# Vulnerabilities published in 2026


- [CVE-2026-74642](https://insights.sbomify.com/CVE-2026-74642/): ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (not scored)
- [CVE-2026-74641](https://insights.sbomify.com/CVE-2026-74641/): ALSA: usx2y: bound the hwdep mmap fault offset (high 7.8)
- [CVE-2026-74640](https://insights.sbomify.com/CVE-2026-74640/): ALSA: FCP: fix OOB write in fcp_meter_ctl_get() (high 7.8)
- [CVE-2026-7464](https://insights.sbomify.com/CVE-2026-7464/): WP Google Maps Integration <= 1.2 - Reflected Cross-Site Scripting via 'page' Parameter (medium 6.1)
- [CVE-2026-74639](https://insights.sbomify.com/CVE-2026-74639/): ALSA: us144mkii: re-anchor capture URBs on resubmission (not scored)
- [CVE-2026-74638](https://insights.sbomify.com/CVE-2026-74638/): drm/v3d: Serialize the scheduler timeout handlers (not scored)
- [CVE-2026-74637](https://insights.sbomify.com/CVE-2026-74637/): perf/core: Fix group leader use-after-free after sibling detach (high 7.8)
- [CVE-2026-74636](https://insights.sbomify.com/CVE-2026-74636/): tracing: Fix race between update_event_fields and, event_define_fields (not scored)
- [CVE-2026-74635](https://insights.sbomify.com/CVE-2026-74635/): fbdev: bitblit: bound-check glyph index in bit_cursor() (high 7.8)
- [CVE-2026-74634](https://insights.sbomify.com/CVE-2026-74634/): ring-buffer: Prevent subbuf order change when resizing is disabled (high 7.8)
- [CVE-2026-74633](https://insights.sbomify.com/CVE-2026-74633/): tracing: Fix NULL pointer dereference in module event cache removal (not scored)
- [CVE-2026-74632](https://insights.sbomify.com/CVE-2026-74632/): mm/huge_memory: fix huge_zero_pfn race (high 7.8)
- [CVE-2026-74631](https://insights.sbomify.com/CVE-2026-74631/): net: smc: fix splice entry lifetime imbalance in smc_rx_splice (high 8.4)
- [CVE-2026-74630](https://insights.sbomify.com/CVE-2026-74630/): ipv6: prevent in6_dev_get() from resurrecting inet6_dev (high 7.8)
- [CVE-2026-74629](https://insights.sbomify.com/CVE-2026-74629/): net/dibs: Correct freeing of dmb_clientid_arr (high 8.8)
- [CVE-2026-74628](https://insights.sbomify.com/CVE-2026-74628/): net/x25: fix use-after-free of the socket by its timers (critical 9.8)
- [CVE-2026-74627](https://insights.sbomify.com/CVE-2026-74627/): net: devmem: prevent net-iov / page mixing (high 7.8)
- [CVE-2026-74626](https://insights.sbomify.com/CVE-2026-74626/): NTB: ntb_netdev: Preserve RX queue depth on allocation failure (high 7.5)
- [CVE-2026-74625](https://insights.sbomify.com/CVE-2026-74625/): netfilter: bridge: release template ct on non-IP path (high 7.5)
- [CVE-2026-74624](https://insights.sbomify.com/CVE-2026-74624/): netfilter: nf_conntrack: defer invalid log until after unlock (high 7.5)
- [CVE-2026-74623](https://insights.sbomify.com/CVE-2026-74623/): net: atlantic: free stranded TX buffers on ring deinit (not scored)
- [CVE-2026-74622](https://insights.sbomify.com/CVE-2026-74622/): net: atlantic: free RX pages of consumed but not refilled buffers (not scored)
- [CVE-2026-74621](https://insights.sbomify.com/CVE-2026-74621/): net/sched: act_ct: fix sk_buff leak when the header checks reject a packet (high 7.5)
- [CVE-2026-74620](https://insights.sbomify.com/CVE-2026-74620/): net/sched: act_gact, act_police: range check the fallback control action (not scored)
- [CVE-2026-7462](https://insights.sbomify.com/CVE-2026-7462/): VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter (medium 6.1)
- [CVE-2026-74619](https://insights.sbomify.com/CVE-2026-74619/): ovl: don't warn when the mount is completed from another user namespace (not scored)
- [CVE-2026-74618](https://insights.sbomify.com/CVE-2026-74618/): binfmt_misc: don't warn when the mount is completed from another user namespace (not scored)
- [CVE-2026-74617](https://insights.sbomify.com/CVE-2026-74617/): dibs: initialise dibs->lock in dibs_dev_alloc() (critical 9.8)
- [CVE-2026-74616](https://insights.sbomify.com/CVE-2026-74616/): xdp: reject clones that overrun skb_shared_info tailroom (critical 9.8)
- [CVE-2026-74615](https://insights.sbomify.com/CVE-2026-74615/): vxlan: do not arm the ageing timer on a device that is down (high 8.8)
- [CVE-2026-74614](https://insights.sbomify.com/CVE-2026-74614/): vsock/virtio: read virtqueues under worker locks (high 8.4)
- [CVE-2026-74613](https://insights.sbomify.com/CVE-2026-74613/): vsock/virtio: avoid refilling the RX queue after teardown (high 7.8)
- [CVE-2026-74612](https://insights.sbomify.com/CVE-2026-74612/): veth: fix skb length accounting after XDP frag adjustment (critical 10.0)
- [CVE-2026-74611](https://insights.sbomify.com/CVE-2026-74611/): tls: rx: restore msg_iter before TLS 1.3 optimistic retry (critical 9.8)
- [CVE-2026-74610](https://insights.sbomify.com/CVE-2026-74610/): tls: don't leave a full plaintext sk_msg ring unpushed (high 7.8)
- [CVE-2026-7461](https://insights.sbomify.com/CVE-2026-7461/): OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials (high 7.5)
- [CVE-2026-74609](https://insights.sbomify.com/CVE-2026-74609/): tipc: read le->link under the node lock in tipc_node_link_down() (high 7.8)
- [CVE-2026-74608](https://insights.sbomify.com/CVE-2026-74608/): smb: client: Fix use-after-free in cifs_try_adding_channels() (critical 9.8)
- [CVE-2026-74607](https://insights.sbomify.com/CVE-2026-74607/): KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (high 8.8)
- [CVE-2026-74606](https://insights.sbomify.com/CVE-2026-74606/): eventfs: Fix use-after-free in eventfs_remove_rec() (high 7.8)
- [CVE-2026-74605](https://insights.sbomify.com/CVE-2026-74605/): eventfs: Use children field for rcu head and add memory barriers (high 7.8)
- [CVE-2026-74604](https://insights.sbomify.com/CVE-2026-74604/): Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (high 8.4)
- [CVE-2026-74603](https://insights.sbomify.com/CVE-2026-74603/): ptp: ocp: Fix board ID over-read (high 7.1)
- [CVE-2026-74602](https://insights.sbomify.com/CVE-2026-74602/): ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (not scored)
- [CVE-2026-74601](https://insights.sbomify.com/CVE-2026-74601/): ring-buffer: Use current_context for safe per-CPU buffer swap (high 7.8)
- [CVE-2026-74600](https://insights.sbomify.com/CVE-2026-74600/): mm/page_table_check: skip special zero mappings (not scored)
- [CVE-2026-7460](https://insights.sbomify.com/CVE-2026-7460/): mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped (high 7.4)
- [CVE-2026-74599](https://insights.sbomify.com/CVE-2026-74599/): mm/ptdump: always stabilise against page table freeing using init_mm (not scored)
- [CVE-2026-74598](https://insights.sbomify.com/CVE-2026-74598/): ipv6: fix Route Information option length validation (high 7.5)
- [CVE-2026-74597](https://insights.sbomify.com/CVE-2026-74597/): ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (critical 9.8)
- [CVE-2026-74596](https://insights.sbomify.com/CVE-2026-74596/): fs,fsverity: remove check for fsverity being enabled in setattr_prepare() (not scored)
- [CVE-2026-74595](https://insights.sbomify.com/CVE-2026-74595/): fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (high 7.8)
- [CVE-2026-74594](https://insights.sbomify.com/CVE-2026-74594/): sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (high 7.8)
- [CVE-2026-74593](https://insights.sbomify.com/CVE-2026-74593/): sched_ext: Take cgroup_lock() first in scx_cgroup_lock() (not scored)
- [CVE-2026-74592](https://insights.sbomify.com/CVE-2026-74592/): ima: Instantiate file_truncate and path_truncate hooks (high 8.1)
- [CVE-2026-74591](https://insights.sbomify.com/CVE-2026-74591/): mm/filemap: __filemap_add_folio() restore index before retrying (critical 9.8)
- [CVE-2026-74590](https://insights.sbomify.com/CVE-2026-74590/): fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (high 7.8)
- [CVE-2026-7459](https://insights.sbomify.com/CVE-2026-7459/): Missing authorization in Simple History – Track, Log, and Audit WordPress Changes (high 7.5)
- [CVE-2026-74589](https://insights.sbomify.com/CVE-2026-74589/): bpf, sockmap: Fix sk_redir use-after-free in send verdict (high 8.4)
- [CVE-2026-74588](https://insights.sbomify.com/CVE-2026-74588/): sctp: keep chunk->transport in step with the list it is queued on (critical 9.8)
- [CVE-2026-74587](https://insights.sbomify.com/CVE-2026-74587/): sctp: fix use-after-free of cached ASCONF chunk (critical 9.8)
- [CVE-2026-74586](https://insights.sbomify.com/CVE-2026-74586/): sctp: clear new_transport when removing a peer (critical 9.8)
- [CVE-2026-74585](https://insights.sbomify.com/CVE-2026-74585/): thunderbolt: Bound the DROM dual link port number before indexing sw->ports (not scored)
- [CVE-2026-74584](https://insights.sbomify.com/CVE-2026-74584/): RDMA/bnxt_re: zero shared page before exposing to userspace (high 7.1)
- [CVE-2026-74583](https://insights.sbomify.com/CVE-2026-74583/): net/sched: cls_route: fix fastmap use-after-free on filter (high 7.8)
- [CVE-2026-74582](https://insights.sbomify.com/CVE-2026-74582/): packet: use consistent hard_header_len in non-ring send paths (high 7.8)
- [CVE-2026-74581](https://insights.sbomify.com/CVE-2026-74581/): net: ipv6: clear suppressed fib6 rule result (critical 9.8)
- [CVE-2026-74580](https://insights.sbomify.com/CVE-2026-74580/): vhost: reset the vring metadata cache on vring reconfiguration (high 8.8)
- [CVE-2026-7458](https://insights.sbomify.com/CVE-2026-7458/): Auth bypass in User Verification by PickPlugins (critical 9.8)
- [CVE-2026-74579](https://insights.sbomify.com/CVE-2026-74579/): netfilter: nft_payload: fix mask build for partial field offload (high 7.1)
- [CVE-2026-74578](https://insights.sbomify.com/CVE-2026-74578/): crypto: algif_skcipher - force synchronous processing on trees without ctx->state (high 7.1)
- [CVE-2026-74577](https://insights.sbomify.com/CVE-2026-74577/): net: mpls: initialize rtm_tos in mpls_getroute() (not scored)
- [CVE-2026-74576](https://insights.sbomify.com/CVE-2026-74576/): mm/slab: prevent unbounded recursion in free path with new kmalloc type (high 7.5)
- [CVE-2026-74575](https://insights.sbomify.com/CVE-2026-74575/): thunderbolt: Prevent XDomain delayed work use-after-free on disconnect (high 8.8)
- [CVE-2026-74574](https://insights.sbomify.com/CVE-2026-74574/): dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (high 7.8)
- [CVE-2026-74573](https://insights.sbomify.com/CVE-2026-74573/): iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (critical 9.3)
- [CVE-2026-74572](https://insights.sbomify.com/CVE-2026-74572/): btrfs: zoned: fix deadlock between metadata writeback and transaction commit (high 7.5)
- [CVE-2026-74571](https://insights.sbomify.com/CVE-2026-74571/): btrfs: skip global block reserve accounting for rescue mounts (not scored)
- [CVE-2026-74570](https://insights.sbomify.com/CVE-2026-74570/): ntfs: harden runlist realloc size calculations (critical 9.8)
- [CVE-2026-7457](https://insights.sbomify.com/CVE-2026-7457/): LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update (medium 6.4)
- [CVE-2026-74569](https://insights.sbomify.com/CVE-2026-74569/): netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (critical 9.8)
- [CVE-2026-74568](https://insights.sbomify.com/CVE-2026-74568/): KVM: arm64: vgic: Fix race between LPI release and re-registration (critical 9.3)
- [CVE-2026-74567](https://insights.sbomify.com/CVE-2026-74567/): keys: fix out-of-bounds read in keyring_get_key_chunk() (high 7.1)
- [CVE-2026-74566](https://insights.sbomify.com/CVE-2026-74566/): keys: make keyring key-chunk byte order agree with keyring_diff_objects() (not scored)
- [CVE-2026-74565](https://insights.sbomify.com/CVE-2026-74565/): netfilter: nf_tables: make nft_object rhltable per table (high 7.8)
- [CVE-2026-74564](https://insights.sbomify.com/CVE-2026-74564/): netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (high 7.1)
- [CVE-2026-74563](https://insights.sbomify.com/CVE-2026-74563/): rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (high 7.8)
- [CVE-2026-74562](https://insights.sbomify.com/CVE-2026-74562/): nexthop: take nh->lock for f6i_list walks in replace check and notify (high 8.8)
- [CVE-2026-74561](https://insights.sbomify.com/CVE-2026-74561/): nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush (high 8.8)
- [CVE-2026-74560](https://insights.sbomify.com/CVE-2026-74560/): xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx (not scored)
- [CVE-2026-7456](https://insights.sbomify.com/CVE-2026-7456/): Missing authorization in Udimi Tools (medium 6.5)
- [CVE-2026-74559](https://insights.sbomify.com/CVE-2026-74559/): xsk: drain continuation descs after overflow in xsk_build_skb() (not scored)
- [CVE-2026-74558](https://insights.sbomify.com/CVE-2026-74558/): xsk: reclaim invalid Tx descriptors in ZC batch path (not scored)
- [CVE-2026-74557](https://insights.sbomify.com/CVE-2026-74557/): scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (high 7.5)
- [CVE-2026-74556](https://insights.sbomify.com/CVE-2026-74556/): scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (critical 9.8)
- [CVE-2026-74555](https://insights.sbomify.com/CVE-2026-74555/): scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (not scored)
- [CVE-2026-74554](https://insights.sbomify.com/CVE-2026-74554/): wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() (high 8.8)
- [CVE-2026-74553](https://insights.sbomify.com/CVE-2026-74553/): hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (not scored)
- [CVE-2026-74552](https://insights.sbomify.com/CVE-2026-74552/): hwmon: (lm90) Only report alarms if driver is ready (not scored)
- [CVE-2026-74551](https://insights.sbomify.com/CVE-2026-74551/): hwmon: (nzxt-smart2) DMA-align output buffer (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/391/