Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 268 of 1013.
- CVE-2026-90163 smb/server: call ksmbd_proc_cleanup() on module init failure
- CVE-2026-90162 ksmbd: defer publishing granted locks to prevent UAF/double-free race
- CVE-2026-90161 erofs: fix interlaced ztailpacking pclusters
- CVE-2026-90160 lwt_bpf: Restore reserved headroom after xmit program
- CVE-2026-9016 Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action
- CVE-2026-90159 bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
- CVE-2026-90158 m68k: nfcon: Do not call console_is_registered() in nfcon_device()
- CVE-2026-90157 bpf: Reject negative optlen in cgroup getsockopt hook
- CVE-2026-90156 ksmbd: safely discard unregistered deferred locks
- CVE-2026-90155 ksmbd: detach blocked lock requests before freeing
- CVE-2026-90154 ksmbd: scope session state changes to bound connections
- CVE-2026-90153 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
- CVE-2026-90152 smb/server: fix session leak in ksmbd_session_register()
- CVE-2026-90151 NFSv4: remove callback IDR entry on client allocation failure
- CVE-2026-90150 pnfs/blocklayout: Fix device leaks on parse failure
- CVE-2026-9015 Missing authorization in Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
- CVE-2026-90149 NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
- CVE-2026-90148 NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
- CVE-2026-90147 clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
- CVE-2026-90146 bpf, xdp: move offload check into dev_xdp_install()
- CVE-2026-90145 hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
- CVE-2026-90144 dpll: fix NULL deref in dpll_device_ops() during teardown race
- CVE-2026-90143 net: kcm: Hold RCU read lock while running BPF parser
- CVE-2026-90142 virtio_net: Fix resize of the RX ring
- CVE-2026-90141 ipvs: fix integer overflow in ftp helper port/address parsing
- CVE-2026-90140 cuse: wait for pending RCU callbacks on module exit
- CVE-2026-9014 WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action
- CVE-2026-90139 fuse: check for NULL root inode in fuse_fill_super_submount
- CVE-2026-90138 vsock: don't check the listener's sk_err in vsock_accept()
- CVE-2026-90137 platform/x86: hp-bioscfg: fix password encoding bounds check
- CVE-2026-90136 platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
- CVE-2026-90135 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
- CVE-2026-90134 ntfs: fix kmap_local_page() usage in compress
- CVE-2026-90133 ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()
- CVE-2026-90132 ntfs: reject unprivileged writes to reserved $LX* xattrs
- CVE-2026-90131 ntfs: serialize resident iomap reads with mrec_lock
- CVE-2026-90130 vdpa_sim: fix cleanup after worker creation failure
- CVE-2026-9013 Bogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API
- CVE-2026-90129 virtio_balloon: quiesce balloon work before device shutdown
- CVE-2026-90128 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
- CVE-2026-90127 virtio: rtc: time out alarm requests
- CVE-2026-90126 rtc: pcf8563: fix clock provider leak on unbind
- CVE-2026-90125 smb: client: fix request buffer leak in smb2_new_read_req()
- CVE-2026-90124 irqchip/renesas-rzg2l: Fix loss of interrupt
- CVE-2026-90123 irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback
- CVE-2026-90122 clk: visconti: Make sure clk_init_data is fully initialized
- CVE-2026-90121 irqchip/gic-v5: Clear per-CPU IRS data on teardown
- CVE-2026-90120 irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing
- CVE-2026-90119 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
- CVE-2026-90118 ntfs: fix off-by-one page overflow in ntfs_decompress()
- CVE-2026-90117 ntfs: validate usa_ofs before preserving the update sequence number
- CVE-2026-90116 ALSA: mtpav: shut down output timer before card teardown
- CVE-2026-90115 xsk: fix NULL pointer dereference in __xsk_rcv()
- CVE-2026-90114 net: bridge: Reject descending VLAN tunnel ranges
- CVE-2026-90113 netdevsim: update queue NAPI association on queue reset
- CVE-2026-90112 net: qlcnic: validate unified ROM sections before loading
- CVE-2026-90111 ip6mr: do not clone dst in ip6mr_cache_report()
- CVE-2026-90110 inetpeer: randomize RB-tree node comparison using SipHash
- CVE-2026-9011 Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action
- CVE-2026-90109 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
- CVE-2026-90108 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
- CVE-2026-90107 net/smc: free pending qentry in smc_llc_flow_stop() before memset
- CVE-2026-90106 net: bridge: arp/nd proxy: fix reading neigh ha
- CVE-2026-90105 vxlan: fix reading neigh ha
- CVE-2026-90104 NFSv4.1: zero referring call lists before decoding
- CVE-2026-90103 NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
- CVE-2026-90102 NFSv4/pnfs: key the data server cache on the NFS version
- CVE-2026-90101 bnxt_en: Fix call to hardware monitoring event handler
- CVE-2026-90100 ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
- CVE-2026-9010 Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters
- CVE-2026-90099 net/sched: account classifier filter allocations to memcg
- CVE-2026-90098 net: sparx5: fix sleep in atomic context in MAC table access
- CVE-2026-90097 Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
- CVE-2026-90096 fuse: invalidate the correct range after O_APPEND direct write
- CVE-2026-90095 fuse: Fix the condition to enable over-io-uring
- CVE-2026-90094 arm64: process: Fix context switching MTE store-only tag check
- CVE-2026-90093 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
- CVE-2026-90092 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
- CVE-2026-90091 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
- CVE-2026-90090 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
- CVE-2026-9009 Code injection in Crawlomatic Multipage Scraper Post Generator
- CVE-2026-90089 Bluetooth: btnxpuart: Validate the FW dump header length
- CVE-2026-90088 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
- CVE-2026-90087 Bluetooth: do not leak an hci_conn when a second LE connect is rejected
- CVE-2026-90086 xsk: honor XDP_TX_METADATA in zero-copy path
- CVE-2026-90085 octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
- CVE-2026-90084 octeontx2-vf: fix workqueue and netdev race in probe/remove
- CVE-2026-90083 net/sched: act_ife: Only operate on Ethernet frames
- CVE-2026-90082 net: mana: Cap MSI-X vectors to the device MSI-X table size
- CVE-2026-90081 net/rds: use wq_has_sleeper() in rds_cong_map_updated()
- CVE-2026-90080 octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
- CVE-2026-9008 Missing authorization in Page-list
- CVE-2026-90079 octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()
- CVE-2026-90078 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
- CVE-2026-90077 net: fix a resource leak in copy_net_ns() error handling path
- CVE-2026-90076 net/sched: fq: add overflow bounds to quantum and initial quantum
- CVE-2026-90075 net/sched: fq_codel: clamp default quantum and mtu
- CVE-2026-90074 net/sched: fq_pie: clamp default quantum to avoid signed overflow
- CVE-2026-90073 net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
- CVE-2026-90072 net/sched: sfq: clamp quantum to avoid signed overflow soft lockup