Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 393 of 1013.
- CVE-2026-74457 can: peak_usb: add bounds check for USB channel index
- CVE-2026-74456 can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
- CVE-2026-74455 can: peak_usb: validate uCAN receive record lengths
- CVE-2026-74454 drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
- CVE-2026-74453 drm/vc4: Zero the tile state data array before each BIN job
- CVE-2026-74452 drm/panthor: reject firmware sections with oversized data
- CVE-2026-74451 drm/panthor: validate firmware interface structure sizes
- CVE-2026-74450 drm/amd/pm: fix pptable use-after-free
- CVE-2026-7445 ZachHandley ZMCPTools MCP Log Resource ResourceManager.ts path traversal
- CVE-2026-74449 drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
- CVE-2026-74448 drm/amdkfd: fix QID bit leak in pqm_create_queue()
- CVE-2026-74447 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
- CVE-2026-74446 drm/amdkfd: hold event_mutex while checkpointing CRIU events
- CVE-2026-74445 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
- CVE-2026-74444 drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- CVE-2026-74443 drm/vmwgfx: bound DMA command body size against suffix pointer
- CVE-2026-74442 drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- CVE-2026-74441 usb: typec: ucsi: Fix race condition and ordering in port unregistration
- CVE-2026-74440 drm/xe: Wait on external BO kernel fences in exec IOCTL
- CVE-2026-7444 Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery
- CVE-2026-74439 iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry
- CVE-2026-74438 crypto: sun4i-ss - Remove insecure and unused rng_alg
- CVE-2026-74437 media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work
- CVE-2026-74436 rxrpc: serialize kernel accept preallocation with socket teardown
- CVE-2026-74435 rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
- CVE-2026-74434 rxrpc: Don't move a peeked OOB message onto the pending queue
- CVE-2026-74433 rxrpc: Fix UAF in rxgk_issue_challenge()
- CVE-2026-74432 rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
- CVE-2026-74431 rxrpc: Fix potential infinite loop in rxrpc_recvmsg()
- CVE-2026-74430 rxrpc: Fix ACKALL packet handling
- CVE-2026-7443 BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection
- CVE-2026-74429 rxrpc: Fix the reception of a reply packet before data transmission
- CVE-2026-74428 rxrpc: Fix double unlock in rxrpc_recvmsg()
- CVE-2026-74427 afs: Fix netns teardown to cancel the preallocation charger
- CVE-2026-74426 afs: fix NULL pointer dereference in afs_get_tree()
- CVE-2026-74425 afs: handle CB.InitCallBackState3 requests without a server record
- CVE-2026-74424 fbcon: fix NULL pointer dereference for a console without vc_data
- CVE-2026-74423 accel/amdxdna: Fix leak when pinning ubuf pages
- CVE-2026-74422 drm/rockchip: inno-hdmi: Switch to drmm_kzalloc()
- CVE-2026-74421 drm/rockchip: dw_dp: Switch to drmm_kzalloc()
- CVE-2026-74420 drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges
- CVE-2026-74419 accel/amdxdna: Adjust size for copy_to_user()
- CVE-2026-74418 dma-fence: Fix potential tracepoint null pointer dereferences
- CVE-2026-74417 drm/radeon: fix integer overflow in radeon_align_pitch()
- CVE-2026-74416 drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
- CVE-2026-74415 spi: atcspi200: fix use-after-free when driver unbind
- CVE-2026-74414 hfsplus: Remove the duplicate attr inode dirty marking action
- CVE-2026-74413 wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers
- CVE-2026-74412 wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers
- CVE-2026-74411 wifi: rtw89: Correct data type for scan index to avoid infinite loop
- CVE-2026-74410 wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
- CVE-2026-7441 Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2026-74409 wifi: rtw89: add bounds check on firmware mac_id in link lookup
- CVE-2026-74408 wifi: ath9k: fix OOB access from firmware tx status queue ID
- CVE-2026-74407 wifi: ath11k: cancel SSR work items during PCI shutdown
- CVE-2026-74406 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
- CVE-2026-74405 OPP: Fix race between OPP addition and lookup
- CVE-2026-74404 crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
- CVE-2026-74403 crypto: ccp - Check for page allocation failure correctly in TIO
- CVE-2026-74402 crypto: atmel-sha204a - fix blocking and non-blocking rng logic
- CVE-2026-74401 dlm: fix add msg handle in send_queue ordered
- CVE-2026-74400 bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries
- CVE-2026-74399 evm: terminate and bound the evm_xattrs read buffer
- CVE-2026-74398 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
- CVE-2026-74397 IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
- CVE-2026-74396 RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure
- CVE-2026-74395 RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
- CVE-2026-74394 RDMA/srpt: fix integer overflow in immediate data length check
- CVE-2026-74393 drm/syncobj: Fix memory leak in drm_syncobj_find_fence()
- CVE-2026-74392 dm: limit target bio polling to one shot
- CVE-2026-74391 tracing: Bound synthetic-field strings with seq_buf
- CVE-2026-74390 RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
- CVE-2026-7439 AgentFlow Local Web API Content-Type Validation Bypass
- CVE-2026-74389 RDMA/hns: Fix log flood after cmd_mbox failure
- CVE-2026-74388 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
- CVE-2026-74387 ALSA: seq: midi: Serialize output teardown with event_input
- CVE-2026-74386 nvmet-tcp: fix page fragment cache leak in error path
- CVE-2026-74385 nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
- CVE-2026-74384 nvme-multipath: fix flex array size in struct nvme_ns_head
- CVE-2026-74383 nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools
- CVE-2026-74382 net/sched: cls_bpf: prevent unbounded recursion in offload rollback
- CVE-2026-74381 gpu: host1x: Allow entries in BO caches to be freed
- CVE-2026-74380 gpu: host1x: Fix iommu_map_sgtable() return value check
- CVE-2026-7438 Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-74379 dax/kmem: account for partial discontiguous resource upon removal
- CVE-2026-74378 RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
- CVE-2026-74377 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
- CVE-2026-74376 md/raid10: reset read_slot when reusing r10bio for discard
- CVE-2026-74375 md/raid1,raid10: fix deadlock in read error recovery path
- CVE-2026-74374 md/raid1,raid10: fix error-path detection with md_cloned_bio()
- CVE-2026-74373 md/raid1,raid10: fix bio accounting for split md cloned bios
- CVE-2026-74372 raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
- CVE-2026-74371 bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
- CVE-2026-74370 liveupdate: fix TOCTOU race in luo_session_retrieve()
- CVE-2026-7437 AzonPost <= 1.3 - Reflected Cross-Site Scripting
- CVE-2026-74369 liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()
- CVE-2026-74368 wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
- CVE-2026-74367 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
- CVE-2026-74366 wifi: ath12k: fix NULL deref in change_sta_links for unready link
- CVE-2026-74365 nvdimm/btt: Handle preemption in BTT lane acquisition