Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 411 of 1013.
- CVE-2026-72406 net: sungem: fix probe error cleanup
- CVE-2026-72405 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
- CVE-2026-72404 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
- CVE-2026-72403 ALSA: FCP: Fix NULL pointer dereference in interface lookup
- CVE-2026-72402 bpf: Mask pseudo pointer values in verifier logs
- CVE-2026-72401 bpf: Fix insn_aux_data leak on verifier err_free_env path
- CVE-2026-72400 seg6: validate SRH length before reading fixed fields
- CVE-2026-7240 Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection
- CVE-2026-72399 net: enetc: check the number of BDs needed for xdp_frame
- CVE-2026-72398 sctp: add INIT verification after cookie unpacking
- CVE-2026-72397 hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
- CVE-2026-72396 hwmon: adm1275: Prevent reading uninitialized stack
- CVE-2026-72395 hwmon: (pmbus) Fix passing events to regulator core
- CVE-2026-72394 hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero
- CVE-2026-72393 eth: fbnic: don't cache shinfo across skb realloc
- CVE-2026-72392 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
- CVE-2026-72391 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
- CVE-2026-72390 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
- CVE-2026-72389 bridge: stp: Fix a potential use-after-free when deleting a bridge
- CVE-2026-72388 drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
- CVE-2026-72387 drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()
- CVE-2026-72386 drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced
- CVE-2026-72385 tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
- CVE-2026-72384 irqchip/ts4800: Fix missing chained handler cleanup on remove
- CVE-2026-72383 sctp: fix addr_wq_timer race in sctp_free_addr_wq()
- CVE-2026-72382 ksmbd: reject undersized DACLs before parsing ACEs
- CVE-2026-72381 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
- CVE-2026-72380 xen/pvcalls: bound backend response req_id before indexing rsp[]
- CVE-2026-7238 code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload
- CVE-2026-72379 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
- CVE-2026-72378 afs: Fix error code in afs_extract_vl_addrs()
- CVE-2026-72377 afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints
- CVE-2026-72376 afs: Fix misplaced inc of net->cells_outstanding
- CVE-2026-72375 afs: Fix reinitialisation of the inode, in particular ->lock_work
- CVE-2026-72374 afs: Fix callback service message parsers to pass through -EAGAIN
- CVE-2026-72373 afs: Fix missing NULL pointer check in afs_break_some_callbacks()
- CVE-2026-72372 afs: Fix lack of locking around modifications of net->cells_dyn_ino
- CVE-2026-72371 afs: Fix the volume AFS_VOLUME_RM_TREE is set on
- CVE-2026-72370 iomap: release pages on atomic dio size mismatch
- CVE-2026-7237 AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal
- CVE-2026-72369 minix: avoid overflow in bitmap block count calculation
- CVE-2026-72368 cachefiles: Fix double unlock in nomem_d_alloc error path
- CVE-2026-72367 iomap: guard io_size EOF trim against concurrent truncate underflow
- CVE-2026-72366 netfs: Fix netfs_create_write_req() to handle async cache object creation
- CVE-2026-72365 netfs: Fix writethrough to use collection offload
- CVE-2026-72364 netfs: Fix writeback error handling
- CVE-2026-72363 netfs: Fix folio state after ENOMEM whilst under writeback iteration
- CVE-2026-72362 drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
- CVE-2026-72361 drm/xe/hw_engine: Fix double-free of managed BO in error path
- CVE-2026-72360 drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
- CVE-2026-72359 drm/xe: fix NPD in bo_meminfo()
- CVE-2026-72358 drm/xe/pt: prevent invalid cursor access for purged BOs
- CVE-2026-72357 uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
- CVE-2026-72356 cifs: Fix missing credit release on failure in cifs_issue_read()
- CVE-2026-72355 netfs: Fix barriering when walking subrequest list
- CVE-2026-72354 ntfs: avoid stale runlist element dereference in MFT writeback
- CVE-2026-72353 ntfs: avoid stale runlist element dereference in fallocate
- CVE-2026-72352 HID: bpf: Fix hid_bpf_get_data() range check
- CVE-2026-72351 gue: validate REMCSUM private option length
- CVE-2026-72350 netfilter: xt_u32: reject invalid shift counts
- CVE-2026-7235 ErlichLiu claude-agent-sdk-master route.ts path traversal
- CVE-2026-72349 netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
- CVE-2026-72348 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
- CVE-2026-72347 netfilter: xt_connmark: reject invalid shift parameters
- CVE-2026-72346 platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume
- CVE-2026-72345 net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
- CVE-2026-72344 net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable
- CVE-2026-72343 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
- CVE-2026-72342 net/mlx5e: Fix HV VHCA stats agent registration race
- CVE-2026-72341 net/mlx5e: Fix publication race for priv->channel_stats[]
- CVE-2026-72340 net: microchip: vcap: fix races on the shared Super VCAP block
- CVE-2026-7234 BrowserOperator browser-operator-core server.js startsWith path traversal
- CVE-2026-72339 qede: fix off-by-one in BD ring consumption on build_skb failure
- CVE-2026-72338 net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
- CVE-2026-72337 Bluetooth: 6lowpan: avoid untracked enable work
- CVE-2026-72336 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
- CVE-2026-72335 Bluetooth: MGMT: Fix adv monitor add failure cleanup
- CVE-2026-72334 Bluetooth: ISO: fix malformed ISO_END/CONT handling
- CVE-2026-72333 Bluetooth: L2CAP: fix tx ident leak for commands without a response
- CVE-2026-72332 accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()
- CVE-2026-72331 accel/amdxdna: Fix VMA access race
- CVE-2026-72330 net/tls: Consume empty data records in tls_sw_read_sock()
- CVE-2026-7233 Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds
- CVE-2026-72329 net/liquidio: drop cached VF pci_dev LUT
- CVE-2026-72328 accel/amdxdna: Fix potential amdxdna_umap lifetime race
- CVE-2026-72327 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
- CVE-2026-72326 net/sched: cake: reject overhead values that underflow length
- CVE-2026-72325 perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
- CVE-2026-72324 gpio: mvebu: free generic chips on unbind
- CVE-2026-72323 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
- CVE-2026-72322 ipv6: mcast: Fix potential UAF in MLD delayed work
- CVE-2026-72321 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
- CVE-2026-72320 netfilter: nft_lookup: fix catchall element handling with inverted lookups
- CVE-2026-7232 FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters
- CVE-2026-72319 ipvs: ensure inner headers in ICMP errors are in headroom
- CVE-2026-72318 cifs: validate DFS referral string offsets
- CVE-2026-72317 SUNRPC: pin upper rpc_clnt across the TLS connect_worker
- CVE-2026-72316 dm era: fix NULL pointer dereference in metadata_open()
- CVE-2026-72315 smb: client: fix busy dentry warning on unmount after DIO
- CVE-2026-72314 regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK