Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 390 of 1013.
- CVE-2026-74734 firewire: ohci: fix NULL pointer dereference in ar_context_release
- CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
- CVE-2026-74731 sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
- CVE-2026-74730 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
- CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors
- CVE-2026-74729 soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
- CVE-2026-74728 xfs: handle NULL b_addr in xfs_buf_free
- CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id
- CVE-2026-74726 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
- CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal
- CVE-2026-74724 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
- CVE-2026-74723 btrfs: lzo: reject inline extents without valid headers
- CVE-2026-74722 btrfs: fix memory leak in btrfs_do_encoded_write()
- CVE-2026-74721 accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
- CVE-2026-74720 bpf: Preserve pointer state for commuted arithmetic
- CVE-2026-7472 Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-74719 net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
- CVE-2026-74718 devlink: fix net namespace reference leak in reload
- CVE-2026-74717 net/mlx5: fw_tracer, return NULL on create error
- CVE-2026-74716 accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
- CVE-2026-74715 bpf: Fix netns reference imbalance in conntrack kfuncs
- CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
- CVE-2026-74713 vhost_iotlb: bound map allocation in add_range
- CVE-2026-74712 vdpa/mlx5: Fix buffer length in create_direct_keys()
- CVE-2026-74711 hwmon: (pmbus) Fix type confusion in notification logic
- CVE-2026-74710 xsk: require at least 16 bytes of TX metadata
- CVE-2026-7471 Server-Side Request Forgery (SSRF) in GitLab
- CVE-2026-74709 xsk: clear metadata pointer when no timestamp is requested
- CVE-2026-74708 xsk: validate launch-time metadata size
- CVE-2026-74707 xsk: validate metadata when processing requests
- CVE-2026-74706 bnge: Fix NULL pointer dereference in aux device release
- CVE-2026-74705 udp: fix potential use-after-free in tunnel segmentation
- CVE-2026-74704 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
- CVE-2026-74703 vhost-scsi: Validate T10 PI scatterlist counts
- CVE-2026-74702 vhost-scsi: reject feature changes after endpoint
- CVE-2026-74701 net/openvswitch: check Ethernet header length in key_extract()
- CVE-2026-74700 net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
- CVE-2026-7470 Tenda 4G300 SafeMacFilter sub_427C3C stack-based overflow
- CVE-2026-74699 drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()
- CVE-2026-74698 net/mlx5e: fix BQL reset on SQ re-activation
- CVE-2026-74697 bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
- CVE-2026-74696 tcp: fix TFO max_qlen accounting across reuseport migration
- CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
- CVE-2026-74694 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
- CVE-2026-74693 net: prestera: validate firmware header length
- CVE-2026-74692 net/smc: fix TOCTOU race between smc_listen_out() and listener close
- CVE-2026-74691 net: thunderbolt: Tear down DMA paths before stopping the rings
- CVE-2026-74690 s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
- CVE-2026-7469 Tenda 4G300 DelFil sub_425A28 command injection
- CVE-2026-74689 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
- CVE-2026-74688 sctp: clear control chunk transport if it is being removed
- CVE-2026-74687 watchdog: at91sam9_wdt: prevent timer rearm during teardown
- CVE-2026-74686 rqspinlock: Reset tail when preserving queue on deadlock
- CVE-2026-74685 hwmon: (ltc4282) Clamp negative current limits
- CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
- CVE-2026-74683 Input: evdev - sanitize event type index when fetching event masks
- CVE-2026-74682 ALSA: usb-audio: fix OOB write on Type II inbound URBs
- CVE-2026-74681 usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
- CVE-2026-74680 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
- CVE-2026-7468 1024-lab smart-admin Demo Site index.html access control
- CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index
- CVE-2026-74678 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
- CVE-2026-74677 net: usb: ipheth: fix carrier_work UAF on disconnect
- CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl
- CVE-2026-74675 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
- CVE-2026-74674 mm: fix incorrect flush address in direct page table reclaim
- CVE-2026-74673 Input: evdev - fix information leak in evdev_pass_values()
- CVE-2026-74672 mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
- CVE-2026-74671 ima: fix out-of-bounds read in xattr_verify()
- CVE-2026-74670 ipvs: stop estimator after disabled calc phase
- CVE-2026-7467 Read More & Accordion <= 3.5.7 - Privilege Escalation via importData
- CVE-2026-74669 ipvs: clear IPv4 options after rebasing tunnel ICMP errors
- CVE-2026-74668 packet: use consistent hard_header_len in TX_RING send path
- CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path
- CVE-2026-74666 packet: synchronize pressure clearing with ring reconfiguration
- CVE-2026-74665 net: fix skb length accounting after generic XDP frag adjustment
- CVE-2026-74664 net: openvswitch: reallocate update replies for mismatched IDs
- CVE-2026-74663 net/sched: reject overly deep qdisc hierarchies
- CVE-2026-74662 inet: frags: publish queues before arming timer
- CVE-2026-74661 mac802154: fix netdev use-after-free in beacon worker
- CVE-2026-74660 netfilter: ebt_nflog: pin the NFLOG backend
- CVE-2026-7466 AgentFlow Arbitrary Python Pipeline Execution via pipeline_path
- CVE-2026-74659 net: bridge: mrp: fix uninitialised bytes on the wire
- CVE-2026-74658 futex: Prevent robust futex exit race some more
- CVE-2026-74657 ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
- CVE-2026-74656 ipv4: fix use-after-free in fib_nhc_update_mtu()
- CVE-2026-74655 serial: qcom-geni: fix TX DMA buffer flush
- CVE-2026-74654 serial: 8250_dma: Clear stale RX state on shutdown
- CVE-2026-74653 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
- CVE-2026-74652 serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
- CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
- CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()
- CVE-2026-7465 Code injection in Spectra Gutenberg Blocks – Website Builder for the Block Editor
- CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check
- CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths
- CVE-2026-74647 misc: fastrpc: Remove buffer from list prior to unmap operation
- CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
- CVE-2026-74645 mm/damon/lru_sort: error out for >10000 active_mem_bp
- CVE-2026-74644 mm/damon/ops-common: putback folios on invalid migrate nid
- CVE-2026-74643 samples/damon/mtier: error out for zero quota goal target values