Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 275 of 1013.
- CVE-2026-89519 sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return
- CVE-2026-89518 sched_ext: Fix this_rq() assumptions in dispatch kfuncs
- CVE-2026-89517 sched_ext: Fix rq->core_pick corruption under core scheduling
- CVE-2026-89516 sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
- CVE-2026-89515 scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
- CVE-2026-89514 scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
- CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow
- CVE-2026-89512 remoteproc: scp: Fix device reference leak on failed lookup
- CVE-2026-89511 qede: Fix NULL pointer dereference in TPA fragment processing
- CVE-2026-89510 RDMA/cxgb4: Cancel reg_work before freeing device on remove
- CVE-2026-8951 Spoofing issue in the Toolbar component in Firefox for Android
- CVE-2026-89509 RDMA/ionic: Embed counter driver data in rdma_counter allocation
- CVE-2026-89508 RDMA/ucma: Lock the handler in ucma_set_ib_path()
- CVE-2026-89507 RDMA/ucma: Lock the handler in ucma_write_cm_event()
- CVE-2026-89506 RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
- CVE-2026-89505 RDMA/uverbs: Guard legacy bundles without method_elm
- CVE-2026-89504 regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
- CVE-2026-89503 ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
- CVE-2026-89502 ring-buffer: Free cpu_buffer::free_page with subbuf_order
- CVE-2026-89501 ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
- CVE-2026-89500 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
- CVE-2026-8950 Same-origin policy bypass in the Networking: HTTP component
- CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails
- CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure
- CVE-2026-89497 orangefs: skip leading spaces before parsing client debug masks
- CVE-2026-89496 ocfs2: always run deallocs on copy-on-write completion
- CVE-2026-89495 ocfs2: bound namelen in dlm_migrate_request_handler
- CVE-2026-89494 ocfs2: validate lengths in dlm_mig_lockres_handler
- CVE-2026-89493 ocfs2: validate rl_used against rl_count in refcount block validator
- CVE-2026-89492 ocfs2: validate directory-index entry counts when reading metadata
- CVE-2026-89491 ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
- CVE-2026-89490 ocfs2: fix readdir position truncation on 32-bit kernels
- CVE-2026-8949 Integer overflow in the Widget: Win32 component
- CVE-2026-89489 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
- CVE-2026-89488 openvswitch: Fix CT limit teardown use-after-free
- CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop
- CVE-2026-89486 ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
- CVE-2026-89485 lockd: pin next file across nlm_inspect_file lock-drop
- CVE-2026-89484 lockd: fix NULL dereference on lockowner allocation failure
- CVE-2026-89483 nvme: zero the discard fallback page
- CVE-2026-89482 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
- CVE-2026-89481 nvme-tcp: fix host memory disclosure on R2T for a read command
- CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes
- CVE-2026-8948 Same-origin policy bypass in the DOM: Networking component
- CVE-2026-89479 sctp: stop processing a packet once its association is deleted
- CVE-2026-89478 sctp: drop a chunk if its transport was removed
- CVE-2026-89477 sctp: fix NULL deref on untransmitted RECONF completion
- CVE-2026-89476 sctp: fix stream->outcnt underflow on duplicate RECONF responses
- CVE-2026-89475 power: supply: bq24257: fix use-after-free on remove
- CVE-2026-89474 power: supply: bq256xx: drain usb_work before freeing the charger
- CVE-2026-89473 power: supply: bq25890: Fix power_supply reference leak
- CVE-2026-89472 power: supply: charger-manager: register regulators before exposing sysfs
- CVE-2026-89471 power: supply: cros_usbpd-charger: bound the EC-reported port count
- CVE-2026-89470 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
- CVE-2026-8947 Use-after-free in the DOM: Bindings (WebIDL) component
- CVE-2026-89469 power: supply: lp8727: fix use-after-free in lp8727_release_irq()
- CVE-2026-89468 power: supply: lp8788-charger: fix use-after-free on remove
- CVE-2026-89467 power: supply: qcom_battmgr: fix use-after-free
- CVE-2026-89466 power: supply: qcom_battmgr: terminate the strings from firmware
- CVE-2026-89465 power: supply: rt9455: quiesce delayed work before teardown
- CVE-2026-89464 power: supply: twl4030_charger: cancel workers via devm
- CVE-2026-89463 power: supply: ucs1002: fix use-after-free on remove
- CVE-2026-89462 power: supply: max17040: propagate register read errors
- CVE-2026-89461 power: supply: max17040: synchronize work cancellation on suspend
- CVE-2026-89460 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
- CVE-2026-8946 Incorrect boundary conditions in the Audio/Video: Web Codecs component
- CVE-2026-89459 s390/percpu: Fix MVIY_PERCPU() with older binutils
- CVE-2026-89458 s390/dasd: Do not complete a failed ESE read as successful
- CVE-2026-89457 s390/dasd: Guard sysfs discipline callbacks against unallocated private data
- CVE-2026-89456 s390/dasd: Propagate partial completion length across ERP recovery
- CVE-2026-89455 PCI: plda: Fix use-after-free of event IRQs during teardown
- CVE-2026-89454 PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
- CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults
- CVE-2026-89452 iommu/msm: Unwind probe state on registration failure
- CVE-2026-89451 iommu/sva: Set handle->dev before the SVA handle is visible
- CVE-2026-89450 iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
- CVE-2026-8945 Sandbox escape in Firefox and Firefox Focus for Android
- CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
- CVE-2026-89448 iommu/vt-d: Force requesting ACS when tboot is enabled
- CVE-2026-89447 iommufd: Avoid locking internal accesses during unmap
- CVE-2026-89446 iommufd: Release current IOAS on xa_store() failure
- CVE-2026-89445 iommufd: Fix UAF in selftest IOPF reporting
- CVE-2026-89444 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
- CVE-2026-89443 platform/x86: ISST: Validate level in perf mask ioctls
- CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl
- CVE-2026-89441 mmc: via-sdmmc: cancel card-detect work on remove
- CVE-2026-89440 mmc: via-sdmmc: stop card-detect handling on probe failure
- CVE-2026-8944 Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter
- CVE-2026-89439 platform/x86: ISST: Add a NULL check for sst_inst[]
- CVE-2026-89438 platform/x86: ISST: Validate logical CPU id and clos id
- CVE-2026-89437 platform/x86: int1092: Fix potential memory leak in sar_probe()
- CVE-2026-89436 platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]
- CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts
- CVE-2026-8943 GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function
- CVE-2026-89427 Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter
- CVE-2026-89426 Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
- CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)
- CVE-2026-89424 Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter
- CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension
- CVE-2026-89420 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free