Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 344 of 1013.
- CVE-2026-80993 net: phylink: correctly validate returned PCS in phylink_inband_caps
- CVE-2026-80992 net: ravb: avoid dereferencing an invalid PTP clock
- CVE-2026-80991 net: ravb: serialize PTP clock teardown
- CVE-2026-80990 net: thunderbolt: Release the Rx HopID that was handed out on mismatch
- CVE-2026-80989 net: thunderbolt: Mark the connection down when bringing it up fails
- CVE-2026-80988 NTB: ntb_transport: Fail TX enqueue when the QP link is down
- CVE-2026-80987 NTB: ntb_transport: Reject oversized TX buffers
- CVE-2026-80986 net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
- CVE-2026-80985 net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
- CVE-2026-80984 net/smc: do not dereference an unset send buffer on the SMC-D teardown path
- CVE-2026-80983 net/smc: fix socket refcount leak in smc_switch_conns()
- CVE-2026-80982 net/smc: fix use-after-free in smc_rx_pipe_buf_release()
- CVE-2026-80981 net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
- CVE-2026-80980 net/smc: stop killed, freed and out_of_sync sharing a byte
- CVE-2026-8098 code-projects Feedback System checklogin.php sql injection
- CVE-2026-80979 net/smc: unregister the connection before draining the rx tasklet
- CVE-2026-80978 net: cap advertised IP tunnel headroom
- CVE-2026-80977 net: skbuff: don't touch shared zerocopy state in skb_tx_error()
- CVE-2026-80976 seg6: reset IP6CB after IPv6 decapsulation
- CVE-2026-80975 mfd: qnap-mcu: keep the reply buffer alive past a command timeout
- CVE-2026-80974 mfd: sm501: Fix potential memory leaks during remove
- CVE-2026-80973 ALSA: 6fire: bound the MIDI event length from the device
- CVE-2026-80972 ALSA: aloop: Check card index validity at probe
- CVE-2026-80971 ALSA: bcd2000: clear the URB pointers on disconnect
- CVE-2026-80970 ALSA: FCP: do not copy out an uninitialised init response
- CVE-2026-8097 CodeAstro Online Classroom askquery.php sql injection
- CVE-2026-80969 ALSA: mpu401: Check card index validity at probe
- CVE-2026-80968 ALSA: mts64: Check card index validity at probe
- CVE-2026-80967 ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
- CVE-2026-80966 ALSA: portman2x4: Check card index validity at probe
- CVE-2026-80965 ALSA: serial-u16550: Check card index validity at probe
- CVE-2026-80964 ALSA: virmidi: Check card index validity at probe
- CVE-2026-80963 dm-stats: fix a crash if allocation of per-cpu data fails
- CVE-2026-80962 dm-pcache: validate geometry fields from on-disk cache_info
- CVE-2026-80961 dm-pcache: validate kset key_num and intra-segment bounds
- CVE-2026-80960 dm-pcache: validate on-media seg_num against the cache device size
- CVE-2026-8096 Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer
- CVE-2026-80959 dm-pcache: bound the persisted tail-position offset
- CVE-2026-80958 dm-pcache: clamp the tail kset read to the segment data region
- CVE-2026-80957 dm-pcache: detect a cycle in the last-kset chain during replay
- CVE-2026-80956 dm-pcache: only hand out initialized cache segments
- CVE-2026-80955 dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
- CVE-2026-80954 i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()
- CVE-2026-80953 i3c: master: adi: initialize the lock before enabling interrupts
- CVE-2026-80952 i3c: master: Fix info leak and UAF in device unregister path
- CVE-2026-80951 i3c: master: svc: bound IBI payload to the requested max_payload_len
- CVE-2026-80950 i3c: renesas: Check that the transfer is valid before accessing it
- CVE-2026-8095 Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2026-80949 wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
- CVE-2026-80948 wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
- CVE-2026-80947 wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
- CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring
- CVE-2026-80945 crypto: iaa - unmap dst before software fallback on decompress
- CVE-2026-80944 wifi: mwifiex: Detach sync cmd buffer on interrupted wait
- CVE-2026-80943 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
- CVE-2026-80942 wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
- CVE-2026-80941 wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
- CVE-2026-80940 wifi: rtw88: pci: fix resource leak on failed NAPI setup
- CVE-2026-8094 Other issue in the WebRTC component
- CVE-2026-80939 wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
- CVE-2026-80938 wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
- CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
- CVE-2026-80936 wifi: mt76: mt7925: cancel mlo_pm_work on stop
- CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
- CVE-2026-80934 wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
- CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size
- CVE-2026-80932 vsock/virtio: flush works in dependency order
- CVE-2026-80931 w1: ds28e17: reject an oversize length on an I2C block read
- CVE-2026-80930 tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
- CVE-2026-8093 Memory safety bugs fixed in Thunderbird 150.0.2
- CVE-2026-80929 sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
- CVE-2026-80928 smack: fix cred UAF in smack_file_send_sigiotask()
- CVE-2026-80927 timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
- CVE-2026-80926 ksmbd: fix use-after-free in oplock break notification
- CVE-2026-80925 vlan: fix skb_under_panic and races when toggling HW VLAN offload
- CVE-2026-80924 crypto: krb5 - use kfree_sensitive() for derived key buffers
- CVE-2026-80923 xhci: dbgtty: Fix unregister on tty_register_driver() failure
- CVE-2026-80922 crypto: qcom-rng - Allow zero as a random number
- CVE-2026-80921 KVM: s390: vsie: zero stale crypto bits
- CVE-2026-80920 io_uring: defer eventfd signaling when queued from a wakeup handler
- CVE-2026-8092 Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2
- CVE-2026-80919 drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
- CVE-2026-80918 HID: core: fix number/pointer type confusion on long items
- CVE-2026-80917 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
- CVE-2026-80916 kcov: fix data corruption and race conditions on PREEMPT_RT
- CVE-2026-80915 drm/xe: Fix DPT allocation paths.
- CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
- CVE-2026-80913 selinux: require every boolean value to be defined
- CVE-2026-80912 selinux: reject an unclaimed class value in security_get_classes()
- CVE-2026-80911 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
- CVE-2026-80910 ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
- CVE-2026-8091 Incorrect boundary conditions in the Audio/Video: Playback component
- CVE-2026-80909 drm/amdgpu: Reject UVD message with invalid number of h265 refs
- CVE-2026-80908 drm/amdgpu: Reject UVD message with dimensions above 4096
- CVE-2026-80907 drm/amdgpu: Fix UVD dpb min size calculation for H264
- CVE-2026-80906 net: packet: fix wrong transport_header when sending VLAN-tagged frame
- CVE-2026-80905 net: tap: fix wrong transport_header when sending VLAN-tagged frame
- CVE-2026-80904 net/tls: Fail tls_sw_splice_read() after a failed async decrypt
- CVE-2026-80903 drm/xe/oa: Fix sync entry leak on OA config emit failure
- CVE-2026-80902 dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA