Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 265 of 1013.
- CVE-2026-90446 Server-Side Request Forgery in Malcolm
- CVE-2026-90445 Path Traversal in Malcolm
- CVE-2026-90444 OS Command Injection in Malcolm
- CVE-2026-90443 Cross-site Scripting in Malcolm
- CVE-2026-90442 Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service
- CVE-2026-90441 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B
- CVE-2026-90440 Denial of service in Apache Thrift
- CVE-2026-9044 Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75
- CVE-2026-90439 NGINX ngx_http_v3_module vulnerability
- CVE-2026-90438 Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
- CVE-2026-90435 RDMA/mlx5: Fix integer overflow of user QP buffer size
- CVE-2026-90434 isofs: release zisofs block pointer buffer head
- CVE-2026-90433 spi: oc-tiny: switch to managed controller allocation
- CVE-2026-90432 sched_ext: Abort directly from the hardlockup handler
- CVE-2026-90431 remoteproc: Prevent crash handling to race with rproc_del()
- CVE-2026-90430 iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
- CVE-2026-90429 iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
- CVE-2026-90428 iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
- CVE-2026-90427 iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
- CVE-2026-90426 iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
- CVE-2026-90425 iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
- CVE-2026-90424 iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
- CVE-2026-90423 RDMA/rxe: Fix UAF in ODP init error-handling path
- CVE-2026-90422 clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
- CVE-2026-90421 PCI: Fix UAF when probe runs concurrent to dyn ID removal
- CVE-2026-90420 nilfs2: fix infinite loop in nilfs_clean_segments()
- CVE-2026-90419 nilfs2: prevent out-of-bounds read in super root block parsing
- CVE-2026-90418 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
- CVE-2026-90417 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
- CVE-2026-90416 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
- CVE-2026-90415 RDMA/cxgb4: free STAG index when TPT entry write fails
- CVE-2026-90414 IB/isert: reject PDUs declaring more data than was received
- CVE-2026-90413 IB/isert: reject login PDUs declaring more data than was received
- CVE-2026-90412 nvmet: fix return status of RMI log page on allocation failure
- CVE-2026-90411 nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
- CVE-2026-90410 spi: davinci: switch to managed controller allocation
- CVE-2026-90409 drm/panthor: Add vm_bind region with kbo range overlap check
- CVE-2026-90408 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
- CVE-2026-90407 wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
- CVE-2026-90406 media: qcom: iris: handle runtime PM resume failure in core deinit
- CVE-2026-90405 media: stm32: dcmi: fix some error handling bugs in probe()
- CVE-2026-90404 platform/chrome: cros_ec_debugfs: Unregister panic notifier
- CVE-2026-90403 wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
- CVE-2026-90402 bus: mhi: host: Fix controller cleanup on EDL sysfs failure
- CVE-2026-90401 md: remove REQ_NOWAIT support from raid1/10/456
- CVE-2026-90400 md: recheck spare changes before starting sync
- CVE-2026-9040 Mali GPU Kernel Driver allows denial of service or disclosure of sensitive information
- CVE-2026-90399 wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
- CVE-2026-90398 wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
- CVE-2026-90397 firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
- CVE-2026-90396 block: fix dio leak on metadata mapping error
- CVE-2026-90395 power: supply: isp1704_charger: cancel work on remove
- CVE-2026-90394 power: supply: sc2731_charger: cancel work on remove
- CVE-2026-90393 bpf: Fix potential UAF in bpf_netns_link_update_prog
- CVE-2026-90392 bpf: Fix potential UAF when reading bpf link info
- CVE-2026-90391 lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
- CVE-2026-90390 md/bitmap: resume array on backlog_store() error path
- CVE-2026-9039 Initialization of a resource with an insecure default in XCharge C6
- CVE-2026-90389 md: scope memalloc_noio to allocation critical sections
- CVE-2026-90388 iommu/dma: Check atomic pool allocation result directly
- CVE-2026-90387 swiotlb: Preserve allocation virtual address for dynamic pools
- CVE-2026-90386 i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
- CVE-2026-90385 md/raid1: create serial pool adding rdev to array with serialize_policy=1
- CVE-2026-90384 iomap: release the folio batch on iomap callback failures
- CVE-2026-90383 misc: sgi-gru: remove interrupt-context page-table walks
- CVE-2026-90382 wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
- CVE-2026-90381 wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
- CVE-2026-90380 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
- CVE-2026-9038 Stack-based buffer overflow in XCharge C6
- CVE-2026-90379 wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
- CVE-2026-90378 wifi: mt76: mt792x: Fix memory leak in SDIO TX path
- CVE-2026-90377 wifi: mt76: fix RX data queuing of RRO 3.0
- CVE-2026-90376 wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
- CVE-2026-90375 wifi: mt76: fix non-AQL packet accounting for MLO stations
- CVE-2026-90374 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
- CVE-2026-90373 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
- CVE-2026-90372 wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
- CVE-2026-90371 wifi: mt76: fix RXDMAD_C buffer recycling race
- CVE-2026-90370 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
- CVE-2026-9037 Download of code without integrity check in XCharge C6
- CVE-2026-90369 wifi: mt76: fix out-of-bounds access in mmio copy helpers
- CVE-2026-90368 wifi: mt76: mt7915: unwind state on add_interface failure
- CVE-2026-90367 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
- CVE-2026-90366 wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
- CVE-2026-90365 wifi: mt76: cancel reset and rc work on device unregister
- CVE-2026-90364 ACPI: processor: Unregister cpufreq notifier on init failure
- CVE-2026-90363 drm/msm: don't tear down KMS twice when KMS init fails
- CVE-2026-90362 drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
- CVE-2026-90361 wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
- CVE-2026-90360 regulator: core: use system_freezable_wq for init complete work
- CVE-2026-9036 Vulnerabilities exists in IBM Netezza Software
- CVE-2026-90359 bpf: Reject >8 byte return values on return-reading trampoline paths
- CVE-2026-90358 bpf, x86: Fix trampoline stack size for 128-bit arguments
- CVE-2026-90357 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
- CVE-2026-90356 wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
- CVE-2026-90355 wifi: mt76: mt7996: clear stale link state on full reset
- CVE-2026-90354 wifi: mt76: mt7915: fix double hif2 init on the non-WED path
- CVE-2026-90353 wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
- CVE-2026-90352 wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
- CVE-2026-90351 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed