# Vulnerabilities published in 2026


- [CVE-2026-72220](https://insights.sbomify.com/CVE-2026-72220/): sunrpc: harden rq_procinfo lifecycle to prevent double-free (critical 9.8)
- [CVE-2026-7222](https://insights.sbomify.com/CVE-2026-7222/): code-projects Coaching Management System Complaint Form complaint.php cross site scripting (medium 5.1)
- [CVE-2026-72219](https://insights.sbomify.com/CVE-2026-72219/): lockd: Plug nlm_file leak when nlm_do_fopen() fails (not scored)
- [CVE-2026-72218](https://insights.sbomify.com/CVE-2026-72218/): lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (not scored)
- [CVE-2026-72217](https://insights.sbomify.com/CVE-2026-72217/): SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (critical 9.8)
- [CVE-2026-72216](https://insights.sbomify.com/CVE-2026-72216/): remoteproc: qcom: Fix leak when custom dump_segments addition fails (not scored)
- [CVE-2026-72215](https://insights.sbomify.com/CVE-2026-72215/): MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() (not scored)
- [CVE-2026-72214](https://insights.sbomify.com/CVE-2026-72214/): power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (not scored)
- [CVE-2026-72213](https://insights.sbomify.com/CVE-2026-72213/): mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (high 7.1)
- [CVE-2026-72212](https://insights.sbomify.com/CVE-2026-72212/): mm/memory_hotplug: fix incorrect altmap passing in error path (not scored)
- [CVE-2026-72211](https://insights.sbomify.com/CVE-2026-72211/): ntfs: grow index root value before reparent header update (critical 9.8)
- [CVE-2026-72210](https://insights.sbomify.com/CVE-2026-72210/): ntfs: fix off-by-one in mapping pairs decoding bounds checks (critical 9.8)
- [CVE-2026-7221](https://insights.sbomify.com/CVE-2026-7221/): TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery (medium 6.9)
- [CVE-2026-72209](https://insights.sbomify.com/CVE-2026-72209/): ntfs: validate attribute values on lookup (critical 9.8)
- [CVE-2026-72208](https://insights.sbomify.com/CVE-2026-72208/): ntfs: add bounds check before accessing EA entries (critical 9.8)
- [CVE-2026-72207](https://insights.sbomify.com/CVE-2026-72207/): ntfs: not change 0-byte $DATA attribute to non-resident (critical 9.8)
- [CVE-2026-72206](https://insights.sbomify.com/CVE-2026-72206/): ntfs: validate index block header more strictly (critical 9.8)
- [CVE-2026-72205](https://insights.sbomify.com/CVE-2026-72205/): ntfs: free volume-wide resources on fill_super failure (not scored)
- [CVE-2026-72204](https://insights.sbomify.com/CVE-2026-72204/): ntfs: centalize $INDEX_ROOT header validation (high 8.4)
- [CVE-2026-72203](https://insights.sbomify.com/CVE-2026-72203/): ntfs: skip extent mft records in writeback to prevent deadlock (high 7.5)
- [CVE-2026-72202](https://insights.sbomify.com/CVE-2026-72202/): ntfs: avoid heap allocation for free-cluster readahead state (high 7.5)
- [CVE-2026-72201](https://insights.sbomify.com/CVE-2026-72201/): ntfs: validate index entries on reading (critical 9.8)
- [CVE-2026-72200](https://insights.sbomify.com/CVE-2026-72200/): ntfs: detect mapping-pairs LCN accumulator overflow (critical 9.8)
- [CVE-2026-7220](https://insights.sbomify.com/CVE-2026-7220/): jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection (medium 6.9)
- [CVE-2026-72199](https://insights.sbomify.com/CVE-2026-72199/): ntfs: validate resident index root values on lookup (critical 9.8)
- [CVE-2026-72198](https://insights.sbomify.com/CVE-2026-72198/): ntfs: reject non-resident records for resident-only attributes (high 7.8)
- [CVE-2026-72197](https://insights.sbomify.com/CVE-2026-72197/): fs/ntfs3: bound DeleteIndexEntryAllocation memmove length (high 8.4)
- [CVE-2026-72196](https://insights.sbomify.com/CVE-2026-72196/): fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass (high 8.4)
- [CVE-2026-72195](https://insights.sbomify.com/CVE-2026-72195/): fs/ntfs3: bound attr_off in UpdateResidentValue against data_off (high 7.8)
- [CVE-2026-72194](https://insights.sbomify.com/CVE-2026-72194/): fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow (critical 9.8)
- [CVE-2026-72193](https://insights.sbomify.com/CVE-2026-72193/): ntfs3: cap RESTART_TABLE free-chain walker at rt->used (not scored)
- [CVE-2026-72192](https://insights.sbomify.com/CVE-2026-72192/): ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head (critical 9.8)
- [CVE-2026-72191](https://insights.sbomify.com/CVE-2026-72191/): ntfs3: validate split-point offset in indx_insert_into_buffer (critical 9.8)
- [CVE-2026-72190](https://insights.sbomify.com/CVE-2026-72190/): ntfs: fix mrec_lock ABBA deadlock in rename (not scored)
- [CVE-2026-7219](https://insights.sbomify.com/CVE-2026-7219/): Totolink N300RT formIpQoS buffer overflow (high 8.6)
- [CVE-2026-72189](https://insights.sbomify.com/CVE-2026-72189/): ntfs: fail attrlist updates when the superblock is inactive (not scored)
- [CVE-2026-72188](https://insights.sbomify.com/CVE-2026-72188/): ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() (critical 9.1)
- [CVE-2026-72187](https://insights.sbomify.com/CVE-2026-72187/): ntfs: avoid self-deadlock during inode eviction (not scored)
- [CVE-2026-72186](https://insights.sbomify.com/CVE-2026-72186/): ntfs: make system files immutable to prevent corruption (critical 9.1)
- [CVE-2026-72185](https://insights.sbomify.com/CVE-2026-72185/): ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock() (critical 9.8)
- [CVE-2026-72184](https://insights.sbomify.com/CVE-2026-72184/): ntfs: fix hole runlist memory leak in insert range error path (not scored)
- [CVE-2026-72183](https://insights.sbomify.com/CVE-2026-72183/): landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path (high 8.4)
- [CVE-2026-72182](https://insights.sbomify.com/CVE-2026-72182/): power: supply: charger-manager: fix refcount leak in is_full_charged() (not scored)
- [CVE-2026-72181](https://insights.sbomify.com/CVE-2026-72181/): mips: sched: Fix CPUMASK_OFFSTACK memory corruption (high 7.8)
- [CVE-2026-72180](https://insights.sbomify.com/CVE-2026-72180/): mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade (not scored)
- [CVE-2026-7218](https://insights.sbomify.com/CVE-2026-7218/): Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow (high 8.6)
- [CVE-2026-72179](https://insights.sbomify.com/CVE-2026-72179/): riscv: cacheinfo: Fix node reference leak in populate_cache_leaves (not scored)
- [CVE-2026-72178](https://insights.sbomify.com/CVE-2026-72178/): mm/damon/core: always put unsuccessfully committed target pids (not scored)
- [CVE-2026-72177](https://insights.sbomify.com/CVE-2026-72177/): mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (not scored)
- [CVE-2026-72176](https://insights.sbomify.com/CVE-2026-72176/): mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (not scored)
- [CVE-2026-72175](https://insights.sbomify.com/CVE-2026-72175/): fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race (high 7.1)
- [CVE-2026-72174](https://insights.sbomify.com/CVE-2026-72174/): fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (not scored)
- [CVE-2026-72173](https://insights.sbomify.com/CVE-2026-72173/): fs/proc/task_mmu: do not warn on seeing non-migration pmd entry (not scored)
- [CVE-2026-72172](https://insights.sbomify.com/CVE-2026-72172/): mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (high 7.8)
- [CVE-2026-72171](https://insights.sbomify.com/CVE-2026-72171/): mtd: slram: remove failed entries from the device list (high 7.8)
- [CVE-2026-72170](https://insights.sbomify.com/CVE-2026-72170/): 9p: skip nlink update in cacheless mode to fix WARN_ON (high 7.8)
- [CVE-2026-7217](https://insights.sbomify.com/CVE-2026-7217/): Deepractice PromptX Document File index.ts read_pdf absolute path traversal (medium 6.9)
- [CVE-2026-72169](https://insights.sbomify.com/CVE-2026-72169/): kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES (not scored)
- [CVE-2026-72168](https://insights.sbomify.com/CVE-2026-72168/): mtd: maps: vmu-flash: fix fault in unaligned fixup (not scored)
- [CVE-2026-72167](https://insights.sbomify.com/CVE-2026-72167/): mtd: rawnand: pl353: fix probe resource allocation (not scored)
- [CVE-2026-72166](https://insights.sbomify.com/CVE-2026-72166/): net/9p: fix infinite loop in p9_client_rpc on fatal signal (not scored)
- [CVE-2026-72165](https://insights.sbomify.com/CVE-2026-72165/): mtd: rawnand: fix condition in 'nand_select_target()' (high 7.8)
- [CVE-2026-72164](https://insights.sbomify.com/CVE-2026-72164/): ocfs2: avoid moving extents to occupied clusters (high 7.8)
- [CVE-2026-72163](https://insights.sbomify.com/CVE-2026-72163/): ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (not scored)
- [CVE-2026-72162](https://insights.sbomify.com/CVE-2026-72162/): ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec (high 7.8)
- [CVE-2026-72161](https://insights.sbomify.com/CVE-2026-72161/): ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (not scored)
- [CVE-2026-72160](https://insights.sbomify.com/CVE-2026-72160/): ocfs2: reject dinodes with non-canonical i_mode type (high 8.8)
- [CVE-2026-7216](https://insights.sbomify.com/CVE-2026-7216/): donchelo processing-claude-mcp-bridge create_sketch Tool processing_server.py path traversal (medium 6.9)
- [CVE-2026-72159](https://insights.sbomify.com/CVE-2026-72159/): ocfs2: reject non-inline dinodes with i_size and zero i_clusters (not scored)
- [CVE-2026-72158](https://insights.sbomify.com/CVE-2026-72158/): fpga: dfl: add bounds check in dfh_get_param_size() (not scored)
- [CVE-2026-72157](https://insights.sbomify.com/CVE-2026-72157/): net: thunderbolt: Fix frags[] overflow by bounding frame_count (high 8.8)
- [CVE-2026-72156](https://insights.sbomify.com/CVE-2026-72156/): fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (not scored)
- [CVE-2026-72155](https://insights.sbomify.com/CVE-2026-72155/): mtd: spi-nor: swp: Improve locking user experience (not scored)
- [CVE-2026-72154](https://insights.sbomify.com/CVE-2026-72154/): openrisc: Fix jump_label smp syncing (high 7.8)
- [CVE-2026-72153](https://insights.sbomify.com/CVE-2026-72153/): irqchip/crossbar: Use correct index in crossbar_domain_free() (not scored)
- [CVE-2026-72152](https://insights.sbomify.com/CVE-2026-72152/): tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (not scored)
- [CVE-2026-72151](https://insights.sbomify.com/CVE-2026-72151/): tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (high 8.4)
- [CVE-2026-72150](https://insights.sbomify.com/CVE-2026-72150/): sunrpc: fix uninitialized xprt_create_args structure (not scored)
- [CVE-2026-7215](https://insights.sbomify.com/CVE-2026-7215/): egtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injection (medium 6.9)
- [CVE-2026-72149](https://insights.sbomify.com/CVE-2026-72149/): dmaengine: tegra: Fix burst size calculation (high 7.5)
- [CVE-2026-72148](https://insights.sbomify.com/CVE-2026-72148/): dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (high 8.8)
- [CVE-2026-72147](https://insights.sbomify.com/CVE-2026-72147/): dmaengine: dw-edma-pcie: Reject devices without driver data (not scored)
- [CVE-2026-72146](https://insights.sbomify.com/CVE-2026-72146/): dmaengine: sh: rz-dmac: Move interrupt request after everything is set up (high 8.4)
- [CVE-2026-72145](https://insights.sbomify.com/CVE-2026-72145/): platform/x86/intel/tpmi: use cleanup helpers in mem_write() (not scored)
- [CVE-2026-72144](https://insights.sbomify.com/CVE-2026-72144/): platform/x86: dell-laptop: fix missing cleanups in init error path (high 7.8)
- [CVE-2026-72143](https://insights.sbomify.com/CVE-2026-72143/): platform/x86: ISST: Restore SST-PP control to all domains (high 7.1)
- [CVE-2026-72142](https://insights.sbomify.com/CVE-2026-72142/): i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (not scored)
- [CVE-2026-72141](https://insights.sbomify.com/CVE-2026-72141/): i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (high 7.5)
- [CVE-2026-72140](https://insights.sbomify.com/CVE-2026-72140/): i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (not scored)
- [CVE-2026-7214](https://insights.sbomify.com/CVE-2026-7214/): eghuzefa engineer-your-data server.py file_inf path traversal (medium 6.9)
- [CVE-2026-72139](https://insights.sbomify.com/CVE-2026-72139/): tcp: defer md5sig_info kfree past RCU grace period in tcp_connect (critical 9.8)
- [CVE-2026-72138](https://insights.sbomify.com/CVE-2026-72138/): xen/gntdev: fix error handling in ioctl (not scored)
- [CVE-2026-72137](https://insights.sbomify.com/CVE-2026-72137/): xfrm: nat_keepalive: avoid double free on send error (critical 9.8)
- [CVE-2026-72136](https://insights.sbomify.com/CVE-2026-72136/): xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-72135](https://insights.sbomify.com/CVE-2026-72135/): tpm: Make the TPM character devices non-seekable (high 7.8)
- [CVE-2026-72134](https://insights.sbomify.com/CVE-2026-72134/): spi: imx: reconfigure for PIO when DMA cannot be started (high 7.8)
- [CVE-2026-72133](https://insights.sbomify.com/CVE-2026-72133/): spi: uniphier: Fix completion initialization order before devm_request_irq() (high 8.4)
- [CVE-2026-72132](https://insights.sbomify.com/CVE-2026-72132/): NFS: Charge unstable writes by request size, not folio size (not scored)
- [CVE-2026-72131](https://insights.sbomify.com/CVE-2026-72131/): nvme-apple: Prevent shared tags across queues on Apple A11 (not scored)
- [CVE-2026-72130](https://insights.sbomify.com/CVE-2026-72130/): nvmet-auth: reject short AUTH_RECEIVE buffers (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/413/