Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 392 of 1013.
- CVE-2026-74550 net: do not send ICMP/NDISC Redirects when peer allocation fails
- CVE-2026-7455 FLT File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Max
- CVE-2026-74549 hwmon: (nct6775-core) Prevent access to unsupported weight registers
- CVE-2026-74548 forcedeth: fix UAF of txrx_stats in nv_remove
- CVE-2026-74547 hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
- CVE-2026-74546 hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
- CVE-2026-74545 rtase: fix double free of multi-frag skb on DMA map failure
- CVE-2026-74544 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
- CVE-2026-74543 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
- CVE-2026-74542 netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
- CVE-2026-74541 Bluetooth: ISO: clear iso_data always when detaching conn from hcon
- CVE-2026-74540 Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
- CVE-2026-7454 WRL File Parsing Memory Corruption in Autodesk 3ds Max
- CVE-2026-74539 Bluetooth: ISO: lock sk in iso_sock_getname
- CVE-2026-74538 Bluetooth: ISO: lock sk in iso_connect_ind
- CVE-2026-74537 Bluetooth: ISO: hold sk properly in iso_conn_ready
- CVE-2026-74536 Bluetooth: ISO: fix leaking sk after socket release
- CVE-2026-74535 Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
- CVE-2026-74534 Bluetooth: ISO: fix refcounting of iso_conn
- CVE-2026-74533 Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
- CVE-2026-74532 Bluetooth: btintel: Validate length before parsing diagnostics TLV
- CVE-2026-74531 Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
- CVE-2026-74530 Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
- CVE-2026-7453 WRL File Parsing Memory Exhaustion in Autodesk 3ds Max
- CVE-2026-74529 Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
- CVE-2026-74528 Bluetooth: hci_sync: hold conn in hci_past_sync() callback
- CVE-2026-74527 octeontx2-af: Block VFs from clobbering special CGX PKIND state
- CVE-2026-74526 scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
- CVE-2026-74525 net: sxgbe: free TX rings on RX allocation failure
- CVE-2026-74524 riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
- CVE-2026-74523 qede: sync udp_tunnel ports outside qede_lock in the recovery path
- CVE-2026-74522 ksmbd: fix use-after-free in __close_file_table_ids()
- CVE-2026-74521 ksmbd: use memcmp() to compare ClientGUIDs
- CVE-2026-74520 iommu/iommufd: Fix IOPF group ownership UAF
- CVE-2026-7452 WRL File Parsing Memory Corruption in Autodesk 3ds Max
- CVE-2026-74519 pinctrl: devicetree: don't free uninitialized dev_name on error path
- CVE-2026-74518 mm/hugetlb: fix list corruption in allocate_file_region_entries()
- CVE-2026-74517 KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
- CVE-2026-74516 KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
- CVE-2026-74515 KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
- CVE-2026-74514 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
- CVE-2026-74513 dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
- CVE-2026-74512 audit: fix potential use-after-free in audit_del_rule()
- CVE-2026-74510 Bluetooth: mgmt: fix UAF in pair command cancellation
- CVE-2026-7451 TIF File Parsing Out-of-Bounds Write in Autodesk 3ds Max
- CVE-2026-74509 Bluetooth: hci_sync: Fix advertising data UAFs
- CVE-2026-74508 Bluetooth: HIDP: reject frames without a transaction header
- CVE-2026-74507 Bluetooth: HIDP: validate numbered report payloads
- CVE-2026-74506 afs: Fix UAF when sending a message
- CVE-2026-74505 ALSA: 6fire: Fix UAF at error handling during probe
- CVE-2026-74504 ALSA: seq: Fix division by zero in initialize_timer()
- CVE-2026-74503 ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
- CVE-2026-74502 ALSA: ump: fix double free of out_cvts on rawmidi error
- CVE-2026-74501 ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
- CVE-2026-74500 ALSA: usb-audio: fix stack info leak in RME Digiface status
- CVE-2026-7450 PAR File Parsing NULL Pointer Dereference in Autodesk 3ds Max
- CVE-2026-74499 ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
- CVE-2026-74498 ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
- CVE-2026-74497 ALSA: usb-audio: Clamp frame size in implicit-feedback mode
- CVE-2026-74496 fou: Fix use-after-free in fou_create()
- CVE-2026-74495 igbvf: Fix leak in TX DMA error cleanup
- CVE-2026-74494 ksmbd: reject repeated SMB2 NEGOTIATE requests
- CVE-2026-74493 net/smc: fix socket use-after-free during link group termination
- CVE-2026-74492 netfilter: ipset: do not update comments from kernel-side hash adds
- CVE-2026-74491 of/address: Fix NULL bus dereference in of_pci_range_parser_one()
- CVE-2026-74490 tipc: avoid use-after-free in poll trace queue dumps
- CVE-2026-74489 wifi: mac80211: fix tid_tx use-after-free on BA session stop
- CVE-2026-74488 wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
- CVE-2026-74487 binfmt_misc: restore write access when removing an entry
- CVE-2026-74486 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
- CVE-2026-74485 binfmt_misc: reject a flag character as the field delimiter
- CVE-2026-74484 binfmt_misc: don't let an 'F' entry pin its own instance
- CVE-2026-74483 binfmt_misc: don't leak the user namespace when the mount fails
- CVE-2026-74482 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
- CVE-2026-74481 mm/page_reporting: use system_freezable_wq to fix UAF during suspend
- CVE-2026-74480 net: bridge: stop fast-leave after deleting a port group
- CVE-2026-74479 net: pktgen: fix proc entry use-after-free
- CVE-2026-74478 um: vector: fix use-after-free in vector_mmsg_rx()
- CVE-2026-74477 uprobes: Fix NULL pointer dereference in hprobe_expire()
- CVE-2026-74476 veth: convert frag_list skbs before running XDP
- CVE-2026-74475 vxlan: use neigh_ha_snapshot() in route_shortcircuit()
- CVE-2026-74474 vxlan: use pskb_network_may_pull() for transmit path header pulls
- CVE-2026-74473 vxlan: use pskb_network_may_pull() in route_shortcircuit()
- CVE-2026-74472 ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
- CVE-2026-74471 tracing: Check return value of __register_event() in trace_module_add_events()
- CVE-2026-74470 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
- CVE-2026-7447 SourceCodester Pet Grooming Management Software update_customer.php sql injection
- CVE-2026-74469 sctp: prevent peer transport count overflow
- CVE-2026-74468 gpio: pch: use raw_spinlock_t for the register lock
- CVE-2026-74467 s390/qeth: Check CAP_NET_ADMIN for private ioctls
- CVE-2026-74466 s390/zcrypt: Close speculative mem read possibility
- CVE-2026-74465 net: openvswitch: fix potential UAF on meter attach failure
- CVE-2026-74464 net: openvswitch: fix skb leak on flow key update failure during ct
- CVE-2026-74463 i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
- CVE-2026-74462 i2c: imx: mark I2C adapter when hardware is powered down
- CVE-2026-74461 i2c: imx: Cancel hrtimer before clearing slave pointer
- CVE-2026-74460 can: ems_usb: validate CPC message lengths
- CVE-2026-7446 VetCoders mcp-server-semgrep MCP index.ts create_rule os command injection
- CVE-2026-74459 can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
- CVE-2026-74458 can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents