Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 414 of 1013.
- CVE-2026-7213 ef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal
- CVE-2026-72129 nvmet-rdma: handle inline data with a nonzero offset
- CVE-2026-72128 nvmet: fix refcount leak in nvmet_sq_create()
- CVE-2026-72127 netdev-genl: report NAPI thread PID in the caller's pid namespace
- CVE-2026-72126 can: isotp: use unconditional synchronize_rcu() in isotp_release()
- CVE-2026-72125 can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
- CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock
- CVE-2026-72123 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
- CVE-2026-72122 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
- CVE-2026-72121 can: bcm: add locking when updating filter and timer values
- CVE-2026-72120 can: bcm: add missing rcu list annotations and operations
- CVE-2026-7212 edvardlindelof notes-mcp notes_mcp.py path traversal
- CVE-2026-72119 can: bcm: extend bcm_tx_lock usage for data and timer updates
- CVE-2026-72118 can: bcm: fix CAN frame rx/tx statistics
- CVE-2026-72117 can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
- CVE-2026-72116 can: bcm: fix stale rx/tx ops after device removal
- CVE-2026-72115 can: bcm: track a single source interface for ANYDEV timeout/throttle ops
- CVE-2026-72114 can: bcm: validate frame length in bcm_rx_setup() for RTR replies
- CVE-2026-72113 can: bcm: add missing device refcount for CAN filter removal
- CVE-2026-72112 io_uring/bpf-ops: reject re-registration of an already-bound ops
- CVE-2026-72111 bpf: Reset register bounds before narrowing retval range in check_mem_access()
- CVE-2026-72110 bpf,fork: wipe ->bpf_storage before bailouts that access it
- CVE-2026-7211 dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection
- CVE-2026-72109 net: sparx5: unregister blocking notifier on init failure
- CVE-2026-72108 dm thin metadata: fix metadata snapshot consistency on commit failure
- CVE-2026-72107 dm era: fix out-of-bounds memory access for non-zero start sector
- CVE-2026-72106 dm-ioctl: fix a possible overflow in list_version_get_info
- CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines
- CVE-2026-72104 dm-pcache: reject option groups without values
- CVE-2026-72103 dm: avoid leaking the caller's thread keyring via the table device file
- CVE-2026-72102 dm_early_create: fix freeing used table on dm_resume failure
- CVE-2026-72101 dm-integrity: fix leaking uninitialized kernel memory
- CVE-2026-72100 dm-integrity: fix a bug if the bio is out of limits
- CVE-2026-7210 The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
- CVE-2026-72099 dm-integrity: don't increment hash_offset twice
- CVE-2026-72098 dm-verity: fix buffer overflow in FEC calculation
- CVE-2026-72097 dm-verity: fix a possible NULL pointer dereference
- CVE-2026-72096 dm-verity: make error counter atomic
- CVE-2026-72095 dma-fence: Make dma_fence_dedup_array() robust against 0-count input
- CVE-2026-72094 dma-buf: dma-fence: Fix potential NULL pointer dereference
- CVE-2026-72093 accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()
- CVE-2026-72092 accel/amdxdna: reject command submission on devices without a submit op
- CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO
- CVE-2026-72090 accel/amdxdna: Use caller client for debug BO sync
- CVE-2026-7209 Simple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-72089 accel/ivpu: Reject firmware log with size smaller than header
- CVE-2026-72088 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
- CVE-2026-72087 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
- CVE-2026-72086 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
- CVE-2026-72085 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
- CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer
- CVE-2026-72083 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
- CVE-2026-72082 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
- CVE-2026-72081 scsi: elx: efct: Fix I/O leak on unsupported additional CDB
- CVE-2026-72080 fs/resctrl: Fix use-after-free during unmount
- CVE-2026-7208 Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion
- CVE-2026-72079 Input: ims-pcu - fix use-after-free and double-free in disconnect
- CVE-2026-72078 Input: ims-pcu - validate control endpoint type
- CVE-2026-72077 Input: ims-pcu - fix firmware leak in async update
- CVE-2026-72076 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
- CVE-2026-72075 Input: ims-pcu - fix race condition in reset_device sysfs callback
- CVE-2026-72074 Input: ims-pcu - fix type confusion in CDC union descriptor parsing
- CVE-2026-72073 mmc: vub300: fix use-after-free on probe failure
- CVE-2026-72072 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
- CVE-2026-72071 tracing/user_events: Fix use-after-free in user_event_mm_dup()
- CVE-2026-72070 wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
- CVE-2026-72069 locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
- CVE-2026-72068 posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
- CVE-2026-72067 cpu: hotplug: Preserve per instance callback errors
- CVE-2026-72066 cpu: hotplug: Bound hotplug states sysfs output
- CVE-2026-72065 net: mana: Validate the packet length reported by the NIC
- CVE-2026-72064 net: mana: Sync page pool RX frags for CPU
- CVE-2026-72063 gpio: tegra: do not call pinctrl for GPIO direction
- CVE-2026-72062 gpio: mt7621: avoid corruption of shared interrupt trigger state
- CVE-2026-72061 net: sit: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-72060 net: ethernet: ti: icssg: guard PA stat lookups
- CVE-2026-7206 dubydu sqlite-mcp entry.py extract_to_json sql injection
- CVE-2026-72059 net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
- CVE-2026-72058 net: ixp4xx_hss: fix duplicate HDLC netdev allocation
- CVE-2026-72057 net/sched: act_ct: preserve tc_skb_cb across defragmentation
- CVE-2026-72056 net: ena: clean up XDP TX queues when regular TX setup fails
- CVE-2026-72055 net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-72054 net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-72053 net: ipip: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-72052 net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-72051 net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-72050 octeontx2-af: Free BPID bitmap on setup failure
- CVE-2026-7205 duartium papers-mcp-server main.py search_papers path traversal
- CVE-2026-72049 ieee802154: admin-gate legacy LLSEC dump operations
- CVE-2026-72048 ieee802154: ca8210: fix cas_ctl leak on spi_async failure
- CVE-2026-72047 ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
- CVE-2026-72046 gve: fix header buffer corruption with header-split and HW-GRO
- CVE-2026-72045 octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
- CVE-2026-72043 LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
- CVE-2026-72042 ipmi: Fix user refcount underflow in event delivery
- CVE-2026-72041 espintcp: use sk_msg_free_partial to fix partial send
- CVE-2026-72040 ipmi: fix refcount leak in i_ipmi_request()
- CVE-2026-7204 Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection
- CVE-2026-72039 bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
- CVE-2026-72038 net: liquidio: fix BAR resource leak on PF number failure