Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 347 of 1013.
- CVE-2026-80719 mm: mglru: fix stale batch updates after memcg reparenting
- CVE-2026-80718 mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
- CVE-2026-80717 sctp: validate Adaptation Indication parameter length
- CVE-2026-80716 ALSA: pcm: wake linked drain waiters on unlink
- CVE-2026-80715 igc: remove napi_synchronize() in igc_down()
- CVE-2026-80714 ipvs: do not propagate one-packet flag to synced conns
- CVE-2026-80713 io_uring: preserve task restrictions across exec
- CVE-2026-80712 spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
- CVE-2026-80711 power: supply: max17040: handle missing status supplier
- CVE-2026-80710 s390/dasd: Fix undersized format-check buffer
- CVE-2026-8071 Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass
- CVE-2026-80709 s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
- CVE-2026-80708 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
- CVE-2026-80707 can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
- CVE-2026-80706 can: softing: fw_parse(): validate firmware record spans
- CVE-2026-80705 drm/amd/display: check if dml21_add_phantom_plane() is successful
- CVE-2026-80704 drm/amd/display: use proper context for logging
- CVE-2026-80703 drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
- CVE-2026-80702 drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
- CVE-2026-80701 drm/vmwgfx: enforce cursor size limits for MOB cursors
- CVE-2026-80700 drm/vmwgfx: validate external BO copy bounds for both stride paths
- CVE-2026-8070 Misconfiguration in Armoury Crate
- CVE-2026-80699 KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
- CVE-2026-80698 dmaengine: idxd: fix double free of wq, engine, and group structs
- CVE-2026-80697 erofs: ensure valid f_path for page cache sharing
- CVE-2026-80696 hwmon: (ltc4282) Fix reading the minimum alarm voltage
- CVE-2026-80695 hwmon: (sht3x) Fix unaligned accesses
- CVE-2026-80694 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
- CVE-2026-80693 idpf: bound interrupt-vector register fill to the allocated array
- CVE-2026-80692 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
- CVE-2026-80691 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
- CVE-2026-80690 scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
- CVE-2026-8069 PredatorSense V3: Local Privilege Escalation (LPE) vulnerability
- CVE-2026-80689 tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
- CVE-2026-80688 riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
- CVE-2026-80687 iommufd/viommu: Release the igroup lock on the vdevice_size error path
- CVE-2026-80686 mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
- CVE-2026-80685 mm/util: don't read __page_2 for order-1 folios in snapshot_page()
- CVE-2026-80684 KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
- CVE-2026-80683 Bluetooth: SCO: give the socket its own sco_conn reference
- CVE-2026-80682 riscv/mm: use physical alignment for vmemmap_start_pfn
- CVE-2026-80681 vxlan: re-fetch eth header after route_shortcircuit()
- CVE-2026-80680 i2c: amd-mp2: Unregister callback on adapter add failure
- CVE-2026-80679 s390/dasd: Fix potential NULL pointer dereference
- CVE-2026-80678 i2c: imx: Fix slave registration race and error handling
- CVE-2026-80677 driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
- CVE-2026-80676 Drivers: hv: vmbus: use generic driver_override infrastructure
- CVE-2026-80675 libbpf: Reject non-exclusive metadata maps in the signed loader
- CVE-2026-80674 ntfs: validate resident attribute lists and harden the validator
- CVE-2026-80673 ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
- CVE-2026-80672 ntfs: fix u16 truncation of restart-area length check
- CVE-2026-80671 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
- CVE-2026-80670 perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
- CVE-2026-8067 Missing authorization in RTU500 series CMU firmware
- CVE-2026-80669 bpf: Disable xfrm_decode_session hook attachment
- CVE-2026-80668 netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
- CVE-2026-80667 net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
- CVE-2026-80666 Bluetooth: sco: Fix a race condition in sco_sock_timeout()
- CVE-2026-80665 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
- CVE-2026-80664 netfilter: xt_nat: reject unsupported target families
- CVE-2026-80663 tools/power/x86/intel-speed-select: Harden daemon pidfile open
- CVE-2026-80662 cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
- CVE-2026-80661 ufs: core: tracing: Do not dereference pointers in TP_printk()
- CVE-2026-80660 hwmon: (occ) unregister sysfs devices outside occ lock
- CVE-2026-8066 Path traversal in RTU500 series CMU firmware
- CVE-2026-80659 mmc: vub300: defer reset until cmd_mutex is unlocked
- CVE-2026-80658 drm/rockchip: dw_dp: Fix null-ptr-deref in dw_dp_remove()
- CVE-2026-80657 accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer
- CVE-2026-80656 hfsplus: Add a sanity check for btree node size
- CVE-2026-80655 soc: xilinx: Fix race condition in event registration
- CVE-2026-80654 soc: xilinx: Shutdown and free rx mailbox channel
- CVE-2026-80653 scsi: hisi_sas: Add slave_destroy interface for v3 hw
- CVE-2026-80652 crypto: ccp - Treat zero-length cert chain as query for blob lengths
- CVE-2026-80651 crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL
- CVE-2026-80650 media: atomisp: gc2235: fix UAF and memory leak
- CVE-2026-8065 Auth bypass in RTU500 series CMU firmware
- CVE-2026-80649 firmware: arm_scmi: Fix OOB in scmi_power_name_get()
- CVE-2026-80648 pinctrl: spacemit: fix NULL check in spacemit_pin_set_config
- CVE-2026-80647 RDMA/hns: Fix warning in poll cq direct mode
- CVE-2026-80646 ipv6: guard against possible NULL deref in __in6_dev_stats_get()
- CVE-2026-80645 rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
- CVE-2026-80644 ocfs2: don't BUG_ON an invalid journal dinode
- CVE-2026-80643 EDAC/igen6: Fix call trace due to missing release()
- CVE-2026-80642 liveupdate: Reference count incoming FLB data
- CVE-2026-80641 wifi: wlcore: enable the right set of ciphers
- CVE-2026-80640 cxl/fwctl: Fix __fortify_panic
- CVE-2026-80639 cxl/test: Fix __fortify_panic
- CVE-2026-80638 ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
- CVE-2026-80637 netfilter: synproxy: fix unaligned memory access in timestamp adjustment
- CVE-2026-80636 netfilter: conntrack: revert ct extension genid infrastructure
- CVE-2026-80635 wifi: wcn36xx: fix OOB read from short trigger BA firmware response
- CVE-2026-80634 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
- CVE-2026-80633 iommufd: Take dma_resv lock before dma_buf_unpin() in release path
- CVE-2026-80632 wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues()
- CVE-2026-80631 btrfs: lzo: reject compressed segment that overflows the compressed input
- CVE-2026-80630 net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
- CVE-2026-8063 Post-auth null pointer dereference when aggregating against a view with empty search pipeline
- CVE-2026-80629 octeontx2-af: npc: Fix size of entry2cntr_map
- CVE-2026-80628 ALSA: seq: oss: Serialize readq reset state with q->lock
- CVE-2026-80627 MIPS: mm: Fix out-of-bounds write in maar_res_walk()