Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 272 of 1013.
- CVE-2026-89792 ksmbd: prevent out-of-bounds reads in share config responses
- CVE-2026-89791 perf: Fix use-after-free when perf mmap() revival races with the last munmap()
- CVE-2026-89790 ipv6: avoid divide by zero in rt6_multipath_rebalance
- CVE-2026-8979 Authentication Bypass
- CVE-2026-89789 gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
- CVE-2026-89788 ksmbd: fix tree connection use-after-free in smb2_tree_connect()
- CVE-2026-89787 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
- CVE-2026-89786 ext4: fix out-of-bounds read in ext4_read_inline_dir()
- CVE-2026-89785 fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
- CVE-2026-89784 SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
- CVE-2026-89783 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
- CVE-2026-89782 fs/ntfs3: reject restart table growth beyond U16_MAX entries
- CVE-2026-89781 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
- CVE-2026-89780 net: qualcomm: rmnet: restore skb->dev on deaggregated frames
- CVE-2026-8978 OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order_by' Parameter
- CVE-2026-89779 fs/ntfs3: validate ef->size covers the record's name and value
- CVE-2026-89778 isofs: fix out-of-bounds page array access on empty zisofs block
- CVE-2026-89777 vfio/pci: clear vdev->msi_perm after freeing it on init failure
- CVE-2026-89776 vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
- CVE-2026-89775 KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
- CVE-2026-89774 Bluetooth: SCO: hold sk properly in sco_conn_ready
- CVE-2026-89773 drm/amd/display: Skip Update HDCP Config In Transition State
- CVE-2026-89772 btrfs: write-protect folios during data writeback
- CVE-2026-89771 ring-buffer: Fix subbuf resize race with ring buffer readers
- CVE-2026-89770 iomap: don't free integrity payload that doesn't exist
- CVE-2026-8977 Cross-site scripting in WP GDPR Cookie Consent
- CVE-2026-89769 clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
- CVE-2026-89768 fs: fix user path of nested backing files
- CVE-2026-89767 ovl: fix double end_creating() on the casefold-mismatch path
- CVE-2026-89766 pidfd: hold exec_update_lock around namespace ioctl
- CVE-2026-89765 timers/itimer: Zero-init old itimerval before copy to userspace
- CVE-2026-89764 rust: devres: fix race between concurrent revokers
- CVE-2026-89763 KEYS: trusted: Fix TPM teardown ordering
- CVE-2026-89762 apparmor: fix cred UAF caused by begin_current_label_crit_section()
- CVE-2026-89761 apparmor: fix out-of-bounds write when null terminating a label vec
- CVE-2026-89760 mm, swap: don't free a hibernation slot that is in the swap cache
- CVE-2026-8976 Missing authorization in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- CVE-2026-89759 mm/kmemleak: avoid soft lockup when scanning task stacks
- CVE-2026-89758 mm/mempolicy: skip non-present PMDs when queueing folios
- CVE-2026-89757 mm/mglru: fix and remove redundant unevictable folio handling
- CVE-2026-89756 mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
- CVE-2026-89755 mm/migrate_device: clear stale mapping after freeing swapcache
- CVE-2026-89754 mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
- CVE-2026-89753 mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
- CVE-2026-89752 mm: memcg: stop reclaim when a limit update is superseded
- CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling
- CVE-2026-89750 tracing/user_events: Clear copied tracing state before fork duplication
- CVE-2026-8975 Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151
- CVE-2026-89749 tracing: Fix crash passing ERR_PTR to kthread_stop()
- CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap
- CVE-2026-89747 tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
- CVE-2026-89746 tracing: Fix use-after-free with same-name named triggers
- CVE-2026-89745 debugfs: Fix lockdown check for mmap_prepare
- CVE-2026-89744 device property: fix infinite loop in fwnode_for_each_child_node()
- CVE-2026-89743 misc: nsm: bound the device-reported response length
- CVE-2026-89742 rapidio: mport_cdev: fix use-after-free in dma_req_free()
- CVE-2026-89741 Revert "media: v4l2-dev: fix error handling in __video_register_device()"
- CVE-2026-89740 serial: imx: serialize imx_uart_ports[] lifetime
- CVE-2026-8974 Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151
- CVE-2026-89739 usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
- CVE-2026-89738 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
- CVE-2026-89737 usb: typec: thunderbolt: Disable work before freeing tbt on remove
- CVE-2026-89736 usb: gadget: u_audio: Fix use-after-free on sound card disconnect
- CVE-2026-89735 usb: gadget: midi2: remove default configfs groups on teardown
- CVE-2026-89734 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
- CVE-2026-89733 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
- CVE-2026-89732 usb: gadget: f_fs: Prevent deadlock during ep0 read loop
- CVE-2026-89731 cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
- CVE-2026-89730 fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
- CVE-2026-8973 Memory safety bugs fixed in Thunderbird 151
- CVE-2026-89729 HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
- CVE-2026-89728 i3c: renesas: Fix out-of-bounds access for newdevs mask
- CVE-2026-89727 KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
- CVE-2026-89726 lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
- CVE-2026-89725 media: cec: stm32: prevent out-of-bounds write on RX overflow
- CVE-2026-89724 media: vicodec: fix out-of-bounds write in FWHT encoder
- CVE-2026-89723 nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
- CVE-2026-89722 PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
- CVE-2026-89721 phy: rockchip-samsung-dcphy: fix out-of-range max_register
- CVE-2026-89720 ubifs: fix out-of-bounds read in signature length check
- CVE-2026-8972 Privilege escalation in the WebRTC: Audio/Video component
- CVE-2026-89719 zram: fix out-of-bounds access in read_block_state()
- CVE-2026-89718 zram: fix out-of-bounds access in writeback_store()
- CVE-2026-89717 zram: set default primary compressor in zram_destroy_comps()
- CVE-2026-89716 zram: validate deflate params
- CVE-2026-89715 NFS/localio: fix ref leak on nfs_uuid_add_file failure
- CVE-2026-89714 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
- CVE-2026-89713 NFSD: check truncate permission under inode lock
- CVE-2026-89712 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
- CVE-2026-89711 NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
- CVE-2026-89710 NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
- CVE-2026-8971 Same-origin policy bypass in the Networking: JAR component
- CVE-2026-89709 lockd, nfsd: RCU-protect nlmsvc_ops dispatch
- CVE-2026-89708 nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
- CVE-2026-89707 nfsd: release path refs on follow_down() error
- CVE-2026-89706 nfsd: Reset write verifier when async COPY writeback fails
- CVE-2026-89705 nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
- CVE-2026-89704 nfsd: sample writeback error cursor before async COPY loop
- CVE-2026-89703 nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
- CVE-2026-89702 nfsd: size fh_verify server sockaddr slot by xpt_locallen