Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 391 of 1013.
- CVE-2026-74642 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
- CVE-2026-74641 ALSA: usx2y: bound the hwdep mmap fault offset
- CVE-2026-74640 ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
- CVE-2026-7464 WP Google Maps Integration <= 1.2 - Reflected Cross-Site Scripting via 'page' Parameter
- CVE-2026-74639 ALSA: us144mkii: re-anchor capture URBs on resubmission
- CVE-2026-74638 drm/v3d: Serialize the scheduler timeout handlers
- CVE-2026-74637 perf/core: Fix group leader use-after-free after sibling detach
- CVE-2026-74636 tracing: Fix race between update_event_fields and, event_define_fields
- CVE-2026-74635 fbdev: bitblit: bound-check glyph index in bit_cursor()
- CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled
- CVE-2026-74633 tracing: Fix NULL pointer dereference in module event cache removal
- CVE-2026-74632 mm/huge_memory: fix huge_zero_pfn race
- CVE-2026-74631 net: smc: fix splice entry lifetime imbalance in smc_rx_splice
- CVE-2026-74630 ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- CVE-2026-74629 net/dibs: Correct freeing of dmb_clientid_arr
- CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers
- CVE-2026-74627 net: devmem: prevent net-iov / page mixing
- CVE-2026-74626 NTB: ntb_netdev: Preserve RX queue depth on allocation failure
- CVE-2026-74625 netfilter: bridge: release template ct on non-IP path
- CVE-2026-74624 netfilter: nf_conntrack: defer invalid log until after unlock
- CVE-2026-74623 net: atlantic: free stranded TX buffers on ring deinit
- CVE-2026-74622 net: atlantic: free RX pages of consumed but not refilled buffers
- CVE-2026-74621 net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
- CVE-2026-74620 net/sched: act_gact, act_police: range check the fallback control action
- CVE-2026-7462 VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter
- CVE-2026-74619 ovl: don't warn when the mount is completed from another user namespace
- CVE-2026-74618 binfmt_misc: don't warn when the mount is completed from another user namespace
- CVE-2026-74617 dibs: initialise dibs->lock in dibs_dev_alloc()
- CVE-2026-74616 xdp: reject clones that overrun skb_shared_info tailroom
- CVE-2026-74615 vxlan: do not arm the ageing timer on a device that is down
- CVE-2026-74614 vsock/virtio: read virtqueues under worker locks
- CVE-2026-74613 vsock/virtio: avoid refilling the RX queue after teardown
- CVE-2026-74612 veth: fix skb length accounting after XDP frag adjustment
- CVE-2026-74611 tls: rx: restore msg_iter before TLS 1.3 optimistic retry
- CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed
- CVE-2026-7461 OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials
- CVE-2026-74609 tipc: read le->link under the node lock in tipc_node_link_down()
- CVE-2026-74608 smb: client: Fix use-after-free in cifs_try_adding_channels()
- CVE-2026-74607 KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
- CVE-2026-74606 eventfs: Fix use-after-free in eventfs_remove_rec()
- CVE-2026-74605 eventfs: Use children field for rcu head and add memory barriers
- CVE-2026-74604 Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- CVE-2026-74603 ptp: ocp: Fix board ID over-read
- CVE-2026-74602 ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
- CVE-2026-74601 ring-buffer: Use current_context for safe per-CPU buffer swap
- CVE-2026-74600 mm/page_table_check: skip special zero mappings
- CVE-2026-7460 mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped
- CVE-2026-74599 mm/ptdump: always stabilise against page table freeing using init_mm
- CVE-2026-74598 ipv6: fix Route Information option length validation
- CVE-2026-74597 ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- CVE-2026-74596 fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
- CVE-2026-74595 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- CVE-2026-74594 sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- CVE-2026-74593 sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
- CVE-2026-74592 ima: Instantiate file_truncate and path_truncate hooks
- CVE-2026-74591 mm/filemap: __filemap_add_folio() restore index before retrying
- CVE-2026-74590 fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- CVE-2026-7459 Missing authorization in Simple History – Track, Log, and Audit WordPress Changes
- CVE-2026-74589 bpf, sockmap: Fix sk_redir use-after-free in send verdict
- CVE-2026-74588 sctp: keep chunk->transport in step with the list it is queued on
- CVE-2026-74587 sctp: fix use-after-free of cached ASCONF chunk
- CVE-2026-74586 sctp: clear new_transport when removing a peer
- CVE-2026-74585 thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- CVE-2026-74584 RDMA/bnxt_re: zero shared page before exposing to userspace
- CVE-2026-74583 net/sched: cls_route: fix fastmap use-after-free on filter
- CVE-2026-74582 packet: use consistent hard_header_len in non-ring send paths
- CVE-2026-74581 net: ipv6: clear suppressed fib6 rule result
- CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration
- CVE-2026-7458 Auth bypass in User Verification by PickPlugins
- CVE-2026-74579 netfilter: nft_payload: fix mask build for partial field offload
- CVE-2026-74578 crypto: algif_skcipher - force synchronous processing on trees without ctx->state
- CVE-2026-74577 net: mpls: initialize rtm_tos in mpls_getroute()
- CVE-2026-74576 mm/slab: prevent unbounded recursion in free path with new kmalloc type
- CVE-2026-74575 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
- CVE-2026-74574 dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
- CVE-2026-74573 iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
- CVE-2026-74572 btrfs: zoned: fix deadlock between metadata writeback and transaction commit
- CVE-2026-74571 btrfs: skip global block reserve accounting for rescue mounts
- CVE-2026-74570 ntfs: harden runlist realloc size calculations
- CVE-2026-7457 LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
- CVE-2026-74569 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
- CVE-2026-74568 KVM: arm64: vgic: Fix race between LPI release and re-registration
- CVE-2026-74567 keys: fix out-of-bounds read in keyring_get_key_chunk()
- CVE-2026-74566 keys: make keyring key-chunk byte order agree with keyring_diff_objects()
- CVE-2026-74565 netfilter: nf_tables: make nft_object rhltable per table
- CVE-2026-74564 netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
- CVE-2026-74563 rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
- CVE-2026-74562 nexthop: take nh->lock for f6i_list walks in replace check and notify
- CVE-2026-74561 nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
- CVE-2026-74560 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
- CVE-2026-7456 Missing authorization in Udimi Tools
- CVE-2026-74559 xsk: drain continuation descs after overflow in xsk_build_skb()
- CVE-2026-74558 xsk: reclaim invalid Tx descriptors in ZC batch path
- CVE-2026-74557 scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
- CVE-2026-74556 scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
- CVE-2026-74555 scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
- CVE-2026-74554 wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
- CVE-2026-74553 hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
- CVE-2026-74552 hwmon: (lm90) Only report alarms if driver is ready
- CVE-2026-74551 hwmon: (nzxt-smart2) DMA-align output buffer