Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 346 of 1013.
- CVE-2026-80810 io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
- CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery
- CVE-2026-80809 ocfs2: fix missing metadata reservation for large xattrs
- CVE-2026-80808 ext4: stop retrying saturated xattr cache entries
- CVE-2026-80807 nilfs2: reject invalid block index in GC ioctl
- CVE-2026-80806 ext4: don't enable DAX on new encrypted files
- CVE-2026-80805 xfs: validate attr entry pointer before field access
- CVE-2026-80804 xfs: restore nofs context unconditionally in xfs_trans_roll
- CVE-2026-80803 nfc: digital: clamp SENSF_RES length to the destination buffer
- CVE-2026-80802 nfc: fdp: bound the device-reported read length and fix an skb leak
- CVE-2026-80801 nfc: microread: validate target discovery payload lengths
- CVE-2026-80800 nfc: llcp: bound the connect_sn TLV walk to the skb
- CVE-2026-8080 MISP core - Stored XSS in MISP template (old engine) element attribute type
- CVE-2026-80799 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
- CVE-2026-80798 nfc: llcp: reject PDUs shorter than the LLCP header
- CVE-2026-80797 nfc: pn533: purge fragmented skbs during cleanup
- CVE-2026-80796 nfc: nci: add data_len bound checks to activation parameter extractors
- CVE-2026-80795 nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
- CVE-2026-80794 nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
- CVE-2026-80793 ipv4: reject undersized MTUs in ip_do_fragment()
- CVE-2026-80792 ipv6: fix use-after-free in ip6_finish_output2()
- CVE-2026-80791 nvmet-auth: zero the AUTH_RECEIVE response buffer
- CVE-2026-80790 nvmet-fc: fix invalid free in LS IOD error path
- CVE-2026-8079 Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon
- CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers
- CVE-2026-80788 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
- CVE-2026-80787 nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
- CVE-2026-80786 fbdev: Wrap user-invoked calls to fb_set_var() in helper
- CVE-2026-80785 fbdev: serialize mode sysfs access with lock_fb_info()
- CVE-2026-80784 mptcp: pm: fix memory leak from alloc-during-teardown race
- CVE-2026-80783 HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
- CVE-2026-80782 HID: magicmouse: do not keep a stale msc->input if no input is claimed
- CVE-2026-80781 HID: core: fix OOB read of field->usage in hid_set_field()
- CVE-2026-80780 HID: pidff: fix OOB write when hid->inputs is empty
- CVE-2026-8078 Fix stored XSS in global settings change log
- CVE-2026-80779 net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
- CVE-2026-80778 futex/pi: Reject cross-mm private futex owners
- CVE-2026-80777 futex/pi: Plug private futex exec() race
- CVE-2026-80776 futex: Fix race in futex_pivot_pending() during private hash resize
- CVE-2026-80775 futex: Fix race on the initial mm->futex.phash.ref allocation
- CVE-2026-80774 HID: asus: fix missing hid_is_usb() check
- CVE-2026-80773 HID: huawei: fix missing hid_is_usb() check
- CVE-2026-80772 HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- CVE-2026-80771 HID: nintendo: register input device after capabilities are set
- CVE-2026-80770 HID: nintendo: stop device IO before hid_hw_stop on probe failure
- CVE-2026-8077 Weak credentials vulnerability in the CashDro 3 web administration panel
- CVE-2026-80769 HID: rapoo: fix missing hid_is_usb() check
- CVE-2026-80768 HID: ft260: fix stack-use-after-return write in I2C read race
- CVE-2026-80767 HID: sensor: custom: Fix use-after-free in enable_sensor
- CVE-2026-80766 HID: uclogic: fix use-after-free of inrange_timer on remove
- CVE-2026-80765 HID: hyperv: validate initial device info bounds
- CVE-2026-80764 Bluetooth: hci_event: fix LE list UAF on reset
- CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response
- CVE-2026-80762 Bluetooth: hci_sync: Fix accept list UAF during suspend
- CVE-2026-80761 Bluetooth: ISO: zero the sockaddr before returning it in getname
- CVE-2026-80760 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- CVE-2026-8076 Weak credentials vulnerability in the CashDro 3 web administration panel
- CVE-2026-80759 Bluetooth: hci_aml: validate firmware segment lengths
- CVE-2026-80758 futex: Avoid private hash use-after-free on final put
- CVE-2026-80757 selinux: reject a class permission count below its inherited common
- CVE-2026-80756 selinux: do not cancel a policy conversion that never started
- CVE-2026-80755 selinux: reject a permission value exceeding the class permission count
- CVE-2026-80754 Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
- CVE-2026-80753 ovpn: run deferred work on a module-owned workqueue
- CVE-2026-80752 Input: psxpad-spi - set driver data before use
- CVE-2026-80751 pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
- CVE-2026-80750 pmdomain: mediatek: fix remaining %pOF after of_node_put()
- CVE-2026-8075 Posting a malicious markdown image crashes the Mattermost Desktop App
- CVE-2026-80749 drm/connector/hdmi: Fix out of bounds memory read
- CVE-2026-80748 mmc: loongson2: Fix sg iteration in data reorder functions
- CVE-2026-80747 drm/amdkfd: Add bounds check for CRAT subtype length
- CVE-2026-80746 clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
- CVE-2026-80745 regulator: fp9931: Fix VPOS/VNEG voltage selector table
- CVE-2026-80744 netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- CVE-2026-80743 ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
- CVE-2026-80742 af_packet: Don't send zero-byte data in tpacket_snd().
- CVE-2026-80741 drm/log: Fix out-of-bounds read on empty message length
- CVE-2026-80740 drm/log: Fix infinite loop when scale is too large for display
- CVE-2026-8074 Improper Permission Check Allows User Manager to Deactivate Bot Accounts
- CVE-2026-80739 net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
- CVE-2026-80738 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
- CVE-2026-80737 serial: amba-pl011: synchronize DMA teardown
- CVE-2026-80736 thunderbolt: Fix bandwidth group reservation indexing
- CVE-2026-80735 ovpn: ensure socket is owned by ovpn before deref sk_user_data
- CVE-2026-80734 btrfs: initialize inode mapping flags for cached inodes
- CVE-2026-80733 net: remove WARN_ON_ONCE() from sk_mc_loop()
- CVE-2026-80732 ata: pata_sl82c105: fix bridge revision use-after-free
- CVE-2026-80731 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
- CVE-2026-80730 ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
- CVE-2026-8073 Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
- CVE-2026-80729 mm/huge_memory: initialise workingset state before folio split
- CVE-2026-80728 Revert "drm/amdgpu: fix aperture mapping leak"
- CVE-2026-80727 x86/mce: Set up the polling timer before CMCI discovery
- CVE-2026-80725 net: gro: properly validate BIG TCP aggregation criteria
- CVE-2026-80724 ptp: vmclock: prevent read-only mappings from becoming writable
- CVE-2026-80723 of: reserved_mem: prevent OOB when too many dynamic regions are defined
- CVE-2026-80722 wifi: mac80211: validate individual TWT params before driver setup
- CVE-2026-80721 Bluetooth: ISO: ensure no dangling hcon references in iso_conn
- CVE-2026-80720 iomap: add a separate bio_set for iomap_split_ioend
- CVE-2026-8072 Insecure generation of SAT access credentials in Ingecon EMS Board