Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 266 of 1013.
- CVE-2026-90350 wifi: mt76: reject out-of-range link ids in mt76_vif_link()
- CVE-2026-9035 Multiple vulnerabilities in Aspera applications.
- CVE-2026-90349 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
- CVE-2026-90348 wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
- CVE-2026-90347 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
- CVE-2026-90346 wifi: nl80211: clean up color-change beacon data on errors
- CVE-2026-90345 wifi: brcmfmac: fix P2P action frame handling without device vif
- CVE-2026-90344 wifi: mac80211: disconnect on CSA to channel 0
- CVE-2026-90343 wifi: cfg80211: stop PMSR before P2P and NAN teardown
- CVE-2026-90342 bpf: Fix mmap_lock deadlock on arena lock failure
- CVE-2026-90341 firmware: coreboot: Validate table bounds
- CVE-2026-90340 pinctrl: generic: free maps on pinctrl_generic_to_map() failure
- CVE-2026-9034 Mali GPU Userspace Driver allows access to already freed memory
- CVE-2026-90339 powerpc/syscall: Fix syscall skip handling for seccomp and ptrace
- CVE-2026-90338 serial: amba-pl011: keep console clock enabled for atomic writes
- CVE-2026-90337 serial: core: do fallible allocations before the console can be registered
- CVE-2026-90336 serial: core: clear freed pointers on uart_register_driver() failure
- CVE-2026-90335 tty: skip cdev_del() when no cdev is registered
- CVE-2026-90334 tty: clear cdev pointer after cdev_add() failure
- CVE-2026-90333 dm-integrity: replace forgeable discard filler with a keyed sector marker
- CVE-2026-90332 PCI: dwc: ep: Flush cached MSI write before unmapping the iATU
- CVE-2026-90331 HID: asus: refactor the two workqueues and init sequence
- CVE-2026-90330 HID: logitech-hidpp: Fix FF device cleanup on init failure
- CVE-2026-9033 Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
- CVE-2026-90329 HID: synchronize input before cleaning up a failed probe
- CVE-2026-90328 HID: steam: Reject short reads
- CVE-2026-90327 phonet: pep: do not write beyond optlen in getsockopt
- CVE-2026-90326 blk-cgroup: fix race between policy activation and blkg destruction
- CVE-2026-90325 blk-cgroup: skip dying blkg in blkcg_activate_policy()
- CVE-2026-90324 ublk: check import_ubuf() return value
- CVE-2026-90323 ublk: validate auto buf reg before taking uring_cmd
- CVE-2026-90322 ocfs2/cluster: keep heartbeat local node stable
- CVE-2026-90321 ocfs2: validate inline xattrs during inode block validation
- CVE-2026-90320 ocfs2: validate external xattr entries when reading metadata
- CVE-2026-9032 Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
- CVE-2026-90319 rapidio: clear mport->net when rio_add_net() fails
- CVE-2026-90318 fat: release buffer head after rebuilding parent
- CVE-2026-90317 bpf: Invalidate RCU pointers after final spin unlock
- CVE-2026-90316 drm/omap: dsi: Do not copy isr table
- CVE-2026-90315 PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
- CVE-2026-90314 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
- CVE-2026-90313 bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
- CVE-2026-90312 bpf: Check load-acquire src ptr type before the load
- CVE-2026-90311 thermal: hwmon: Remove hwmon class device along with its parent
- CVE-2026-9031 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
- CVE-2026-90309 RDMA/erdma: Hold CQ references when processing EQ events
- CVE-2026-90308 RDMA/erdma: Hold QP references for AE and CM processing
- CVE-2026-90307 RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
- CVE-2026-90306 ARM: 9481/2: breakpoint: CFI breakpoints only on demand
- CVE-2026-90305 ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
- CVE-2026-90304 ARM: 9484/1: enable interrupts when unhandled user faults are triggered
- CVE-2026-90303 ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
- CVE-2026-90302 ocfs2: synchronize heartbeat callbacks with o2net teardown
- CVE-2026-90301 ocfs2: o2hb: quiesce negotiate handlers and timeout work
- CVE-2026-90300 bpf: Clear buf on error in __bpf_get_task_stack
- CVE-2026-9030 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
- CVE-2026-90299 bpf: Fix sleepable check for tracing/lsm prog
- CVE-2026-90298 drm/sun4i: tcon: Drop TCON TOP device reference
- CVE-2026-90297 drm/sun4i: crtc: Propagate layer initialization error
- CVE-2026-90296 cpufreq: imx6q: fix devres accumulation across driver rebind
- CVE-2026-90295 cpufreq: imx6q: fix out-of-bounds write when probed more than once
- CVE-2026-90294 IB/isert: delay the final Login Response until the session is registered
- CVE-2026-90293 IB/isert: post the full-feature receive buffers after session registration
- CVE-2026-90292 RDMA/siw: Fix use-after-free in siw_accept()
- CVE-2026-90291 module/dups: Fix use-after-free in kmod_dup_req lifetime handling
- CVE-2026-90290 arm64: hibernate: Restore DAIF state on error
- CVE-2026-9029 Stored XSS in the Geomap panel tile-layer attribution
- CVE-2026-90289 drm/amd/display: Resize MST HDCP per-connector arrays to 32
- CVE-2026-90288 phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure
- CVE-2026-90287 phy: sunplus: fix error handling in sp_uphy_init()
- CVE-2026-90286 drm/amdgpu/gfx6: Use PFP on the compute queues too
- CVE-2026-90285 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
- CVE-2026-90284 firmware_loader: do not queue completed sysfs fallback requests
- CVE-2026-90283 hugetlbfs: release subpool on fill_super failure
- CVE-2026-90282 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
- CVE-2026-90281 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
- CVE-2026-90280 phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
- CVE-2026-9028 Missing authorization in CorvusPay WooCommerce Payment Gateway
- CVE-2026-90279 md/raid5: round bitmap stripes with sector division
- CVE-2026-90278 md: wait for behind writes before destroying bitmap
- CVE-2026-90277 md/md-llbitmap: prevent create failure bitmap UAF
- CVE-2026-90276 md/md-llbitmap: stop daemon timer rearm on destroy
- CVE-2026-90275 md/raid1: don't set array_frozen in raid1_takeover()
- CVE-2026-90274 coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
- CVE-2026-90273 coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
- CVE-2026-90272 perf: arm_pmuv3: Zero initialize hw_id branch stack field
- CVE-2026-90271 arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt
- CVE-2026-90270 arm_mpam: Disable driver unbind to avoid UAF
- CVE-2026-9027 Business logic in CorvusPay WooCommerce Payment Gateway
- CVE-2026-90269 bpf: Reject load-acquire from pointers requiring fault protection
- CVE-2026-90268 scsi: sd: Fix error handling in sd_probe() after large pool creation failure
- CVE-2026-90267 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
- CVE-2026-90266 btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge
- CVE-2026-90265 btrfs: defrag: fix deadlock between defrag and delalloc space reservation
- CVE-2026-90264 btrfs: always wait for ordered extents to avoid OE races
- CVE-2026-90263 btrfs: check if root is readonly when setting posix acl
- CVE-2026-90262 btrfs: retry verity reads for not-uptodate Merkle folios
- CVE-2026-90261 btrfs: zoned: flush active metadata block group at btree_writepages() start
- CVE-2026-90260 btrfs: zoned: don't clobber the extent buffer when zeroing it out
- CVE-2026-90259 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()