# Vulnerabilities published in 2026


- [CVE-2026-80810](https://insights.sbomify.com/CVE-2026-80810/): io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() (not scored)
- [CVE-2026-8081](https://insights.sbomify.com/CVE-2026-8081/): router-for-me CLIProxyAPI api_tools.go server-side request forgery (medium 5.3)
- [CVE-2026-80809](https://insights.sbomify.com/CVE-2026-80809/): ocfs2: fix missing metadata reservation for large xattrs (not scored)
- [CVE-2026-80808](https://insights.sbomify.com/CVE-2026-80808/): ext4: stop retrying saturated xattr cache entries (not scored)
- [CVE-2026-80807](https://insights.sbomify.com/CVE-2026-80807/): nilfs2: reject invalid block index in GC ioctl (not scored)
- [CVE-2026-80806](https://insights.sbomify.com/CVE-2026-80806/): ext4: don't enable DAX on new encrypted files (not scored)
- [CVE-2026-80805](https://insights.sbomify.com/CVE-2026-80805/): xfs: validate attr entry pointer before field access (not scored)
- [CVE-2026-80804](https://insights.sbomify.com/CVE-2026-80804/): xfs: restore nofs context unconditionally in xfs_trans_roll (not scored)
- [CVE-2026-80803](https://insights.sbomify.com/CVE-2026-80803/): nfc: digital: clamp SENSF_RES length to the destination buffer (not scored)
- [CVE-2026-80802](https://insights.sbomify.com/CVE-2026-80802/): nfc: fdp: bound the device-reported read length and fix an skb leak (not scored)
- [CVE-2026-80801](https://insights.sbomify.com/CVE-2026-80801/): nfc: microread: validate target discovery payload lengths (not scored)
- [CVE-2026-80800](https://insights.sbomify.com/CVE-2026-80800/): nfc: llcp: bound the connect_sn TLV walk to the skb (not scored)
- [CVE-2026-8080](https://insights.sbomify.com/CVE-2026-8080/): MISP core - Stored XSS in MISP template (old engine) element attribute type (medium 6.8)
- [CVE-2026-80799](https://insights.sbomify.com/CVE-2026-80799/): nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (not scored)
- [CVE-2026-80798](https://insights.sbomify.com/CVE-2026-80798/): nfc: llcp: reject PDUs shorter than the LLCP header (not scored)
- [CVE-2026-80797](https://insights.sbomify.com/CVE-2026-80797/): nfc: pn533: purge fragmented skbs during cleanup (not scored)
- [CVE-2026-80796](https://insights.sbomify.com/CVE-2026-80796/): nfc: nci: add data_len bound checks to activation parameter extractors (not scored)
- [CVE-2026-80795](https://insights.sbomify.com/CVE-2026-80795/): nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (not scored)
- [CVE-2026-80794](https://insights.sbomify.com/CVE-2026-80794/): nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (not scored)
- [CVE-2026-80793](https://insights.sbomify.com/CVE-2026-80793/): ipv4: reject undersized MTUs in ip_do_fragment() (not scored)
- [CVE-2026-80792](https://insights.sbomify.com/CVE-2026-80792/): ipv6: fix use-after-free in ip6_finish_output2() (not scored)
- [CVE-2026-80791](https://insights.sbomify.com/CVE-2026-80791/): nvmet-auth: zero the AUTH_RECEIVE response buffer (not scored)
- [CVE-2026-80790](https://insights.sbomify.com/CVE-2026-80790/): nvmet-fc: fix invalid free in LS IOD error path (not scored)
- [CVE-2026-8079](https://insights.sbomify.com/CVE-2026-8079/): Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon (high 8.7)
- [CVE-2026-80789](https://insights.sbomify.com/CVE-2026-80789/): nvmet-tcp: bound SGL data length before allocating command buffers (not scored)
- [CVE-2026-80788](https://insights.sbomify.com/CVE-2026-80788/): nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations (not scored)
- [CVE-2026-80787](https://insights.sbomify.com/CVE-2026-80787/): nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() (not scored)
- [CVE-2026-80786](https://insights.sbomify.com/CVE-2026-80786/): fbdev: Wrap user-invoked calls to fb_set_var() in helper (not scored)
- [CVE-2026-80785](https://insights.sbomify.com/CVE-2026-80785/): fbdev: serialize mode sysfs access with lock_fb_info() (not scored)
- [CVE-2026-80784](https://insights.sbomify.com/CVE-2026-80784/): mptcp: pm: fix memory leak from alloc-during-teardown race (not scored)
- [CVE-2026-80783](https://insights.sbomify.com/CVE-2026-80783/): HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (not scored)
- [CVE-2026-80782](https://insights.sbomify.com/CVE-2026-80782/): HID: magicmouse: do not keep a stale msc->input if no input is claimed (not scored)
- [CVE-2026-80781](https://insights.sbomify.com/CVE-2026-80781/): HID: core: fix OOB read of field->usage in hid_set_field() (not scored)
- [CVE-2026-80780](https://insights.sbomify.com/CVE-2026-80780/): HID: pidff: fix OOB write when hid->inputs is empty (not scored)
- [CVE-2026-8078](https://insights.sbomify.com/CVE-2026-8078/): Fix stored XSS in global settings change log (medium 4.8)
- [CVE-2026-80779](https://insights.sbomify.com/CVE-2026-80779/): net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (not scored)
- [CVE-2026-80778](https://insights.sbomify.com/CVE-2026-80778/): futex/pi: Reject cross-mm private futex owners (not scored)
- [CVE-2026-80777](https://insights.sbomify.com/CVE-2026-80777/): futex/pi: Plug private futex exec() race (not scored)
- [CVE-2026-80776](https://insights.sbomify.com/CVE-2026-80776/): futex: Fix race in futex_pivot_pending() during private hash resize (not scored)
- [CVE-2026-80775](https://insights.sbomify.com/CVE-2026-80775/): futex: Fix race on the initial mm->futex.phash.ref allocation (not scored)
- [CVE-2026-80774](https://insights.sbomify.com/CVE-2026-80774/): HID: asus: fix missing hid_is_usb() check (not scored)
- [CVE-2026-80773](https://insights.sbomify.com/CVE-2026-80773/): HID: huawei: fix missing hid_is_usb() check (not scored)
- [CVE-2026-80772](https://insights.sbomify.com/CVE-2026-80772/): HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (not scored)
- [CVE-2026-80771](https://insights.sbomify.com/CVE-2026-80771/): HID: nintendo: register input device after capabilities are set (not scored)
- [CVE-2026-80770](https://insights.sbomify.com/CVE-2026-80770/): HID: nintendo: stop device IO before hid_hw_stop on probe failure (not scored)
- [CVE-2026-8077](https://insights.sbomify.com/CVE-2026-8077/): Weak credentials vulnerability in the CashDro 3 web administration panel (high 8.6)
- [CVE-2026-80769](https://insights.sbomify.com/CVE-2026-80769/): HID: rapoo: fix missing hid_is_usb() check (not scored)
- [CVE-2026-80768](https://insights.sbomify.com/CVE-2026-80768/): HID: ft260: fix stack-use-after-return write in I2C read race (not scored)
- [CVE-2026-80767](https://insights.sbomify.com/CVE-2026-80767/): HID: sensor: custom: Fix use-after-free in enable_sensor (not scored)
- [CVE-2026-80766](https://insights.sbomify.com/CVE-2026-80766/): HID: uclogic: fix use-after-free of inrange_timer on remove (not scored)
- [CVE-2026-80765](https://insights.sbomify.com/CVE-2026-80765/): HID: hyperv: validate initial device info bounds (not scored)
- [CVE-2026-80764](https://insights.sbomify.com/CVE-2026-80764/): Bluetooth: hci_event: fix LE list UAF on reset (not scored)
- [CVE-2026-80763](https://insights.sbomify.com/CVE-2026-80763/): Bluetooth: hci_event: validate LE Set CIG Parameters response (not scored)
- [CVE-2026-80762](https://insights.sbomify.com/CVE-2026-80762/): Bluetooth: hci_sync: Fix accept list UAF during suspend (not scored)
- [CVE-2026-80761](https://insights.sbomify.com/CVE-2026-80761/): Bluetooth: ISO: zero the sockaddr before returning it in getname (not scored)
- [CVE-2026-80760](https://insights.sbomify.com/CVE-2026-80760/): Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (not scored)
- [CVE-2026-8076](https://insights.sbomify.com/CVE-2026-8076/): Weak credentials vulnerability in the CashDro 3 web administration panel (critical 9.3)
- [CVE-2026-80759](https://insights.sbomify.com/CVE-2026-80759/): Bluetooth: hci_aml: validate firmware segment lengths (not scored)
- [CVE-2026-80758](https://insights.sbomify.com/CVE-2026-80758/): futex: Avoid private hash use-after-free on final put (not scored)
- [CVE-2026-80757](https://insights.sbomify.com/CVE-2026-80757/): selinux: reject a class permission count below its inherited common (not scored)
- [CVE-2026-80756](https://insights.sbomify.com/CVE-2026-80756/): selinux: do not cancel a policy conversion that never started (not scored)
- [CVE-2026-80755](https://insights.sbomify.com/CVE-2026-80755/): selinux: reject a permission value exceeding the class permission count (not scored)
- [CVE-2026-80754](https://insights.sbomify.com/CVE-2026-80754/): Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (high 7.8)
- [CVE-2026-80753](https://insights.sbomify.com/CVE-2026-80753/): ovpn: run deferred work on a module-owned workqueue (high 8.4)
- [CVE-2026-80752](https://insights.sbomify.com/CVE-2026-80752/): Input: psxpad-spi - set driver data before use (high 8.4)
- [CVE-2026-80751](https://insights.sbomify.com/CVE-2026-80751/): pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() (high 7.8)
- [CVE-2026-80750](https://insights.sbomify.com/CVE-2026-80750/): pmdomain: mediatek: fix remaining %pOF after of_node_put() (high 8.4)
- [CVE-2026-8075](https://insights.sbomify.com/CVE-2026-8075/): Posting a malicious markdown image crashes the Mattermost Desktop App (medium 6.5)
- [CVE-2026-80749](https://insights.sbomify.com/CVE-2026-80749/): drm/connector/hdmi: Fix out of bounds memory read (high 7.1)
- [CVE-2026-80748](https://insights.sbomify.com/CVE-2026-80748/): mmc: loongson2: Fix sg iteration in data reorder functions (high 7.8)
- [CVE-2026-80747](https://insights.sbomify.com/CVE-2026-80747/): drm/amdkfd: Add bounds check for CRAT subtype length (high 8.0)
- [CVE-2026-80746](https://insights.sbomify.com/CVE-2026-80746/): clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK (not scored)
- [CVE-2026-80745](https://insights.sbomify.com/CVE-2026-80745/): regulator: fp9931: Fix VPOS/VNEG voltage selector table (high 8.4)
- [CVE-2026-80744](https://insights.sbomify.com/CVE-2026-80744/): netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (not scored)
- [CVE-2026-80743](https://insights.sbomify.com/CVE-2026-80743/): ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (not scored)
- [CVE-2026-80742](https://insights.sbomify.com/CVE-2026-80742/): af_packet: Don't send zero-byte data in tpacket_snd(). (not scored)
- [CVE-2026-80741](https://insights.sbomify.com/CVE-2026-80741/): drm/log: Fix out-of-bounds read on empty message length (high 7.1)
- [CVE-2026-80740](https://insights.sbomify.com/CVE-2026-80740/): drm/log: Fix infinite loop when scale is too large for display (not scored)
- [CVE-2026-8074](https://insights.sbomify.com/CVE-2026-8074/): Improper Permission Check Allows User Manager to Deactivate Bot Accounts (low 3.8)
- [CVE-2026-80739](https://insights.sbomify.com/CVE-2026-80739/): net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (not scored)
- [CVE-2026-80738](https://insights.sbomify.com/CVE-2026-80738/): bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie (high 7.3)
- [CVE-2026-80737](https://insights.sbomify.com/CVE-2026-80737/): serial: amba-pl011: synchronize DMA teardown (high 7.8)
- [CVE-2026-80736](https://insights.sbomify.com/CVE-2026-80736/): thunderbolt: Fix bandwidth group reservation indexing (high 7.8)
- [CVE-2026-80735](https://insights.sbomify.com/CVE-2026-80735/): ovpn: ensure socket is owned by ovpn before deref sk_user_data (high 7.3)
- [CVE-2026-80734](https://insights.sbomify.com/CVE-2026-80734/): btrfs: initialize inode mapping flags for cached inodes (high 8.8)
- [CVE-2026-80733](https://insights.sbomify.com/CVE-2026-80733/): net: remove WARN_ON_ONCE() from sk_mc_loop() (not scored)
- [CVE-2026-80732](https://insights.sbomify.com/CVE-2026-80732/): ata: pata_sl82c105: fix bridge revision use-after-free (high 7.8)
- [CVE-2026-80731](https://insights.sbomify.com/CVE-2026-80731/): net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (high 7.8)
- [CVE-2026-80730](https://insights.sbomify.com/CVE-2026-80730/): ring-buffer: Fix crash passing ERR_PTR to kthread_stop() (not scored)
- [CVE-2026-8073](https://insights.sbomify.com/CVE-2026-8073/): Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP (high 7.5)
- [CVE-2026-80729](https://insights.sbomify.com/CVE-2026-80729/): mm/huge_memory: initialise workingset state before folio split (not scored)
- [CVE-2026-80728](https://insights.sbomify.com/CVE-2026-80728/): Revert "drm/amdgpu: fix aperture mapping leak" (not scored)
- [CVE-2026-80727](https://insights.sbomify.com/CVE-2026-80727/): x86/mce: Set up the polling timer before CMCI discovery (not scored)
- [CVE-2026-80725](https://insights.sbomify.com/CVE-2026-80725/): net: gro: properly validate BIG TCP aggregation criteria (critical 9.8)
- [CVE-2026-80724](https://insights.sbomify.com/CVE-2026-80724/): ptp: vmclock: prevent read-only mappings from becoming writable (high 8.8)
- [CVE-2026-80723](https://insights.sbomify.com/CVE-2026-80723/): of: reserved_mem: prevent OOB when too many dynamic regions are defined (high 8.4)
- [CVE-2026-80722](https://insights.sbomify.com/CVE-2026-80722/): wifi: mac80211: validate individual TWT params before driver setup (high 8.8)
- [CVE-2026-80721](https://insights.sbomify.com/CVE-2026-80721/): Bluetooth: ISO: ensure no dangling hcon references in iso_conn (high 8.8)
- [CVE-2026-80720](https://insights.sbomify.com/CVE-2026-80720/): iomap: add a separate bio_set for iomap_split_ioend (high 7.5)
- [CVE-2026-8072](https://insights.sbomify.com/CVE-2026-8072/): Insecure generation of SAT access credentials in Ingecon EMS Board (critical 9.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/346/