# Vulnerabilities published in 2026


- [CVE-2026-90446](https://insights.sbomify.com/CVE-2026-90446/): Server-Side Request Forgery in Malcolm (medium 5.3)
- [CVE-2026-90445](https://insights.sbomify.com/CVE-2026-90445/): Path Traversal in Malcolm (high 7.1)
- [CVE-2026-90444](https://insights.sbomify.com/CVE-2026-90444/): OS Command Injection in Malcolm (high 8.7)
- [CVE-2026-90443](https://insights.sbomify.com/CVE-2026-90443/): Cross-site Scripting in Malcolm (medium 5.3)
- [CVE-2026-90442](https://insights.sbomify.com/CVE-2026-90442/): Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service (high 8.6)
- [CVE-2026-90441](https://insights.sbomify.com/CVE-2026-90441/): Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B (high 7.1)
- [CVE-2026-90440](https://insights.sbomify.com/CVE-2026-90440/): Denial of service in Apache Thrift (high 8.2)
- [CVE-2026-9044](https://insights.sbomify.com/CVE-2026-9044/): Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75 (high 8.5)
- [CVE-2026-90439](https://insights.sbomify.com/CVE-2026-90439/): NGINX ngx_http_v3_module vulnerability (medium 6.9)
- [CVE-2026-90438](https://insights.sbomify.com/CVE-2026-90438/): Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission (high 7.2)
- [CVE-2026-90435](https://insights.sbomify.com/CVE-2026-90435/): RDMA/mlx5: Fix integer overflow of user QP buffer size (high 7.8)
- [CVE-2026-90434](https://insights.sbomify.com/CVE-2026-90434/): isofs: release zisofs block pointer buffer head (not scored)
- [CVE-2026-90433](https://insights.sbomify.com/CVE-2026-90433/): spi: oc-tiny: switch to managed controller allocation (not scored)
- [CVE-2026-90432](https://insights.sbomify.com/CVE-2026-90432/): sched_ext: Abort directly from the hardlockup handler (not scored)
- [CVE-2026-90431](https://insights.sbomify.com/CVE-2026-90431/): remoteproc: Prevent crash handling to race with rproc_del() (not scored)
- [CVE-2026-90430](https://insights.sbomify.com/CVE-2026-90430/): iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (not scored)
- [CVE-2026-90429](https://insights.sbomify.com/CVE-2026-90429/): iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init (high 7.8)
- [CVE-2026-90428](https://insights.sbomify.com/CVE-2026-90428/): iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (not scored)
- [CVE-2026-90427](https://insights.sbomify.com/CVE-2026-90427/): iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() (high 7.4)
- [CVE-2026-90426](https://insights.sbomify.com/CVE-2026-90426/): iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (not scored)
- [CVE-2026-90425](https://insights.sbomify.com/CVE-2026-90425/): iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID (high 8.8)
- [CVE-2026-90424](https://insights.sbomify.com/CVE-2026-90424/): iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path (not scored)
- [CVE-2026-90423](https://insights.sbomify.com/CVE-2026-90423/): RDMA/rxe: Fix UAF in ODP init error-handling path (high 7.8)
- [CVE-2026-90422](https://insights.sbomify.com/CVE-2026-90422/): clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path (not scored)
- [CVE-2026-90421](https://insights.sbomify.com/CVE-2026-90421/): PCI: Fix UAF when probe runs concurrent to dyn ID removal (not scored)
- [CVE-2026-90420](https://insights.sbomify.com/CVE-2026-90420/): nilfs2: fix infinite loop in nilfs_clean_segments() (not scored)
- [CVE-2026-90419](https://insights.sbomify.com/CVE-2026-90419/): nilfs2: prevent out-of-bounds read in super root block parsing (high 7.1)
- [CVE-2026-90418](https://insights.sbomify.com/CVE-2026-90418/): nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch (not scored)
- [CVE-2026-90417](https://insights.sbomify.com/CVE-2026-90417/): RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (not scored)
- [CVE-2026-90416](https://insights.sbomify.com/CVE-2026-90416/): RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (not scored)
- [CVE-2026-90415](https://insights.sbomify.com/CVE-2026-90415/): RDMA/cxgb4: free STAG index when TPT entry write fails (not scored)
- [CVE-2026-90414](https://insights.sbomify.com/CVE-2026-90414/): IB/isert: reject PDUs declaring more data than was received (critical 9.1)
- [CVE-2026-90413](https://insights.sbomify.com/CVE-2026-90413/): IB/isert: reject login PDUs declaring more data than was received (critical 9.1)
- [CVE-2026-90412](https://insights.sbomify.com/CVE-2026-90412/): nvmet: fix return status of RMI log page on allocation failure (not scored)
- [CVE-2026-90411](https://insights.sbomify.com/CVE-2026-90411/): nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request (not scored)
- [CVE-2026-90410](https://insights.sbomify.com/CVE-2026-90410/): spi: davinci: switch to managed controller allocation (not scored)
- [CVE-2026-90409](https://insights.sbomify.com/CVE-2026-90409/): drm/panthor: Add vm_bind region with kbo range overlap check (not scored)
- [CVE-2026-90408](https://insights.sbomify.com/CVE-2026-90408/): wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() (high 7.7)
- [CVE-2026-90407](https://insights.sbomify.com/CVE-2026-90407/): wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (high 7.7)
- [CVE-2026-90406](https://insights.sbomify.com/CVE-2026-90406/): media: qcom: iris: handle runtime PM resume failure in core deinit (not scored)
- [CVE-2026-90405](https://insights.sbomify.com/CVE-2026-90405/): media: stm32: dcmi: fix some error handling bugs in probe() (not scored)
- [CVE-2026-90404](https://insights.sbomify.com/CVE-2026-90404/): platform/chrome: cros_ec_debugfs: Unregister panic notifier (not scored)
- [CVE-2026-90403](https://insights.sbomify.com/CVE-2026-90403/): wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (high 7.0)
- [CVE-2026-90402](https://insights.sbomify.com/CVE-2026-90402/): bus: mhi: host: Fix controller cleanup on EDL sysfs failure (high 7.0)
- [CVE-2026-90401](https://insights.sbomify.com/CVE-2026-90401/): md: remove REQ_NOWAIT support from raid1/10/456 (high 7.1)
- [CVE-2026-90400](https://insights.sbomify.com/CVE-2026-90400/): md: recheck spare changes before starting sync (not scored)
- [CVE-2026-9040](https://insights.sbomify.com/CVE-2026-9040/): Mali GPU Kernel Driver allows denial of service or disclosure of sensitive information (high 7.7)
- [CVE-2026-90399](https://insights.sbomify.com/CVE-2026-90399/): wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (high 8.4)
- [CVE-2026-90398](https://insights.sbomify.com/CVE-2026-90398/): wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (high 8.4)
- [CVE-2026-90397](https://insights.sbomify.com/CVE-2026-90397/): firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published (not scored)
- [CVE-2026-90396](https://insights.sbomify.com/CVE-2026-90396/): block: fix dio leak on metadata mapping error (not scored)
- [CVE-2026-90395](https://insights.sbomify.com/CVE-2026-90395/): power: supply: isp1704_charger: cancel work on remove (not scored)
- [CVE-2026-90394](https://insights.sbomify.com/CVE-2026-90394/): power: supply: sc2731_charger: cancel work on remove (not scored)
- [CVE-2026-90393](https://insights.sbomify.com/CVE-2026-90393/): bpf: Fix potential UAF in bpf_netns_link_update_prog (not scored)
- [CVE-2026-90392](https://insights.sbomify.com/CVE-2026-90392/): bpf: Fix potential UAF when reading bpf link info (high 7.8)
- [CVE-2026-90391](https://insights.sbomify.com/CVE-2026-90391/): lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone (not scored)
- [CVE-2026-90390](https://insights.sbomify.com/CVE-2026-90390/): md/bitmap: resume array on backlog_store() error path (not scored)
- [CVE-2026-9039](https://insights.sbomify.com/CVE-2026-9039/): Initialization of a resource with an insecure default in XCharge C6 (high 8.6)
- [CVE-2026-90389](https://insights.sbomify.com/CVE-2026-90389/): md: scope memalloc_noio to allocation critical sections (not scored)
- [CVE-2026-90388](https://insights.sbomify.com/CVE-2026-90388/): iommu/dma: Check atomic pool allocation result directly (high 7.8)
- [CVE-2026-90387](https://insights.sbomify.com/CVE-2026-90387/): swiotlb: Preserve allocation virtual address for dynamic pools (high 7.8)
- [CVE-2026-90386](https://insights.sbomify.com/CVE-2026-90386/): i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (not scored)
- [CVE-2026-90385](https://insights.sbomify.com/CVE-2026-90385/): md/raid1: create serial pool adding rdev to array with serialize_policy=1 (not scored)
- [CVE-2026-90384](https://insights.sbomify.com/CVE-2026-90384/): iomap: release the folio batch on iomap callback failures (not scored)
- [CVE-2026-90383](https://insights.sbomify.com/CVE-2026-90383/): misc: sgi-gru: remove interrupt-context page-table walks (high 7.8)
- [CVE-2026-90382](https://insights.sbomify.com/CVE-2026-90382/): wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (not scored)
- [CVE-2026-90381](https://insights.sbomify.com/CVE-2026-90381/): wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() (high 8.8)
- [CVE-2026-90380](https://insights.sbomify.com/CVE-2026-90380/): wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (high 8.8)
- [CVE-2026-9038](https://insights.sbomify.com/CVE-2026-9038/): Stack-based buffer overflow in XCharge C6 (high 8.6)
- [CVE-2026-90379](https://insights.sbomify.com/CVE-2026-90379/): wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash (high 8.8)
- [CVE-2026-90378](https://insights.sbomify.com/CVE-2026-90378/): wifi: mt76: mt792x: Fix memory leak in SDIO TX path (not scored)
- [CVE-2026-90377](https://insights.sbomify.com/CVE-2026-90377/): wifi: mt76: fix RX data queuing of RRO 3.0 (not scored)
- [CVE-2026-90376](https://insights.sbomify.com/CVE-2026-90376/): wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP (not scored)
- [CVE-2026-90375](https://insights.sbomify.com/CVE-2026-90375/): wifi: mt76: fix non-AQL packet accounting for MLO stations (not scored)
- [CVE-2026-90374](https://insights.sbomify.com/CVE-2026-90374/): wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] (not scored)
- [CVE-2026-90373](https://insights.sbomify.com/CVE-2026-90373/): wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (not scored)
- [CVE-2026-90372](https://insights.sbomify.com/CVE-2026-90372/): wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (high 7.1)
- [CVE-2026-90371](https://insights.sbomify.com/CVE-2026-90371/): wifi: mt76: fix RXDMAD_C buffer recycling race (high 8.8)
- [CVE-2026-90370](https://insights.sbomify.com/CVE-2026-90370/): wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (not scored)
- [CVE-2026-9037](https://insights.sbomify.com/CVE-2026-9037/): Download of code without integrity check in XCharge C6 (critical 9.3)
- [CVE-2026-90369](https://insights.sbomify.com/CVE-2026-90369/): wifi: mt76: fix out-of-bounds access in mmio copy helpers (not scored)
- [CVE-2026-90368](https://insights.sbomify.com/CVE-2026-90368/): wifi: mt76: mt7915: unwind state on add_interface failure (not scored)
- [CVE-2026-90367](https://insights.sbomify.com/CVE-2026-90367/): wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER (high 8.8)
- [CVE-2026-90366](https://insights.sbomify.com/CVE-2026-90366/): wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (not scored)
- [CVE-2026-90365](https://insights.sbomify.com/CVE-2026-90365/): wifi: mt76: cancel reset and rc work on device unregister (not scored)
- [CVE-2026-90364](https://insights.sbomify.com/CVE-2026-90364/): ACPI: processor: Unregister cpufreq notifier on init failure (not scored)
- [CVE-2026-90363](https://insights.sbomify.com/CVE-2026-90363/): drm/msm: don't tear down KMS twice when KMS init fails (not scored)
- [CVE-2026-90362](https://insights.sbomify.com/CVE-2026-90362/): drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (not scored)
- [CVE-2026-90361](https://insights.sbomify.com/CVE-2026-90361/): wifi: ath11k: fix leak in ath11k_service_ready_ext_event() (not scored)
- [CVE-2026-90360](https://insights.sbomify.com/CVE-2026-90360/): regulator: core: use system_freezable_wq for init complete work (not scored)
- [CVE-2026-9036](https://insights.sbomify.com/CVE-2026-9036/): Vulnerabilities exists in IBM Netezza Software (medium 5.9)
- [CVE-2026-90359](https://insights.sbomify.com/CVE-2026-90359/): bpf: Reject >8 byte return values on return-reading trampoline paths (not scored)
- [CVE-2026-90358](https://insights.sbomify.com/CVE-2026-90358/): bpf, x86: Fix trampoline stack size for 128-bit arguments (high 7.8)
- [CVE-2026-90357](https://insights.sbomify.com/CVE-2026-90357/): wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (high 8.8)
- [CVE-2026-90356](https://insights.sbomify.com/CVE-2026-90356/): wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset (not scored)
- [CVE-2026-90355](https://insights.sbomify.com/CVE-2026-90355/): wifi: mt76: mt7996: clear stale link state on full reset (not scored)
- [CVE-2026-90354](https://insights.sbomify.com/CVE-2026-90354/): wifi: mt76: mt7915: fix double hif2 init on the non-WED path (not scored)
- [CVE-2026-90353](https://insights.sbomify.com/CVE-2026-90353/): wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (high 7.0)
- [CVE-2026-90352](https://insights.sbomify.com/CVE-2026-90352/): wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (not scored)
- [CVE-2026-90351](https://insights.sbomify.com/CVE-2026-90351/): wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/265/