Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 410 of 1013.
- CVE-2026-72498 RDMA/bnxt_re: Avoid displaying the kernel pointer
- CVE-2026-72497 RDMA/bnxt_re: Add a max slot check for SQ
- CVE-2026-72496 RDMA/bnxt_re: Proper rollback if the ioremap fails
- CVE-2026-72495 RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
- CVE-2026-72494 RDMA/irdma: Replace waitqueue and flag with completion
- CVE-2026-72493 net: serialize netif_running() check in enqueue_to_backlog()
- CVE-2026-72492 ksmbd: fix use-after-free in same_client_has_lease()
- CVE-2026-72491 net/9p: fix race condition on rdma->state in trans_rdma.c
- CVE-2026-72490 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt
- CVE-2026-7249 Missing authorization in Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget
- CVE-2026-72489 staging: nvec: fix use-after-free in nvec_rx_completed()
- CVE-2026-72488 soundwire: fix bug in sdw_add_element_group_count found by syzkaller
- CVE-2026-72487 PCI: Check ROM header and data structure addr before accessing
- CVE-2026-72486 mailbox: mtk-adsp: fix UAF during device teardown
- CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds
- CVE-2026-72484 staging: most: video: avoid double free on video register failure
- CVE-2026-72483 usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
- CVE-2026-72482 gpib: fix double decrement of descriptor_busy in command_ioctl()
- CVE-2026-72481 iio: magnetometer: ak8975: fix potential kernel stack memory leak
- CVE-2026-72480 iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
- CVE-2026-7248 D-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflow
- CVE-2026-72479 iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
- CVE-2026-72478 fs/ntfs3: add bounds check to run_get_highest_vcn()
- CVE-2026-72477 fs/ntfs3: call _ntfs_bad_inode() when failing to rename
- CVE-2026-72476 dmaengine: Fix possible use after free
- CVE-2026-72475 dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
- CVE-2026-72474 dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
- CVE-2026-72473 xprtrdma: Decouple req recycling from RPC completion
- CVE-2026-72472 nfs: use nfsi->rwsem to protect traversal of the file lock list
- CVE-2026-72471 fs/ntfs3: prevent potential lcn remains uninitialized
- CVE-2026-72470 fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
- CVE-2026-7247 D-Link DI-8100 File Extension file_exten.asp file_exten_asp buffer overflow
- CVE-2026-72469 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
- CVE-2026-72468 xprtrdma: Initialize re_id before removal registration
- CVE-2026-72467 xprtrdma: Check frwr_wp_create() during connect
- CVE-2026-72466 xprtrdma: Fix bcall rep leak and unbounded peek
- CVE-2026-72465 xprtrdma: Sanitize the reply credit grant after parsing
- CVE-2026-72464 xprtrdma: Repost Receive buffers for malformed replies
- CVE-2026-72463 xfrm: Fix dev use-after-free in xfrm async resumption
- CVE-2026-72462 apparmor: fix race in unix socket mediation when peer_path is used
- CVE-2026-72461 apparmor: fix refcount leak when updating the sk_ctx
- CVE-2026-72460 apparmor: check label build before no_new_privs test
- CVE-2026-7246 [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
- CVE-2026-72459 apparmor: aa_label_alloc use aa_label_free on alloc failure
- CVE-2026-72458 apparmor: fix NULL pointer dereference in unpack_pdb
- CVE-2026-72457 apparmor: fail policy unpack on accept2 allocation failure
- CVE-2026-72456 apparmor: release exe file resources on path failure
- CVE-2026-72455 apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()
- CVE-2026-72454 i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
- CVE-2026-72453 regcache: Do not overwrite error code when finalizing cache after error
- CVE-2026-72452 drm/i915: clear CRTC color blob pointers after dropping refs
- CVE-2026-72451 xfrm: Fix xfrm state cache insertion race
- CVE-2026-72450 xfrm: validate selector family and prefixlen during match
- CVE-2026-72449 drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
- CVE-2026-72448 octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
- CVE-2026-72447 sctp: hold socket lock when dumping endpoints in sctp_diag
- CVE-2026-72446 ALSA: usb-audio: qcom: reject stream disable with no active interface
- CVE-2026-72445 ALSA: usb-audio: qcom: clear opened when stream enable fails
- CVE-2026-72444 flow_dissector: check device type before reading ETH_ADDRS
- CVE-2026-72443 ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
- CVE-2026-72442 netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
- CVE-2026-72441 ieee802154: fix kernel-infoleak in dgram_recvmsg()
- CVE-2026-72440 md/raid1: fix writes_pending and barrier reference leaks on write failures
- CVE-2026-7244 Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection
- CVE-2026-72439 md/raid10: fix writes_pending leak on write request failures
- CVE-2026-72438 md/raid10: fix writes_pending and barrier reference leaks on discard failures
- CVE-2026-72437 md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
- CVE-2026-72436 netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
- CVE-2026-72435 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
- CVE-2026-72434 netfilter: ipset: make sure gc is properly stopped
- CVE-2026-72433 netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
- CVE-2026-72432 tpm_crb: Check ACPI_COMPANION() against NULL during probe
- CVE-2026-72431 alloc_tag: fix use-after-free in /proc/allocinfo after module unload
- CVE-2026-72430 net/sched: act_ct: fix nf_connlabels leak on two error paths
- CVE-2026-7243 Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection
- CVE-2026-72429 ipv6: ioam: fix type confusion of dst_entry
- CVE-2026-72428 bpf: Fix stack slot index in nospec checks
- CVE-2026-72427 bpf: Fix effective prog array index with BPF_F_PREORDER
- CVE-2026-72426 bpf: Preserve pointer spill metadata during half-slot cleanup
- CVE-2026-72425 ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
- CVE-2026-72424 rtc: msc313: fix NULL deref in shared IRQ handler at probe
- CVE-2026-72423 bpf: Guard conntrack opts error writes
- CVE-2026-72422 ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
- CVE-2026-72421 ipv4: fib: Don't ignore error route in local/main tables.
- CVE-2026-72420 md/raid5: avoid R5_Overlap races while breaking stripe batches
- CVE-2026-7242 Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection
- CVE-2026-72419 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
- CVE-2026-72418 netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
- CVE-2026-72417 netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
- CVE-2026-72416 netfilter: nft_compat: ebtables emulation must reject non-bridge targets
- CVE-2026-72415 ASoC: SDCA: Validate written enum value in ge_put_enum_double()
- CVE-2026-72414 net: dsa: sja1105: round up PTP perout pin duration
- CVE-2026-72413 sctp: fix err_chunk memory leaks in INIT handling
- CVE-2026-72412 s390/mm: Fix handling of _PAGE_UNUSED pte bit
- CVE-2026-72411 net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work
- CVE-2026-72410 octeontx2-af: Validate NIX maximum LFs correctly
- CVE-2026-7241 Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection
- CVE-2026-72409 net: mvneta: re-enable percpu interrupt on resume
- CVE-2026-72408 geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
- CVE-2026-72407 geneve: validate inner network offset in geneve_gro_complete()