Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 267 of 1013.
- CVE-2026-90258 pinctrl: airoha: add missed IRQ resource helpers
- CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string
- CVE-2026-90256 Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
- CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime
- CVE-2026-90254 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
- CVE-2026-90253 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
- CVE-2026-90252 Bluetooth: MGMT: free the HCI command when it is cancelled
- CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length
- CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
- CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
- CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
- CVE-2026-90247 bpf: Fix mmap_lock leak in irq_work path
- CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check
- CVE-2026-90245 fbdev: kyro: Validate overlay viewport coordinates
- CVE-2026-90244 iommu/dma: Restore locking around msi_page_list
- CVE-2026-90243 iommu/vt-d: Clear Present bit before tearing down copied context entry
- CVE-2026-90242 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
- CVE-2026-90241 iommu/vt-d: Tear down scalable-mode context on probe failure
- CVE-2026-90240 iommu/vt-d: Flush context cache with correct SID when tearing down aliases
- CVE-2026-9024 Cross-site scripting in DELMIA Service Process Engineer
- CVE-2026-90239 media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()
- CVE-2026-90238 media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path
- CVE-2026-90237 netfilter: nft_ct: move custom expectation support to helper
- CVE-2026-90236 NFSD: Release the export reference when reaping open stateids
- CVE-2026-90235 sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
- CVE-2026-90234 NFS: Return a delegation the client fails to record
- CVE-2026-90233 nvme-pci: release descriptor pools on probe failure
- CVE-2026-90232 amt: Don't support cross-netns setup.
- CVE-2026-90231 apparmor: fix unconfined user namespace restriction forced stack
- CVE-2026-90230 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
- CVE-2026-90229 nvme-apple: Destroy the admin queue on removal
- CVE-2026-90228 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
- CVE-2026-90227 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
- CVE-2026-90226 nfc: llcp: avoid userspace overflow on invalid optlen
- CVE-2026-90225 nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
- CVE-2026-90224 nfc: nci: fix double completion race in nci_data_exchange_complete
- CVE-2026-90223 nfc: llcp: bound SNL TLV parsing to the skb and add length checks
- CVE-2026-90222 nfc: pn533: hold a reference to the request skb during send_frame
- CVE-2026-90221 nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
- CVE-2026-90220 ALSA: seq: Don't leak the extension cell pointer in the bounce payload
- CVE-2026-9022 Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute
- CVE-2026-90219 RDMA/cxgb4: Free debugfs on registration failure
- CVE-2026-90218 RDMA/cma: Fix WARNING in res_to_rt
- CVE-2026-90217 bpf: Compare iterator types during state pruning
- CVE-2026-90216 ubi: Fix rollback for explicit UBI device numbers
- CVE-2026-90215 mtd: ubi: Release device reference on busy detach
- CVE-2026-90214 ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
- CVE-2026-90213 firewire: core: fix memory leak in error path of build_tree()
- CVE-2026-90212 arm64/efi: Avoid voluntary preemption with efi_mm installed
- CVE-2026-90211 bpf, s390: Clear fetch destination on faulting arena atomic
- CVE-2026-90210 bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure
- CVE-2026-9021 Missing authorization in Easy Invoice – Invoice Generator, PDF Quotes & Payments
- CVE-2026-90209 s390/debug: Fix deadlock during unregister
- CVE-2026-90208 clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
- CVE-2026-90207 ALSA: seq: midi: Serialize input teardown with event_input
- CVE-2026-90206 nvmet: fix max_qid race between configfs and controller allocation
- CVE-2026-90205 ocfs2: validate orphan slot during inode read
- CVE-2026-90204 ocfs2: validate DIO orphan slot during inode read
- CVE-2026-90203 Squashfs: check block offset is not negative
- CVE-2026-90202 scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
- CVE-2026-90201 net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
- CVE-2026-90200 fs/ntfs3: fix integer overflow in MFT cluster validation
- CVE-2026-90199 fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
- CVE-2026-90198 ALSA: core: Fix use-after-free in snd_card_do_free()
- CVE-2026-90197 HID: haptic: don't write an uninitialized value to unhandled usages
- CVE-2026-90196 ASoC: SOF: validate topology volume range before allocation
- CVE-2026-90195 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
- CVE-2026-90194 ACPI: scan: fix bus ID cleanup on device_add() failures
- CVE-2026-90193 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
- CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback
- CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
- CVE-2026-90190 null_blk: use DEFINE_MUTEX for the file-scope mutex
- CVE-2026-9019 Cross-site scripting in Easy Image Collage
- CVE-2026-90189 null_blk: register configfs subsystem after creating default devices
- CVE-2026-90188 null_blk: free global tag_set on init error path
- CVE-2026-90187 null_blk: free zones array on device power-off
- CVE-2026-90186 null_blk: reject per-device queue resize for shared tag set
- CVE-2026-90185 null_blk: serialize configfs attribute stores with the lock
- CVE-2026-90184 null_blk: serialize configfs attribute updates with device setup
- CVE-2026-90183 blk-iolatency: clear delay state when freeing policy data
- CVE-2026-90182 blk-iocost: clear delay state when freeing policy data
- CVE-2026-90181 ublk: avoid teardown retry loop on xarray allocation failure
- CVE-2026-90180 block: mtip32xx: synchronize ioctls with device removal
- CVE-2026-9018 Privilege escalation in Easy Elements for Elementor – Addons & Website Templates
- CVE-2026-90179 apparmor: fix deadlock in complain-mode change_hat
- CVE-2026-90178 hwmon: (coretemp) Fix core_data leak on CPUs without PTS
- CVE-2026-90177 bpf: Check pointer type for all atomic RMW paths
- CVE-2026-90176 ksmbd: Do not skip lock checks for single-byte ranges
- CVE-2026-90175 smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
- CVE-2026-90174 ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
- CVE-2026-90173 smb: smbdirect: free completion queues with ib_free_cq()
- CVE-2026-90172 smb: smbdirect: destroy QP before mem pools on accept failure
- CVE-2026-90171 smb: smbdirect: release pending child sockets outside the handler lock
- CVE-2026-90170 ksmbd: validate ipc response length before dereferencing its fields
- CVE-2026-9017 Missing authorization in NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-90169 ksmbd: free preauth sessions on connection teardown
- CVE-2026-90167 ksmbd: serialize oplock close with pending break ownership
- CVE-2026-90166 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
- CVE-2026-90165 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
- CVE-2026-90164 smb/server: abort initialization when proc setup fails