# Vulnerabilities published in 2026


- [CVE-2026-74734](https://insights.sbomify.com/CVE-2026-74734/): firewire: ohci: fix NULL pointer dereference in ar_context_release (not scored)
- [CVE-2026-74733](https://insights.sbomify.com/CVE-2026-74733/): gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (high 7.8)
- [CVE-2026-74731](https://insights.sbomify.com/CVE-2026-74731/): sched_ext: Skip sub-disable teardown for never-linked sub-schedulers (high 7.8)
- [CVE-2026-74730](https://insights.sbomify.com/CVE-2026-74730/): NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (critical 9.8)
- [CVE-2026-7473](https://insights.sbomify.com/CVE-2026-7473/): Arista Extensible Operating System Incomplete Comparison with Missing Factors (medium 6.9, exploited in the wild)
- [CVE-2026-74729](https://insights.sbomify.com/CVE-2026-74729/): soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read (not scored)
- [CVE-2026-74728](https://insights.sbomify.com/CVE-2026-74728/): xfs: handle NULL b_addr in xfs_buf_free (not scored)
- [CVE-2026-74727](https://insights.sbomify.com/CVE-2026-74727/): ovpn: skip rehash for peers already removed from by_id (critical 9.8)
- [CVE-2026-74726](https://insights.sbomify.com/CVE-2026-74726/): bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (high 7.3)
- [CVE-2026-74725](https://insights.sbomify.com/CVE-2026-74725/): enic: fix tx_hang_reset use-after-free on device removal (high 7.8)
- [CVE-2026-74724](https://insights.sbomify.com/CVE-2026-74724/): ipvs: avoid out-of-bounds write in ip_vs_nat_icmp (high 7.8)
- [CVE-2026-74723](https://insights.sbomify.com/CVE-2026-74723/): btrfs: lzo: reject inline extents without valid headers (critical 9.8)
- [CVE-2026-74722](https://insights.sbomify.com/CVE-2026-74722/): btrfs: fix memory leak in btrfs_do_encoded_write() (not scored)
- [CVE-2026-74721](https://insights.sbomify.com/CVE-2026-74721/): accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() (high 7.8)
- [CVE-2026-74720](https://insights.sbomify.com/CVE-2026-74720/): bpf: Preserve pointer state for commuted arithmetic (high 7.8)
- [CVE-2026-7472](https://insights.sbomify.com/CVE-2026-7472/): Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (medium 4.9)
- [CVE-2026-74719](https://insights.sbomify.com/CVE-2026-74719/): net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (not scored)
- [CVE-2026-74718](https://insights.sbomify.com/CVE-2026-74718/): devlink: fix net namespace reference leak in reload (not scored)
- [CVE-2026-74717](https://insights.sbomify.com/CVE-2026-74717/): net/mlx5: fw_tracer, return NULL on create error (high 7.5)
- [CVE-2026-74716](https://insights.sbomify.com/CVE-2026-74716/): accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() (not scored)
- [CVE-2026-74715](https://insights.sbomify.com/CVE-2026-74715/): bpf: Fix netns reference imbalance in conntrack kfuncs (high 7.8)
- [CVE-2026-74714](https://insights.sbomify.com/CVE-2026-74714/): bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() (high 7.8)
- [CVE-2026-74713](https://insights.sbomify.com/CVE-2026-74713/): vhost_iotlb: bound map allocation in add_range (high 7.1)
- [CVE-2026-74712](https://insights.sbomify.com/CVE-2026-74712/): vdpa/mlx5: Fix buffer length in create_direct_keys() (critical 9.3)
- [CVE-2026-74711](https://insights.sbomify.com/CVE-2026-74711/): hwmon: (pmbus) Fix type confusion in notification logic (high 8.4)
- [CVE-2026-74710](https://insights.sbomify.com/CVE-2026-74710/): xsk: require at least 16 bytes of TX metadata (high 7.8)
- [CVE-2026-7471](https://insights.sbomify.com/CVE-2026-7471/): Server-Side Request Forgery (SSRF) in GitLab (low 3.5)
- [CVE-2026-74709](https://insights.sbomify.com/CVE-2026-74709/): xsk: clear metadata pointer when no timestamp is requested (not scored)
- [CVE-2026-74708](https://insights.sbomify.com/CVE-2026-74708/): xsk: validate launch-time metadata size (high 7.8)
- [CVE-2026-74707](https://insights.sbomify.com/CVE-2026-74707/): xsk: validate metadata when processing requests (high 7.8)
- [CVE-2026-74706](https://insights.sbomify.com/CVE-2026-74706/): bnge: Fix NULL pointer dereference in aux device release (not scored)
- [CVE-2026-74705](https://insights.sbomify.com/CVE-2026-74705/): udp: fix potential use-after-free in tunnel segmentation (critical 10.0)
- [CVE-2026-74704](https://insights.sbomify.com/CVE-2026-74704/): net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter (high 8.2)
- [CVE-2026-74703](https://insights.sbomify.com/CVE-2026-74703/): vhost-scsi: Validate T10 PI scatterlist counts (high 7.1)
- [CVE-2026-74702](https://insights.sbomify.com/CVE-2026-74702/): vhost-scsi: reject feature changes after endpoint (high 8.8)
- [CVE-2026-74701](https://insights.sbomify.com/CVE-2026-74701/): net/openvswitch: check Ethernet header length in key_extract() (high 7.8)
- [CVE-2026-74700](https://insights.sbomify.com/CVE-2026-74700/): net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (high 7.8)
- [CVE-2026-7470](https://insights.sbomify.com/CVE-2026-7470/): Tenda 4G300 SafeMacFilter sub_427C3C stack-based overflow (high 8.7)
- [CVE-2026-74699](https://insights.sbomify.com/CVE-2026-74699/): drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() (not scored)
- [CVE-2026-74698](https://insights.sbomify.com/CVE-2026-74698/): net/mlx5e: fix BQL reset on SQ re-activation (not scored)
- [CVE-2026-74697](https://insights.sbomify.com/CVE-2026-74697/): bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (high 8.2)
- [CVE-2026-74696](https://insights.sbomify.com/CVE-2026-74696/): tcp: fix TFO max_qlen accounting across reuseport migration (high 7.5)
- [CVE-2026-74695](https://insights.sbomify.com/CVE-2026-74695/): netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (high 7.5)
- [CVE-2026-74694](https://insights.sbomify.com/CVE-2026-74694/): net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (not scored)
- [CVE-2026-74693](https://insights.sbomify.com/CVE-2026-74693/): net: prestera: validate firmware header length (not scored)
- [CVE-2026-74692](https://insights.sbomify.com/CVE-2026-74692/): net/smc: fix TOCTOU race between smc_listen_out() and listener close (high 7.5)
- [CVE-2026-74691](https://insights.sbomify.com/CVE-2026-74691/): net: thunderbolt: Tear down DMA paths before stopping the rings (high 8.8)
- [CVE-2026-74690](https://insights.sbomify.com/CVE-2026-74690/): s390/ism: Fix UAF of sba and ieq during ism_dev_exit() (high 8.4)
- [CVE-2026-7469](https://insights.sbomify.com/CVE-2026-7469/): Tenda 4G300 DelFil sub_425A28 command injection (medium 5.3)
- [CVE-2026-74689](https://insights.sbomify.com/CVE-2026-74689/): net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (high 7.1)
- [CVE-2026-74688](https://insights.sbomify.com/CVE-2026-74688/): sctp: clear control chunk transport if it is being removed (critical 9.8)
- [CVE-2026-74687](https://insights.sbomify.com/CVE-2026-74687/): watchdog: at91sam9_wdt: prevent timer rearm during teardown (high 7.8)
- [CVE-2026-74686](https://insights.sbomify.com/CVE-2026-74686/): rqspinlock: Reset tail when preserving queue on deadlock (not scored)
- [CVE-2026-74685](https://insights.sbomify.com/CVE-2026-74685/): hwmon: (ltc4282) Clamp negative current limits (not scored)
- [CVE-2026-74684](https://insights.sbomify.com/CVE-2026-74684/): net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (high 7.1)
- [CVE-2026-74683](https://insights.sbomify.com/CVE-2026-74683/): Input: evdev - sanitize event type index when fetching event masks (not scored)
- [CVE-2026-74682](https://insights.sbomify.com/CVE-2026-74682/): ALSA: usb-audio: fix OOB write on Type II inbound URBs (not scored)
- [CVE-2026-74681](https://insights.sbomify.com/CVE-2026-74681/): usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg (not scored)
- [CVE-2026-74680](https://insights.sbomify.com/CVE-2026-74680/): usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (not scored)
- [CVE-2026-7468](https://insights.sbomify.com/CVE-2026-7468/): 1024-lab smart-admin Demo Site index.html access control (medium 6.9)
- [CVE-2026-74679](https://insights.sbomify.com/CVE-2026-74679/): usb: gadget: f_ncm: Use unsigned int for ndp_index (not scored)
- [CVE-2026-74678](https://insights.sbomify.com/CVE-2026-74678/): net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (high 7.5)
- [CVE-2026-74677](https://insights.sbomify.com/CVE-2026-74677/): net: usb: ipheth: fix carrier_work UAF on disconnect (not scored)
- [CVE-2026-74676](https://insights.sbomify.com/CVE-2026-74676/): vt: add permission check for KDSKBMETA ioctl (not scored)
- [CVE-2026-74675](https://insights.sbomify.com/CVE-2026-74675/): vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (high 7.8)
- [CVE-2026-74674](https://insights.sbomify.com/CVE-2026-74674/): mm: fix incorrect flush address in direct page table reclaim (high 7.8)
- [CVE-2026-74673](https://insights.sbomify.com/CVE-2026-74673/): Input: evdev - fix information leak in evdev_pass_values() (not scored)
- [CVE-2026-74672](https://insights.sbomify.com/CVE-2026-74672/): mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF (not scored)
- [CVE-2026-74671](https://insights.sbomify.com/CVE-2026-74671/): ima: fix out-of-bounds read in xattr_verify() (not scored)
- [CVE-2026-74670](https://insights.sbomify.com/CVE-2026-74670/): ipvs: stop estimator after disabled calc phase (high 7.8)
- [CVE-2026-7467](https://insights.sbomify.com/CVE-2026-7467/): Read More & Accordion <= 3.5.7 - Privilege Escalation via importData (high 8.8)
- [CVE-2026-74669](https://insights.sbomify.com/CVE-2026-74669/): ipvs: clear IPv4 options after rebasing tunnel ICMP errors (critical 9.8)
- [CVE-2026-74668](https://insights.sbomify.com/CVE-2026-74668/): packet: use consistent hard_header_len in TX_RING send path (high 7.8)
- [CVE-2026-74667](https://insights.sbomify.com/CVE-2026-74667/): net/packet: reset the MAC header on the packet-socket transmit path (high 7.8)
- [CVE-2026-74666](https://insights.sbomify.com/CVE-2026-74666/): packet: synchronize pressure clearing with ring reconfiguration (high 7.8)
- [CVE-2026-74665](https://insights.sbomify.com/CVE-2026-74665/): net: fix skb length accounting after generic XDP frag adjustment (critical 9.1)
- [CVE-2026-74664](https://insights.sbomify.com/CVE-2026-74664/): net: openvswitch: reallocate update replies for mismatched IDs (not scored)
- [CVE-2026-74663](https://insights.sbomify.com/CVE-2026-74663/): net/sched: reject overly deep qdisc hierarchies (high 7.8)
- [CVE-2026-74662](https://insights.sbomify.com/CVE-2026-74662/): inet: frags: publish queues before arming timer (critical 9.8)
- [CVE-2026-74661](https://insights.sbomify.com/CVE-2026-74661/): mac802154: fix netdev use-after-free in beacon worker (high 7.8)
- [CVE-2026-74660](https://insights.sbomify.com/CVE-2026-74660/): netfilter: ebt_nflog: pin the NFLOG backend (high 7.8)
- [CVE-2026-7466](https://insights.sbomify.com/CVE-2026-7466/): AgentFlow Arbitrary Python Pipeline Execution via pipeline_path (high 7.7)
- [CVE-2026-74659](https://insights.sbomify.com/CVE-2026-74659/): net: bridge: mrp: fix uninitialised bytes on the wire (not scored)
- [CVE-2026-74658](https://insights.sbomify.com/CVE-2026-74658/): futex: Prevent robust futex exit race some more (not scored)
- [CVE-2026-74657](https://insights.sbomify.com/CVE-2026-74657/): ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (not scored)
- [CVE-2026-74656](https://insights.sbomify.com/CVE-2026-74656/): ipv4: fix use-after-free in fib_nhc_update_mtu() (high 7.8)
- [CVE-2026-74655](https://insights.sbomify.com/CVE-2026-74655/): serial: qcom-geni: fix TX DMA buffer flush (high 8.8)
- [CVE-2026-74654](https://insights.sbomify.com/CVE-2026-74654/): serial: 8250_dma: Clear stale RX state on shutdown (not scored)
- [CVE-2026-74653](https://insights.sbomify.com/CVE-2026-74653/): serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (not scored)
- [CVE-2026-74652](https://insights.sbomify.com/CVE-2026-74652/): serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ (high 7.8)
- [CVE-2026-74651](https://insights.sbomify.com/CVE-2026-74651/): staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (high 8.1)
- [CVE-2026-74650](https://insights.sbomify.com/CVE-2026-74650/): staging: rtl8723bs: fix OOB read in WMM_param_handler() (not scored)
- [CVE-2026-7465](https://insights.sbomify.com/CVE-2026-7465/): Code injection in Spectra Gutenberg Blocks – Website Builder for the Block Editor (high 8.8)
- [CVE-2026-74649](https://insights.sbomify.com/CVE-2026-74649/): staging: rtl8723bs: fix missing shared-key auth challenge length check (high 8.8)
- [CVE-2026-74648](https://insights.sbomify.com/CVE-2026-74648/): staging: rtl8723bs: validate monitor transmit frame lengths (high 7.8)
- [CVE-2026-74647](https://insights.sbomify.com/CVE-2026-74647/): misc: fastrpc: Remove buffer from list prior to unmap operation (high 7.8)
- [CVE-2026-74646](https://insights.sbomify.com/CVE-2026-74646/): misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (high 7.8)
- [CVE-2026-74645](https://insights.sbomify.com/CVE-2026-74645/): mm/damon/lru_sort: error out for >10000 active_mem_bp (not scored)
- [CVE-2026-74644](https://insights.sbomify.com/CVE-2026-74644/): mm/damon/ops-common: putback folios on invalid migrate nid (not scored)
- [CVE-2026-74643](https://insights.sbomify.com/CVE-2026-74643/): samples/damon/mtier: error out for zero quota goal target values (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/390/