Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 271 of 1013.
- CVE-2026-89883 media: rc: sunxi-cir: Unregister rc device on probe failure
- CVE-2026-89882 media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow
- CVE-2026-89881 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
- CVE-2026-89880 media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
- CVE-2026-8988 Access to Bootloader
- CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer
- CVE-2026-89878 media: s2255: check firmware size before reading trailing marker
- CVE-2026-89877 media: saa7164: fix cleanup on resource allocation failure
- CVE-2026-89876 media: tda18250: fix possible integer overflow
- CVE-2026-89875 media: ti: vpe: quiesce overflow recovery before freeing streams
- CVE-2026-89874 media: v4l2-async: avoid deleting unlinked ASC entry on link error
- CVE-2026-89873 media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
- CVE-2026-89872 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
- CVE-2026-89871 media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
- CVE-2026-89870 media: zoran: Avoid freeing a registered video_device twice
- CVE-2026-8987 Authenticated Heap Overflow
- CVE-2026-89869 media: qcom: iris: use disable_irq() during power-off
- CVE-2026-89868 media: chips-media: wave5: Add timeout while stop_streaming
- CVE-2026-89867 media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued
- CVE-2026-89866 media: chips-media: wave5: Resume device before setting EOS flag
- CVE-2026-89865 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
- CVE-2026-89864 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
- CVE-2026-89863 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
- CVE-2026-89862 scsi: qla2xxx: Fix BSG job leak on validate flash image error path
- CVE-2026-89861 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
- CVE-2026-89860 scsi: qla2xxx: Initialize NVMe abort_work once at submission
- CVE-2026-8986 Command Injection via Malicious OCPP Server
- CVE-2026-89859 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
- CVE-2026-89858 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
- CVE-2026-89857 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
- CVE-2026-89856 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
- CVE-2026-89855 scsi: qla2xxx: Serialize flash version read in reset handler
- CVE-2026-89854 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
- CVE-2026-89853 scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
- CVE-2026-89852 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
- CVE-2026-89851 scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
- CVE-2026-89850 scsi: qla2xxx: Don't query firmware state while chip is down
- CVE-2026-8985 Unauthenticated Command Injection
- CVE-2026-89849 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
- CVE-2026-89848 scsi: qla2xxx: Quiesce response IRQ before freeing request queue
- CVE-2026-89847 scsi: qla2xxx: Avoid double completion in async IOCB timeout
- CVE-2026-89846 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
- CVE-2026-89845 scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
- CVE-2026-89844 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
- CVE-2026-89843 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
- CVE-2026-89842 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
- CVE-2026-89841 f2fs: only redirty pinned folios in redirty_blocks
- CVE-2026-89840 f2fs: validate MOVE_RANGE destination size
- CVE-2026-8984 Unauthenticated RCE
- CVE-2026-89839 f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
- CVE-2026-89838 f2fs: limit recovery filename logging to stored length
- CVE-2026-89837 f2fs: fix dentry folio leak in find_in_level
- CVE-2026-89836 f2fs: fix folio_nr_pages() race after put in large folio invalidate
- CVE-2026-89835 f2fs: avoid NULL checkpoint thread access in sysfs
- CVE-2026-89834 f2fs: fix to migrate all curseg types during free_segment_range
- CVE-2026-89833 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
- CVE-2026-89832 f2fs: fix to clear dirty flag on folio in error path
- CVE-2026-89831 f2fs: protect critical_task_priority updates with s_umount
- CVE-2026-89830 f2fs: fix valid block count leak on data block allocation failure
- CVE-2026-8983 Backdoor Authentication Token
- CVE-2026-89829 f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
- CVE-2026-89828 drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
- CVE-2026-89827 drm/amdgpu: avoid force-completing uninitialized UVD rings
- CVE-2026-89826 drm/panthor: harden firmware build-info bounds checks
- CVE-2026-89825 drm/panthor: fix firmware control interface bounds checks
- CVE-2026-89824 drm/panel-edp: fix i2c adapter leak on probe failure
- CVE-2026-89823 drm: fix race between partial drm_dev_register() failure and ioctl
- CVE-2026-89822 drm/i915: Guard against NULL driver_data in i915_pci_probe()
- CVE-2026-89821 drm/amd/display: avoid divide-by-zero in __is_lut_linear()
- CVE-2026-89820 drm/amd/display: fix dc_lock leak on GPU reset error paths
- CVE-2026-8982 Hard-coded / Backdoor Accounts
- CVE-2026-89819 drm/amd/display: validate plane degamma LUT size for private color prop
- CVE-2026-89818 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
- CVE-2026-89817 drm/gud: NUL-terminate TV mode names read from the device
- CVE-2026-89816 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
- CVE-2026-89815 drm/ttm: Drop tt->restore after successful restore
- CVE-2026-89814 drm/amdgpu: clamp the isolation index for rings outside a partition
- CVE-2026-89813 drm/amdgpu: force complete the KIQ ring fences on reset
- CVE-2026-89812 drm/amdgpu: force complete the MES ring fences on reset
- CVE-2026-89811 drm/amdkfd: Add TLB flush after MES queue eviction/suspension
- CVE-2026-89810 drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
- CVE-2026-8981 Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTML
- CVE-2026-89809 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
- CVE-2026-89808 drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
- CVE-2026-89807 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
- CVE-2026-89806 drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
- CVE-2026-89805 drm/pagemap: Fix folio allocation fallback and use-after-put
- CVE-2026-89804 drm/nouveau/dmem: fix mismatched DMA unmap size for large folios
- CVE-2026-89803 drm/nouveau: unsubscribe the channel-kill event before the fence context
- CVE-2026-89802 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
- CVE-2026-89801 drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
- CVE-2026-89800 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
- CVE-2026-8980 Privilege Escalation
- CVE-2026-89799 bpf: Disable preemption in bpf_get_stackid
- CVE-2026-89798 rpcrdma: arm rn_done before publishing the notification
- CVE-2026-89797 power: supply: ab8500_fg: fix use-after-free on remove
- CVE-2026-89796 mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
- CVE-2026-89795 PCI: Allow per function PCI slots to fix slot reset on s390
- CVE-2026-89794 ksmbd: zero pipe read compound padding
- CVE-2026-89793 ublk: clear VM_MAYWRITE on read-only ublk char device mmap