# Vulnerabilities published in 2026


- [CVE-2026-74457](https://insights.sbomify.com/CVE-2026-74457/): can: peak_usb: add bounds check for USB channel index (not scored)
- [CVE-2026-74456](https://insights.sbomify.com/CVE-2026-74456/): can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (high 7.8)
- [CVE-2026-74455](https://insights.sbomify.com/CVE-2026-74455/): can: peak_usb: validate uCAN receive record lengths (not scored)
- [CVE-2026-74454](https://insights.sbomify.com/CVE-2026-74454/): drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (high 7.8)
- [CVE-2026-74453](https://insights.sbomify.com/CVE-2026-74453/): drm/vc4: Zero the tile state data array before each BIN job (high 7.8)
- [CVE-2026-74452](https://insights.sbomify.com/CVE-2026-74452/): drm/panthor: reject firmware sections with oversized data (high 7.8)
- [CVE-2026-74451](https://insights.sbomify.com/CVE-2026-74451/): drm/panthor: validate firmware interface structure sizes (high 7.8)
- [CVE-2026-74450](https://insights.sbomify.com/CVE-2026-74450/): drm/amd/pm: fix pptable use-after-free (high 7.8)
- [CVE-2026-7445](https://insights.sbomify.com/CVE-2026-7445/): ZachHandley ZMCPTools MCP Log Resource ResourceManager.ts path traversal (medium 5.3)
- [CVE-2026-74449](https://insights.sbomify.com/CVE-2026-74449/): drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (high 7.8)
- [CVE-2026-74448](https://insights.sbomify.com/CVE-2026-74448/): drm/amdkfd: fix QID bit leak in pqm_create_queue() (not scored)
- [CVE-2026-74447](https://insights.sbomify.com/CVE-2026-74447/): drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (high 7.8)
- [CVE-2026-74446](https://insights.sbomify.com/CVE-2026-74446/): drm/amdkfd: hold event_mutex while checkpointing CRIU events (high 7.8)
- [CVE-2026-74445](https://insights.sbomify.com/CVE-2026-74445/): drm/vmwgfx: reject DX_BIND_QUERY without a DX context (not scored)
- [CVE-2026-74444](https://insights.sbomify.com/CVE-2026-74444/): drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (high 7.8)
- [CVE-2026-74443](https://insights.sbomify.com/CVE-2026-74443/): drm/vmwgfx: bound DMA command body size against suffix pointer (high 8.8)
- [CVE-2026-74442](https://insights.sbomify.com/CVE-2026-74442/): drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (not scored)
- [CVE-2026-74441](https://insights.sbomify.com/CVE-2026-74441/): usb: typec: ucsi: Fix race condition and ordering in port unregistration (not scored)
- [CVE-2026-74440](https://insights.sbomify.com/CVE-2026-74440/): drm/xe: Wait on external BO kernel fences in exec IOCTL (high 7.8)
- [CVE-2026-7444](https://insights.sbomify.com/CVE-2026-7444/): Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery (high 8.1)
- [CVE-2026-74439](https://insights.sbomify.com/CVE-2026-74439/): iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (critical 9.3)
- [CVE-2026-74438](https://insights.sbomify.com/CVE-2026-74438/): crypto: sun4i-ss - Remove insecure and unused rng_alg (high 7.8)
- [CVE-2026-74437](https://insights.sbomify.com/CVE-2026-74437/): media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work (not scored)
- [CVE-2026-74436](https://insights.sbomify.com/CVE-2026-74436/): rxrpc: serialize kernel accept preallocation with socket teardown (critical 9.8)
- [CVE-2026-74435](https://insights.sbomify.com/CVE-2026-74435/): rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (high 7.5)
- [CVE-2026-74434](https://insights.sbomify.com/CVE-2026-74434/): rxrpc: Don't move a peeked OOB message onto the pending queue (critical 9.8)
- [CVE-2026-74433](https://insights.sbomify.com/CVE-2026-74433/): rxrpc: Fix UAF in rxgk_issue_challenge() (critical 9.8)
- [CVE-2026-74432](https://insights.sbomify.com/CVE-2026-74432/): rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) (not scored)
- [CVE-2026-74431](https://insights.sbomify.com/CVE-2026-74431/): rxrpc: Fix potential infinite loop in rxrpc_recvmsg() (high 7.5)
- [CVE-2026-74430](https://insights.sbomify.com/CVE-2026-74430/): rxrpc: Fix ACKALL packet handling (high 7.5)
- [CVE-2026-7443](https://insights.sbomify.com/CVE-2026-7443/): BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection (medium 6.9)
- [CVE-2026-74429](https://insights.sbomify.com/CVE-2026-74429/): rxrpc: Fix the reception of a reply packet before data transmission (high 7.5)
- [CVE-2026-74428](https://insights.sbomify.com/CVE-2026-74428/): rxrpc: Fix double unlock in rxrpc_recvmsg() (critical 9.8)
- [CVE-2026-74427](https://insights.sbomify.com/CVE-2026-74427/): afs: Fix netns teardown to cancel the preallocation charger (critical 9.8)
- [CVE-2026-74426](https://insights.sbomify.com/CVE-2026-74426/): afs: fix NULL pointer dereference in afs_get_tree() (not scored)
- [CVE-2026-74425](https://insights.sbomify.com/CVE-2026-74425/): afs: handle CB.InitCallBackState3 requests without a server record (high 7.5)
- [CVE-2026-74424](https://insights.sbomify.com/CVE-2026-74424/): fbcon: fix NULL pointer dereference for a console without vc_data (not scored)
- [CVE-2026-74423](https://insights.sbomify.com/CVE-2026-74423/): accel/amdxdna: Fix leak when pinning ubuf pages (not scored)
- [CVE-2026-74422](https://insights.sbomify.com/CVE-2026-74422/): drm/rockchip: inno-hdmi: Switch to drmm_kzalloc() (not scored)
- [CVE-2026-74421](https://insights.sbomify.com/CVE-2026-74421/): drm/rockchip: dw_dp: Switch to drmm_kzalloc() (not scored)
- [CVE-2026-74420](https://insights.sbomify.com/CVE-2026-74420/): drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges (not scored)
- [CVE-2026-74419](https://insights.sbomify.com/CVE-2026-74419/): accel/amdxdna: Adjust size for copy_to_user() (high 7.3)
- [CVE-2026-74418](https://insights.sbomify.com/CVE-2026-74418/): dma-fence: Fix potential tracepoint null pointer dereferences (not scored)
- [CVE-2026-74417](https://insights.sbomify.com/CVE-2026-74417/): drm/radeon: fix integer overflow in radeon_align_pitch() (high 7.8)
- [CVE-2026-74416](https://insights.sbomify.com/CVE-2026-74416/): drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (not scored)
- [CVE-2026-74415](https://insights.sbomify.com/CVE-2026-74415/): spi: atcspi200: fix use-after-free when driver unbind (not scored)
- [CVE-2026-74414](https://insights.sbomify.com/CVE-2026-74414/): hfsplus: Remove the duplicate attr inode dirty marking action (not scored)
- [CVE-2026-74413](https://insights.sbomify.com/CVE-2026-74413/): wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers (high 8.8)
- [CVE-2026-74412](https://insights.sbomify.com/CVE-2026-74412/): wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers (high 8.8)
- [CVE-2026-74411](https://insights.sbomify.com/CVE-2026-74411/): wifi: rtw89: Correct data type for scan index to avoid infinite loop (high 8.8)
- [CVE-2026-74410](https://insights.sbomify.com/CVE-2026-74410/): wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (high 8.1)
- [CVE-2026-7441](https://insights.sbomify.com/CVE-2026-7441/): Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-74409](https://insights.sbomify.com/CVE-2026-74409/): wifi: rtw89: add bounds check on firmware mac_id in link lookup (high 8.8)
- [CVE-2026-74408](https://insights.sbomify.com/CVE-2026-74408/): wifi: ath9k: fix OOB access from firmware tx status queue ID (high 8.8)
- [CVE-2026-74407](https://insights.sbomify.com/CVE-2026-74407/): wifi: ath11k: cancel SSR work items during PCI shutdown (high 8.8)
- [CVE-2026-74406](https://insights.sbomify.com/CVE-2026-74406/): vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). (critical 9.8)
- [CVE-2026-74405](https://insights.sbomify.com/CVE-2026-74405/): OPP: Fix race between OPP addition and lookup (high 7.8)
- [CVE-2026-74404](https://insights.sbomify.com/CVE-2026-74404/): crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (high 7.8)
- [CVE-2026-74403](https://insights.sbomify.com/CVE-2026-74403/): crypto: ccp - Check for page allocation failure correctly in TIO (high 7.8)
- [CVE-2026-74402](https://insights.sbomify.com/CVE-2026-74402/): crypto: atmel-sha204a - fix blocking and non-blocking rng logic (not scored)
- [CVE-2026-74401](https://insights.sbomify.com/CVE-2026-74401/): dlm: fix add msg handle in send_queue ordered (critical 9.8)
- [CVE-2026-74400](https://insights.sbomify.com/CVE-2026-74400/): bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries (not scored)
- [CVE-2026-74399](https://insights.sbomify.com/CVE-2026-74399/): evm: terminate and bound the evm_xattrs read buffer (not scored)
- [CVE-2026-74398](https://insights.sbomify.com/CVE-2026-74398/): ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (critical 9.8)
- [CVE-2026-74397](https://insights.sbomify.com/CVE-2026-74397/): IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (high 7.8)
- [CVE-2026-74396](https://insights.sbomify.com/CVE-2026-74396/): RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure (high 7.5)
- [CVE-2026-74395](https://insights.sbomify.com/CVE-2026-74395/): RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (not scored)
- [CVE-2026-74394](https://insights.sbomify.com/CVE-2026-74394/): RDMA/srpt: fix integer overflow in immediate data length check (critical 9.8)
- [CVE-2026-74393](https://insights.sbomify.com/CVE-2026-74393/): drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (not scored)
- [CVE-2026-74392](https://insights.sbomify.com/CVE-2026-74392/): dm: limit target bio polling to one shot (not scored)
- [CVE-2026-74391](https://insights.sbomify.com/CVE-2026-74391/): tracing: Bound synthetic-field strings with seq_buf (not scored)
- [CVE-2026-74390](https://insights.sbomify.com/CVE-2026-74390/): RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (high 7.8)
- [CVE-2026-7439](https://insights.sbomify.com/CVE-2026-7439/): AgentFlow Local Web API Content-Type Validation Bypass (medium 4.8)
- [CVE-2026-74389](https://insights.sbomify.com/CVE-2026-74389/): RDMA/hns: Fix log flood after cmd_mbox failure (not scored)
- [CVE-2026-74388](https://insights.sbomify.com/CVE-2026-74388/): ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (high 7.8)
- [CVE-2026-74387](https://insights.sbomify.com/CVE-2026-74387/): ALSA: seq: midi: Serialize output teardown with event_input (high 7.8)
- [CVE-2026-74386](https://insights.sbomify.com/CVE-2026-74386/): nvmet-tcp: fix page fragment cache leak in error path (not scored)
- [CVE-2026-74385](https://insights.sbomify.com/CVE-2026-74385/): nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (high 7.5)
- [CVE-2026-74384](https://insights.sbomify.com/CVE-2026-74384/): nvme-multipath: fix flex array size in struct nvme_ns_head (critical 9.8)
- [CVE-2026-74383](https://insights.sbomify.com/CVE-2026-74383/): nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools (high 8.4)
- [CVE-2026-74382](https://insights.sbomify.com/CVE-2026-74382/): net/sched: cls_bpf: prevent unbounded recursion in offload rollback (not scored)
- [CVE-2026-74381](https://insights.sbomify.com/CVE-2026-74381/): gpu: host1x: Allow entries in BO caches to be freed (not scored)
- [CVE-2026-74380](https://insights.sbomify.com/CVE-2026-74380/): gpu: host1x: Fix iommu_map_sgtable() return value check (high 8.8)
- [CVE-2026-7438](https://insights.sbomify.com/CVE-2026-7438/): Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-74379](https://insights.sbomify.com/CVE-2026-74379/): dax/kmem: account for partial discontiguous resource upon removal (not scored)
- [CVE-2026-74378](https://insights.sbomify.com/CVE-2026-74378/): RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (high 7.8)
- [CVE-2026-74377](https://insights.sbomify.com/CVE-2026-74377/): RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (high 7.8)
- [CVE-2026-74376](https://insights.sbomify.com/CVE-2026-74376/): md/raid10: reset read_slot when reusing r10bio for discard (critical 9.8)
- [CVE-2026-74375](https://insights.sbomify.com/CVE-2026-74375/): md/raid1,raid10: fix deadlock in read error recovery path (not scored)
- [CVE-2026-74374](https://insights.sbomify.com/CVE-2026-74374/): md/raid1,raid10: fix error-path detection with md_cloned_bio() (high 7.5)
- [CVE-2026-74373](https://insights.sbomify.com/CVE-2026-74373/): md/raid1,raid10: fix bio accounting for split md cloned bios (not scored)
- [CVE-2026-74372](https://insights.sbomify.com/CVE-2026-74372/): raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path (not scored)
- [CVE-2026-74371](https://insights.sbomify.com/CVE-2026-74371/): bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat (high 7.8)
- [CVE-2026-74370](https://insights.sbomify.com/CVE-2026-74370/): liveupdate: fix TOCTOU race in luo_session_retrieve() (not scored)
- [CVE-2026-7437](https://insights.sbomify.com/CVE-2026-7437/): AzonPost <= 1.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-74369](https://insights.sbomify.com/CVE-2026-74369/): liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() (not scored)
- [CVE-2026-74368](https://insights.sbomify.com/CVE-2026-74368/): wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (not scored)
- [CVE-2026-74367](https://insights.sbomify.com/CVE-2026-74367/): wifi: ath12k: fix inconsistent arvif state in vdev_create error paths (high 7.8)
- [CVE-2026-74366](https://insights.sbomify.com/CVE-2026-74366/): wifi: ath12k: fix NULL deref in change_sta_links for unready link (not scored)
- [CVE-2026-74365](https://insights.sbomify.com/CVE-2026-74365/): nvdimm/btt: Handle preemption in BTT lane acquisition (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/393/