Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 345 of 1013.
- CVE-2026-80901 ipvs: fix the checksum validations
- CVE-2026-80900 ASoC: SDCA: Make UMP message size check more robust
- CVE-2026-8090 Use-after-free in the DOM: Networking component
- CVE-2026-80899 erofs: remove fscache backend entirely
- CVE-2026-80898 netfs: clear PG_private_2 on copy-to-cache append failure
- CVE-2026-80897 netfs: release readahead folios on iterator preparation failure
- CVE-2026-80896 mshv: Fix race in mshv_irqfd_deassign
- CVE-2026-80895 mshv: Order pt_vp_array publish against irqfd assertion path
- CVE-2026-80894 iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
- CVE-2026-80893 mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
- CVE-2026-80892 erofs: cap LZMA stream pool size
- CVE-2026-80891 KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
- CVE-2026-80890 sctp: reject stale cookies with mismatched verification tags
- CVE-2026-8089 weMail < 2.1.3 - Reflected Cross-Site Scripting
- CVE-2026-80889 can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
- CVE-2026-80888 drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- CVE-2026-80887 drm/vmwgfx: use check_add_overflow for shader size+offset bound
- CVE-2026-80886 serial: msm: Disable DMA for kernel console UART
- CVE-2026-80885 afs: Fix uncancelled rxrpc OOB message handler
- CVE-2026-80884 ntb: Store original DMA address for future release
- CVE-2026-80883 drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
- CVE-2026-80882 crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm
- CVE-2026-80881 ocfs2: fix buffer head management in ocfs2_read_blocks()
- CVE-2026-80880 IB/mlx5: Properly support implicit ODP rereg_mr
- CVE-2026-8088 OSGeo gdal GDapi.c GDfieldinfo out-of-bounds
- CVE-2026-80879 ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
- CVE-2026-80878 afs: Fix leak of ungot volume
- CVE-2026-80877 afs: Fix vllist leak
- CVE-2026-80876 ring-buffer: Fix event length with forced 8-byte alignment
- CVE-2026-80875 ipvs: use parsed transport offset in TCP state lookup
- CVE-2026-80874 arm64: dts: renesas: ironhide: Describe inline ECC carveouts
- CVE-2026-80873 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
- CVE-2026-80872 ALSA: hda/tas2781: Cancel async firmware request at unbind
- CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface
- CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
- CVE-2026-8087 OSGeo gdal GDapi.c GDnentries heap-based overflow
- CVE-2026-80869 ntfs: bound the attribute-list entry in ntfs_read_inode_mount()
- CVE-2026-80868 ntfs3: Allocate iomap inline_data using alloc_page
- CVE-2026-80867 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
- CVE-2026-80866 tipc: avoid busy looping in tipc_exit_net()
- CVE-2026-80865 bpf: Add missing access_ok call to copy_user_syms
- CVE-2026-80864 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
- CVE-2026-80863 RDMA/rxe: Fix OOB in free_rd_atomic_resources()
- CVE-2026-80862 nvme-tcp: fix usage of page_frag_cache
- CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible
- CVE-2026-80860 fuse: fix race between interrupt and resend
- CVE-2026-8086 OSGeo gdal SWapi.c SWnentries heap-based overflow
- CVE-2026-80859 fuse: fix missing barrier when checking io-uring readiness
- CVE-2026-80858 fuse: publish io-uring queues with release semantics
- CVE-2026-80857 fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
- CVE-2026-80856 fuse: fix invalidate lock leak on setattr writeback failure
- CVE-2026-80855 fuse: fix invalidate lock leak on open O_TRUNC DAX failure
- CVE-2026-80854 usb: gadget: f_tcm: keep port count until LUN teardown completes
- CVE-2026-80853 KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts
- CVE-2026-80852 tls: device: fix out-of-bounds write in tls_append_frag()
- CVE-2026-80851 gtp: serialize PDP context updates
- CVE-2026-80850 tcp: fix AO info use-after-free in tcp_ao_connect_init()
- CVE-2026-8085 Rockwell Automation Arena® - Memory Corruption Vulnerability
- CVE-2026-80849 net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
- CVE-2026-80848 xfrm: espintcp: fix UAF during close
- CVE-2026-80847 tcp: clamp route advmss to TCP_MIN_MSS
- CVE-2026-80846 xfrm: drop ESP-in-TCP packets with no ingress device
- CVE-2026-80845 xfrm: avoid lock inversion in nat keepalive work
- CVE-2026-80844 xfrm: ah6: validate routing header segments_left
- CVE-2026-80843 xfrm: fix xfrm_state_construct() auth-trunc leak
- CVE-2026-80842 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
- CVE-2026-80841 net/packet: defer vmalloc TX_RING free until skbs finish
- CVE-2026-80840 ipv6: seg6: clear IPv4 control block on IPIP decapsulation
- CVE-2026-8084 OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds
- CVE-2026-80839 batman-adv: reject unrepresentable multicast TVLV offsets
- CVE-2026-80838 vxlan: keep the last remote linked during FDB flush
- CVE-2026-80837 netfilter: nf_tables: don't queue packet path object notifications
- CVE-2026-80836 crypto: virtio - bound the akcipher result length
- CVE-2026-80835 crypto: qcom-rng - Remove crypto_rng interface
- CVE-2026-80834 crypto: sun8i-ce - Remove crypto_rng interface
- CVE-2026-80833 crypto: sun8i-ss - Remove crypto_rng interface
- CVE-2026-80832 crypto: qce - fix CCM AAD buffer underallocation
- CVE-2026-80831 crypto: mxs-dcp - fix source scatterlist length access
- CVE-2026-80830 usb: core: Add lock to usb_wakeup_notification()
- CVE-2026-8083 SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection
- CVE-2026-80829 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- CVE-2026-80828 ALSA: usb-audio: Complete cleanup after system-resume errors
- CVE-2026-80827 USB: serial: option: fix slab OOB read in interrupt URB callback
- CVE-2026-80826 USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- CVE-2026-80825 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- CVE-2026-80824 usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- CVE-2026-80823 nfc: st21nfca: validate ATR_REQ length against the received frame
- CVE-2026-80822 mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
- CVE-2026-80821 nvmet: pci-epf: put CQ ref on create_cq mapping failure
- CVE-2026-80820 xfs: don't livelock in scrub on a circular unlinked list
- CVE-2026-8082 Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection
- CVE-2026-80819 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
- CVE-2026-80818 iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
- CVE-2026-80817 iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
- CVE-2026-80816 ALSA: FCP: Use a private URB for the notification endpoint
- CVE-2026-80815 ALSA: scarlett2: Use a private URB for the notification endpoint
- CVE-2026-80814 rndis_host: add overflow check in rndis_rx_fixup()
- CVE-2026-80813 nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
- CVE-2026-80812 ALSA: dummy: Check card index validity at probe
- CVE-2026-80811 io_uring/cmd: fix iovec leak when the async cmd is not recycled