2026-93086](https://insights.sbomify.com/CVE-2026-93086/): firmware: arm_scmi: Avoid IDR updates while cleaning channels (not scored)
- [CVE-2026-93085](https://insights.sbomify.com/CVE-2026-93085/): firmware: arm_scmi: Reject out of range DT protocol IDs (not scored)
- [CVE-2026-93084](https://insights.sbomify.com/CVE-2026-93084/): firmware: arm_scmi: Drop handle on protocol bind failures (not scored)
- [CVE-2026-93083](https://insights.sbomify.com/CVE-2026-93083/): firmware: arm_scmi: Unwind TX receiver mailbox setup failure (not scored)
- [CVE-2026-93082](https://insights.sbomify.com/CVE-2026-93082/): firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (not scored)
- [CVE-2026-93081](https://insights.sbomify.com/CVE-2026-93081/): firmware: arm_scmi: Fix SCMI device destroy lifetimes (not scored)
- [CVE-2026-93080](https://insights.sbomify.com/CVE-2026-93080/): firmware: arm_scmi: Fix transport device teardown lookup (not scored)
- [CVE-2026-9308](https://insights.sbomify.com/CVE-2026-9308/): Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order (medium 5.4)
- [CVE-2026-93079](https://insights.sbomify.com/CVE-2026-93079/): cxl/features: Reject Get Feature count larger than the output buffer (high 7.8)
- [CVE-2026-93078](https://insights.sbomify.com/CVE-2026-93078/): cxl/features: Reject Set Features output buffer smaller than the header (not scored)
- [CVE-2026-93077](https://insights.sbomify.com/CVE-2026-93077/): cxl/features: Clamp Get Feature output size to the remaining buffer (not scored)
- [CVE-2026-93076](https://insights.sbomify.com/CVE-2026-93076/): dax/fsdev: clear vmemmap_shift when binding static pgmap (not scored)
- [CVE-2026-93075](https://insights.sbomify.com/CVE-2026-93075/): dax/fsdev: clear pgmap ops and owner on unbind (not scored)
- [CVE-2026-93074](https://insights.sbomify.com/CVE-2026-93074/): dax/fsdev: use __va(phys) for kaddr in direct_access (high 7.8)
- [CVE-2026-93073](https://insights.sbomify.com/CVE-2026-93073/): dax: read holder_ops once in dax_holder_notify_failure() (not scored)
- [CVE-2026-93072](https://insights.sbomify.com/CVE-2026-93072/): irqchip/renesas-irqc: Fix generic interrupt chip leak on remove (not scored)
- [CVE-2026-93071](https://insights.sbomify.com/CVE-2026-93071/): media: bcm2835-unicam: Fix asc leaked in error/remove path (not scored)
- [CVE-2026-93070](https://insights.sbomify.com/CVE-2026-93070/): media: ipu6: Do not free aux device pdata after init (high 7.8)
- [CVE-2026-9307](https://insights.sbomify.com/CVE-2026-9307/): Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities (medium 6.3)
- [CVE-2026-93069](https://insights.sbomify.com/CVE-2026-93069/): OPP: Fix cleanup ordering (not scored)
- [CVE-2026-93068](https://insights.sbomify.com/CVE-2026-93068/): drm/amd/display: Fix DM I2C teardown race (not scored)
- [CVE-2026-93067](https://insights.sbomify.com/CVE-2026-93067/): drm/bridge: tc358767: clamp the reported AUX read size to the request (not scored)
- [CVE-2026-93066](https://insights.sbomify.com/CVE-2026-93066/): x86/mm/pat: Take cpa_lock around large-page collapse (not scored)
- [CVE-2026-93065](https://insights.sbomify.com/CVE-2026-93065/): wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (not scored)
- [CVE-2026-93064](https://insights.sbomify.com/CVE-2026-93064/): wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (not scored)
- [CVE-2026-93063](https://insights.sbomify.com/CVE-2026-93063/): wifi: iwlwifi: mei: check SAP message length before reading it (high 8.4)
- [CVE-2026-93062](https://insights.sbomify.com/CVE-2026-93062/): wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (not scored)
- [CVE-2026-93061](https://insights.sbomify.com/CVE-2026-93061/): gpu: host1x: Avoid stack over-read in debug output helpers (not scored)
- [CVE-2026-93060](https://insights.sbomify.com/CVE-2026-93060/): drm/msm/adreno: fix use after free on error path in a6xx_gpu_init() (not scored)
- [CVE-2026-9306](https://insights.sbomify.com/CVE-2026-9306/): QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization (medium 6.3)
- [CVE-2026-93059](https://insights.sbomify.com/CVE-2026-93059/): drm/msm: Fix task_struct reference leak in recover_worker (not scored)
- [CVE-2026-93058](https://insights.sbomify.com/CVE-2026-93058/): drm/msm: Only fini scheduler after successful init (not scored)
- [CVE-2026-93057](https://insights.sbomify.com/CVE-2026-93057/): scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context (not scored)
- [CVE-2026-93056](https://insights.sbomify.com/CVE-2026-93056/): usb: gadget: f_uac1_legacy: remove broken string configfs attributes (not scored)
- [CVE-2026-93055](https://insights.sbomify.com/CVE-2026-93055/): UDF symlink pathComponent header OOB read (not scored)
- [CVE-2026-93054](https://insights.sbomify.com/CVE-2026-93054/): uio: Fix stale info pointer in failed registration path (high 7.0)
- [CVE-2026-93053](https://insights.sbomify.com/CVE-2026-93053/): speakup: keyhelp: guard letter_offsets possible out-of-range indexing (not scored)
- [CVE-2026-93052](https://insights.sbomify.com/CVE-2026-93052/): misc: bcm-vk: Use acquire/release for msgq_inited (not scored)
- [CVE-2026-93051](https://insights.sbomify.com/CVE-2026-93051/): misc: ad525x_dpot: use driver core groups for sysfs files (not scored)
- [CVE-2026-93050](https://insights.sbomify.com/CVE-2026-93050/): ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove (not scored)
- [CVE-2026-9305](https://insights.sbomify.com/CVE-2026-9305/): QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection (medium 5.3)
- [CVE-2026-93049](https://insights.sbomify.com/CVE-2026-93049/): mtd: mtdswap: Avoid freeing registered blktrans device twice (not scored)
- [CVE-2026-93048](https://insights.sbomify.com/CVE-2026-93048/): mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (not scored)
- [CVE-2026-93047](https://insights.sbomify.com/CVE-2026-93047/): drm/v3d: Associate BOs with every job that accesses them (not scored)
- [CVE-2026-93046](https://insights.sbomify.com/CVE-2026-93046/): software node: Fix software_node_get_reference_args() with index -1 (high 7.0)
- [CVE-2026-93045](https://insights.sbomify.com/CVE-2026-93045/): bpf: Reject arena frees below the arena base (high 7.8)
- [CVE-2026-93044](https://insights.sbomify.com/CVE-2026-93044/): bpf: Disallow interpreter fallback for arena-related insns (not scored)
- [CVE-2026-93043](https://insights.sbomify.com/CVE-2026-93043/): bpf: Disallow interpreter fallback for gotox insn (not scored)
- [CVE-2026-93042](https://insights.sbomify.com/CVE-2026-93042/): dmaengine: dw-edma: Terminate all descriptors without callbacks (high 8.8)
- [CVE-2026-93041](https://insights.sbomify.com/CVE-2026-93041/): dmaengine: dw-edma: Serialize abort state updates (not scored)
- [CVE-2026-93040](https://insights.sbomify.com/CVE-2026-93040/): dmaengine: dw-edma: Serialize channel state checks (not scored)
- [CVE-2026-9304](https://insights.sbomify.com/CVE-2026-9304/): calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery (low 2.3)
- [CVE-2026-93039](https://insights.sbomify.com/CVE-2026-93039/): ASoC: meson: Keep link pointers valid on realloc failure (high 7.4)
- [CVE-2026-93038](https://insights.sbomify.com/CVE-2026-93038/): iio: dac: ad5686: missing NULL check on match data (not scored)
- [CVE-2026-93037](https://insights.sbomify.com/CVE-2026-93037/): RDMA/hfi1: Propagate sdma_txinit_ahg() errors (high 7.8)
- [CVE-2026-93034](https://insights.sbomify.com/CVE-2026-93034/): CVE-2026-93034 (critical 9.8)
- [CVE-2026-93031](https://insights.sbomify.com/CVE-2026-93031/): File upload in Share-one-Drive | OneDrive & SharePoint plugin for WordPress (high 8.8)
- [CVE-2026-93030](https://insights.sbomify.com/CVE-2026-93030/): XML external entity in IBM Financial Transaction Manager (FTM) for Redhat OpenShift (medium 6.5)
- [CVE-2026-9303](https://insights.sbomify.com/CVE-2026-9303/): calcom cal.diy cross-site request forgery (medium 5.3)
- [CVE-2026-93029](https://insights.sbomify.com/CVE-2026-93029/): Cross-site scripting in WP Squared (critical 9.0)
- [CVE-2026-93026](https://insights.sbomify.com/CVE-2026-93026/): Missing authorization in Backup and Replication (medium 6.1)
- [CVE-2026-9302](https://insights.sbomify.com/CVE-2026-9302/): 546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection (medium 5.3)
- [CVE-2026-93019](https://insights.sbomify.com/CVE-2026-93019/): Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. (critical 9.1)
- [CVE-2026-93018](https://insights.sbomify.com/CVE-2026-93018/): Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in (medium 5.5)
- [CVE-2026-93017](https://insights.sbomify.com/CVE-2026-93017/): Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader (high 7.7)
- [CVE-2026-93015](https://insights.sbomify.com/CVE-2026-93015/): BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write (high 7.0)
- [CVE-2026-93014](https://insights.sbomify.com/CVE-2026-93014/): RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter (high 7.1)
- [CVE-2026-93013](https://insights.sbomify.com/CVE-2026-93013/): RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal (medium 5.3)
- [CVE-2026-93012](https://insights.sbomify.com/CVE-2026-93012/): Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envel (critical 9.8)
- [CVE-2026-93011](https://insights.sbomify.com/CVE-2026-93011/): Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms (medium 5.3)
- [CVE-2026-93010](https://insights.sbomify.com/CVE-2026-93010/): Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check (medium 4.3)
- [CVE-2026-9301](https://insights.sbomify.com/CVE-2026-9301/): omec-project amf NGReset Message memory corruption (medium 5.3)
- [CVE-2026-93009](https://insights.sbomify.com/CVE-2026-93009/): Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder (medium 4.3)
- [CVE-2026-93008](https://insights.sbomify.com/CVE-2026-93008/): Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations (medium 6.8)
- [CVE-2026-93007](https://insights.sbomify.com/CVE-2026-93007/): Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation (medium 5.3)
- [CVE-2026-93006](https://insights.sbomify.com/CVE-2026-93006/): Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content (medium 6.8)
- [CVE-2026-93003](https://insights.sbomify.com/CVE-2026-93003/): NetX Duo Web HTTP server interprets request body content as HTTP header fields (medium 6.9)
- [CVE-2026-93000](https://insights.sbomify.com/CVE-2026-93000/): SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search (medium 6.8)
- [CVE-2026-9300](https://insights.sbomify.com/CVE-2026-9300/): omec-project amf NGSetupRequest memory corruption (medium 5.3)
- [CVE-2026-92999](https://insights.sbomify.com/CVE-2026-92999/): Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action (medium 5.3)
- [CVE-2026-92998](https://insights.sbomify.com/CVE-2026-92998/): Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters (high 8.6)
- [CVE-2026-92997](https://insights.sbomify.com/CVE-2026-92997/): Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter (high 8.6)
- [CVE-2026-92996](https://insights.sbomify.com/CVE-2026-92996/): Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done (medium 5.3)
- [CVE-2026-92995](https://insights.sbomify.com/CVE-2026-92995/): Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file (medium 5.3)
- [CVE-2026-92994](https://insights.sbomify.com/CVE-2026-92994/): Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/244/