Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 270 of 1013.
- CVE-2026-89974 nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
- CVE-2026-89973 nvme-tcp: check the data direction of a C2HData PDU
- CVE-2026-89972 nvme: add missing SRCU grace period in error path
- CVE-2026-89971 nvme: skip the zoned limits update if the zone info query failed
- CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown
- CVE-2026-8997 Heap Buffer Overflow in vifm
- CVE-2026-89969 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
- CVE-2026-89968 nvmet-tcp: reject unsolicited H2CData PDUs
- CVE-2026-89967 mm/migrate_device: avoid out-of-bounds writes for compound folios
- CVE-2026-89966 mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
- CVE-2026-89965 nvdimm/btt: reject an arena whose nfree is below the lane count
- CVE-2026-89964 parisc: eisa: Fix infinite loop when parsing invalid IRQ value
- CVE-2026-89963 powerpc/kexec_file: Fix null-ptr-def in extra size calculation
- CVE-2026-89962 powerpc/kexec_file: Prevent kexec range truncation
- CVE-2026-89961 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
- CVE-2026-89960 s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
- CVE-2026-8996 Missing authorization in Backup and Staging by WP Time Capsule
- CVE-2026-89959 s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
- CVE-2026-89958 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
- CVE-2026-89957 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
- CVE-2026-89956 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
- CVE-2026-89955 s390/vfio-ap: Fix NULL deref in status_show() during queue probe
- CVE-2026-89954 mtd: afs: validate v2 image info bounds
- CVE-2026-89953 mtd: mtdoops: free page bitmap when the backing MTD is removed
- CVE-2026-89952 mtd: rawnand: validate ONFI extended parameter page sections
- CVE-2026-89951 batman-adv: fix stale receive device on merged fragments
- CVE-2026-89950 batman-adv: mcast: linearize skbuff for packet generation
- CVE-2026-8995 Missing authorization in Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
- CVE-2026-89949 batman-adv: dat: avoid unaligned fault in IP extraction
- CVE-2026-89948 batman-adv: bla: fix freeing of claims on meshif deletion
- CVE-2026-89947 clk: meson: align gxbb_32k_clk_sel number of parents with actual count
- CVE-2026-89946 ASoC: cs35l33: drain threaded IRQ before runtime suspend
- CVE-2026-89945 ASoC: cs35l34: drain threaded IRQ before runtime suspend
- CVE-2026-89944 ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
- CVE-2026-89943 ASoC: loongson: Fix error handling in ACPI property parsing
- CVE-2026-89942 iio: buffer: Fix potential use-after-free in anonymous buffer release
- CVE-2026-89941 iio: buffer: Make IIO DMA fence release RCU-safe
- CVE-2026-89940 iio: buffer: Tie IIO dma fence lock lifetime to the fence
- CVE-2026-8994 Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter
- CVE-2026-89939 iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
- CVE-2026-89938 iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
- CVE-2026-89937 iio: chemical: sgp30: Handle IAQ thread creation failure
- CVE-2026-89936 iio: dac: m62332: Fix regulator reference count imbalance
- CVE-2026-89935 iio: light: apds9306: fix PM reference leak in apds9306_read_data()
- CVE-2026-89934 iio: light: ltrf216a: fix runtime PM reference leak in error path
- CVE-2026-89933 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
- CVE-2026-89932 KVM: nVMX: Always flush vpid02 on first use
- CVE-2026-89931 KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
- CVE-2026-89930 KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
- CVE-2026-8993 Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks
- CVE-2026-89929 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
- CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
- CVE-2026-89927 KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
- CVE-2026-89926 KVM: s390: Fix length check __import_wp_info()
- CVE-2026-89925 KVM: s390: Fix memory leak in guest debug handling
- CVE-2026-89924 KVM: s390: Fix old_data leak in guest debug error path
- CVE-2026-89923 KVM: s390: Free guest debug data on vcpu destroy
- CVE-2026-89922 KVM: s390: Take srcu when importing watchpoint data
- CVE-2026-89921 KVM: s390: Zero initialize data structures for inject_pfault_token
- CVE-2026-89920 KVM: s390: Fix memory corruption by not reinjecting CK machine checks
- CVE-2026-8992 Security feature bypass in Secure Access Client
- CVE-2026-89919 KVM: s390: keyop: use mmu_lock to read gmap->asce
- CVE-2026-89918 KVM: arm64: Correctly handle end of VA space TLBI invalidation
- CVE-2026-89917 KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping
- CVE-2026-89916 KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
- CVE-2026-89915 KVM: arm64: Remove VM-wide VNCR mapping counter
- CVE-2026-89914 KVM: arm64: Sign-extend VA for range-based TLBI invalidation
- CVE-2026-89913 KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
- CVE-2026-89912 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
- CVE-2026-89911 KVM: arm64: Correctly cap TLBI Range to the architural limit
- CVE-2026-89910 LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc
- CVE-2026-8991 Cross-site scripting in Drag and Drop Multiple File Upload for Contact Form 7
- CVE-2026-89909 LoongArch: KVM: Free init resources if kvm_init() fails
- CVE-2026-89908 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
- CVE-2026-89907 LoongArch: KVM: Validate MSI data before routing it to EIOINTC
- CVE-2026-89906 LoongArch: BPF: Refactor jump offset calculation in tail call
- CVE-2026-89905 LoongArch: BPF: Move arena register slot below TCC context
- CVE-2026-89904 LoongArch: Fix acpi_package_ids[] array overflow
- CVE-2026-89903 LoongArch: Do not save/restore percpu base register in rethook trampoline
- CVE-2026-89902 LoongArch: Avoid preempt count underflow without probe
- CVE-2026-89901 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
- CVE-2026-89900 media: cec: core: Fix kmemleak due to missed rc_free_device() call
- CVE-2026-8990 Authentication Bypass in Kidsview
- CVE-2026-89899 media: cec: disable delayed work before freeing an interrupted transmit
- CVE-2026-89898 media: cec: extron-da-hd-4k-plus: add sanity check
- CVE-2026-89897 media: cec: Serialize exclusive follower delivery
- CVE-2026-89896 media: cedrus: fix memory leak in cedrus_init_ctrls()
- CVE-2026-89895 media: cobalt: Avoid freeing ALSA private data twice
- CVE-2026-89894 media: cx231xx: reject geometry changes while the VBI queue is busy
- CVE-2026-89893 media: cx23885: cancel NetUP CI work before teardown
- CVE-2026-89892 media: em28xx: defer audio-only extension registration
- CVE-2026-89891 media: em28xx: fix use-after-free of dev_next->devlist on disconnect
- CVE-2026-89890 media: go7007: defer the ALSA v4l2 put until card release
- CVE-2026-8989 Open Recovery Mode
- CVE-2026-89889 media: i2c: imx415: Release runtime PM reference on VBLANK error
- CVE-2026-89888 media: i2c: ov02a10: fix endpoint parsing use-after-free
- CVE-2026-89887 media: i2c: ov7740: fix use-after-destroy in remove
- CVE-2026-89886 media: intel/ipu6: fix async notifier cleanup leak on parse error
- CVE-2026-89885 media: platform: mtk-mdp3: Fix SCP device refcounting
- CVE-2026-89884 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup