Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 394 of 1013.
- CVE-2026-74364 bpf: Reject exclusive maps as inner maps in map-in-map
- CVE-2026-74363 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
- CVE-2026-74362 ext2: fix ignored return value of generic_write_sync()
- CVE-2026-74361 nvme: fix FDP fdpcidx bounds check
- CVE-2026-74360 bpf: Reject exclusive maps for bpf_map_elem iterators
- CVE-2026-7436 Cross-site scripting in WPC Badge Management for WooCommerce
- CVE-2026-74359 configfs_lookup(): don't leave ->s_dentry dangling on failure
- CVE-2026-74358 ext4: fix fast commit wait/wake bit mapping on 64-bit
- CVE-2026-74357 drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump
- CVE-2026-74356 vhost: fix vhost_get_avail_idx for a non empty ring
- CVE-2026-74355 iommu/vt-d: Fix RB-tree corruption in probe error path
- CVE-2026-74354 bpf: Take mmap_lock in zap_pages()
- CVE-2026-74353 drm/amdkfd: always resume_all after suspend_all
- CVE-2026-74352 of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
- CVE-2026-74351 ocfs2: rebase copied fsdlm LVB pointers in locking_state
- CVE-2026-74350 ocfs2: validate fast symlink target during inode read
- CVE-2026-7435 SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString
- CVE-2026-74349 ocfs2: reject FITRIM ranges shorter than a cluster
- CVE-2026-74348 ocfs2/dlm: require a ref for locking_state debugfs open
- CVE-2026-74347 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
- CVE-2026-74346 RDMA/irdma: Fix OOB read during CQ MR registration
- CVE-2026-74345 RDMA/siw: Fix endpoint/socket association handling
- CVE-2026-74344 bpf: Clear rb node linkage when freeing bpf_rb_root
- CVE-2026-74343 kernfs: fix xattr race condition with multiple superblocks
- CVE-2026-74342 kernfs: link kn to its parent before the LSM init hook
- CVE-2026-74341 wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
- CVE-2026-74340 wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
- CVE-2026-74339 ALSA: seq: Clear variable event pointer on read
- CVE-2026-74338 bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
- CVE-2026-74337 bpf: Fix NMI/tracepoint re-entry deadlock on lru locks
- CVE-2026-74336 wifi: mac80211: bound S1G TIM PVB walk to the TIM element
- CVE-2026-74335 bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
- CVE-2026-74334 RDMA/nldev: Fix locking when accessing mr->pd
- CVE-2026-74333 ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
- CVE-2026-74332 ASoC: amd: acp-sdw-sof: Bound DAI link iteration
- CVE-2026-74331 firmware_loader: Fix recursive lock in device_cache_fw_images()
- CVE-2026-74330 configfs: fix lockless traversals of ->s_children
- CVE-2026-74329 watchdog: unregister PM notifier on watchdog unregister
- CVE-2026-74328 iommufd: Destroy the pages content after detaching from dmabuf
- CVE-2026-74327 vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
- CVE-2026-74326 wifi: mt76: mt7921: fix resource leak in probe error path
- CVE-2026-74325 wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
- CVE-2026-74324 wifi: mt76: mt7925: validate skb length in testmode query
- CVE-2026-74323 wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()
- CVE-2026-74322 wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()
- CVE-2026-74321 btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
- CVE-2026-74320 fbdev: sm501fb: Fix buffer errors in OF binding code
- CVE-2026-7432 Race condition in Secure Access Client
- CVE-2026-74319 btrfs: zoned: fix deadlock waiting for ticket during data relocation
- CVE-2026-74318 btrfs: fix deadlock cloning inline extent when using flushoncommit
- CVE-2026-74317 ixgbe: do not configure xps for XDP queues
- CVE-2026-74316 NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
- CVE-2026-74315 lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
- CVE-2026-74314 bpf: Cancel special fields on map value recycle
- CVE-2026-74313 vduse: hold vduse_lock across IDR lookup in open path
- CVE-2026-74312 vhost/vdpa: validate virtqueue index in mmap and fault paths
- CVE-2026-74311 virtio: rtc: tear down old virtqueues before restore
- CVE-2026-74310 vhost/net: complete zerocopy ubufs only once
- CVE-2026-7431 Misconfiguration in Secure Access Client
- CVE-2026-74309 vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
- CVE-2026-74308 ext4: fix kernel BUG in ext4_write_inline_data_end
- CVE-2026-74307 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
- CVE-2026-74306 vfio/qat: fix f_pos race in qat_vf_resume_write()
- CVE-2026-74305 bpf: Tighten cgroup storage cookie checks for prog arrays
- CVE-2026-74304 Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device
- CVE-2026-74303 Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
- CVE-2026-74302 Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
- CVE-2026-74301 Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
- CVE-2026-74300 Bluetooth: hci: validate codec capability element length
- CVE-2026-7430 Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import
- CVE-2026-74299 RDMA/core: Fix FRMR aging push to queue error flow
- CVE-2026-74298 RDMA/core: Fix FRMR set pinned push error path
- CVE-2026-74297 RDMA/mlx5: Fix undefined shift of user RQ WQE size
- CVE-2026-74296 RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
- CVE-2026-74295 ASoC: codecs: hdac_hdmi: Validate written enum value
- CVE-2026-74294 ASoC: meson: aiu: Validate written enum values
- CVE-2026-74293 ASoC: fsl: fsl_audmix: Validate written enum values
- CVE-2026-74292 ASoC: tegra: tegra210_ahub: Validate written enum value
- CVE-2026-74291 ASoC: topology: Check PCM and DAI name strings before use
- CVE-2026-74290 net/sched: cls_flow: Dont expose folded kernel pointers
- CVE-2026-7429 SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing
- CVE-2026-74289 ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
- CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
- CVE-2026-74287 sctp: validate embedded address parameter length
- CVE-2026-74286 net: pfcp: allocate per-cpu tstats for PFCP netdevs
- CVE-2026-74285 net: Stop leased rxq before uninstalling its memory provider
- CVE-2026-74284 net/sched: sch_hfsc: Don't make class passive twice
- CVE-2026-74283 tipc: require net admin for TIPCv2 netlink mutators
- CVE-2026-74282 tipc: prevent snt_unacked underflow on CONN_ACK
- CVE-2026-74281 tipc: reject inverted service ranges from peer bindings
- CVE-2026-74280 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
- CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL
- CVE-2026-74279 crypto: cavium/cpt - fix DMA cleanup using wrong loop index
- CVE-2026-74278 ALSA: seq: Fix kernel heap address leak in bounce_error_event()
- CVE-2026-74277 iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path
- CVE-2026-74276 spi: xilinx: use FIFO occupancy register to determine buffer size
- CVE-2026-74275 cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()
- CVE-2026-74274 cxl/region: Fill first free targets[] slot during auto-discovery
- CVE-2026-74273 cxl/region: Block region delete during region creation
- CVE-2026-74272 cxl/region: Resolve region deletion races