# Vulnerabilities published in 2026


- [CVE-2026-7213](https://insights.sbomify.com/CVE-2026-7213/): ef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal (medium 6.9)
- [CVE-2026-72129](https://insights.sbomify.com/CVE-2026-72129/): nvmet-rdma: handle inline data with a nonzero offset (critical 9.8)
- [CVE-2026-72128](https://insights.sbomify.com/CVE-2026-72128/): nvmet: fix refcount leak in nvmet_sq_create() (not scored)
- [CVE-2026-72127](https://insights.sbomify.com/CVE-2026-72127/): netdev-genl: report NAPI thread PID in the caller's pid namespace (not scored)
- [CVE-2026-72126](https://insights.sbomify.com/CVE-2026-72126/): can: isotp: use unconditional synchronize_rcu() in isotp_release() (high 7.8)
- [CVE-2026-72125](https://insights.sbomify.com/CVE-2026-72125/): can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER (high 7.8)
- [CVE-2026-72124](https://insights.sbomify.com/CVE-2026-72124/): can: isotp: serialize TX state transitions under so->rx_lock (high 8.8)
- [CVE-2026-72123](https://insights.sbomify.com/CVE-2026-72123/): can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (high 7.8)
- [CVE-2026-72122](https://insights.sbomify.com/CVE-2026-72122/): can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (high 7.3)
- [CVE-2026-72121](https://insights.sbomify.com/CVE-2026-72121/): can: bcm: add locking when updating filter and timer values (high 8.8)
- [CVE-2026-72120](https://insights.sbomify.com/CVE-2026-72120/): can: bcm: add missing rcu list annotations and operations (high 7.8)
- [CVE-2026-7212](https://insights.sbomify.com/CVE-2026-7212/): edvardlindelof notes-mcp notes_mcp.py path traversal (medium 6.9)
- [CVE-2026-72119](https://insights.sbomify.com/CVE-2026-72119/): can: bcm: extend bcm_tx_lock usage for data and timer updates (high 7.8)
- [CVE-2026-72118](https://insights.sbomify.com/CVE-2026-72118/): can: bcm: fix CAN frame rx/tx statistics (not scored)
- [CVE-2026-72117](https://insights.sbomify.com/CVE-2026-72117/): can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() (not scored)
- [CVE-2026-72116](https://insights.sbomify.com/CVE-2026-72116/): can: bcm: fix stale rx/tx ops after device removal (high 7.1)
- [CVE-2026-72115](https://insights.sbomify.com/CVE-2026-72115/): can: bcm: track a single source interface for ANYDEV timeout/throttle ops (high 8.1)
- [CVE-2026-72114](https://insights.sbomify.com/CVE-2026-72114/): can: bcm: validate frame length in bcm_rx_setup() for RTR replies (high 7.8)
- [CVE-2026-72113](https://insights.sbomify.com/CVE-2026-72113/): can: bcm: add missing device refcount for CAN filter removal (high 7.8)
- [CVE-2026-72112](https://insights.sbomify.com/CVE-2026-72112/): io_uring/bpf-ops: reject re-registration of an already-bound ops (high 7.8)
- [CVE-2026-72111](https://insights.sbomify.com/CVE-2026-72111/): bpf: Reset register bounds before narrowing retval range in check_mem_access() (high 8.8)
- [CVE-2026-72110](https://insights.sbomify.com/CVE-2026-72110/): bpf,fork: wipe ->bpf_storage before bailouts that access it (high 7.8)
- [CVE-2026-7211](https://insights.sbomify.com/CVE-2026-7211/): dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection (medium 6.9)
- [CVE-2026-72109](https://insights.sbomify.com/CVE-2026-72109/): net: sparx5: unregister blocking notifier on init failure (high 7.8)
- [CVE-2026-72108](https://insights.sbomify.com/CVE-2026-72108/): dm thin metadata: fix metadata snapshot consistency on commit failure (high 7.8)
- [CVE-2026-72107](https://insights.sbomify.com/CVE-2026-72107/): dm era: fix out-of-bounds memory access for non-zero start sector (high 8.8)
- [CVE-2026-72106](https://insights.sbomify.com/CVE-2026-72106/): dm-ioctl: fix a possible overflow in list_version_get_info (not scored)
- [CVE-2026-72105](https://insights.sbomify.com/CVE-2026-72105/): dm-log: fix a bitset_size overflow on 32bit machines (high 7.8)
- [CVE-2026-72104](https://insights.sbomify.com/CVE-2026-72104/): dm-pcache: reject option groups without values (not scored)
- [CVE-2026-72103](https://insights.sbomify.com/CVE-2026-72103/): dm: avoid leaking the caller's thread keyring via the table device file (high 7.3)
- [CVE-2026-72102](https://insights.sbomify.com/CVE-2026-72102/): dm_early_create: fix freeing used table on dm_resume failure (high 7.8)
- [CVE-2026-72101](https://insights.sbomify.com/CVE-2026-72101/): dm-integrity: fix leaking uninitialized kernel memory (not scored)
- [CVE-2026-72100](https://insights.sbomify.com/CVE-2026-72100/): dm-integrity: fix a bug if the bio is out of limits (high 8.8)
- [CVE-2026-7210](https://insights.sbomify.com/CVE-2026-7210/): The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection (medium 6.3)
- [CVE-2026-72099](https://insights.sbomify.com/CVE-2026-72099/): dm-integrity: don't increment hash_offset twice (high 7.1)
- [CVE-2026-72098](https://insights.sbomify.com/CVE-2026-72098/): dm-verity: fix buffer overflow in FEC calculation (critical 9.8)
- [CVE-2026-72097](https://insights.sbomify.com/CVE-2026-72097/): dm-verity: fix a possible NULL pointer dereference (not scored)
- [CVE-2026-72096](https://insights.sbomify.com/CVE-2026-72096/): dm-verity: make error counter atomic (not scored)
- [CVE-2026-72095](https://insights.sbomify.com/CVE-2026-72095/): dma-fence: Make dma_fence_dedup_array() robust against 0-count input (high 7.8)
- [CVE-2026-72094](https://insights.sbomify.com/CVE-2026-72094/): dma-buf: dma-fence: Fix potential NULL pointer dereference (not scored)
- [CVE-2026-72093](https://insights.sbomify.com/CVE-2026-72093/): accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap() (high 7.8)
- [CVE-2026-72092](https://insights.sbomify.com/CVE-2026-72092/): accel/amdxdna: reject command submission on devices without a submit op (not scored)
- [CVE-2026-72091](https://insights.sbomify.com/CVE-2026-72091/): accel/amdxdna: reject user command submission without a command BO (not scored)
- [CVE-2026-72090](https://insights.sbomify.com/CVE-2026-72090/): accel/amdxdna: Use caller client for debug BO sync (high 7.8)
- [CVE-2026-7209](https://insights.sbomify.com/CVE-2026-7209/): Simple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-72089](https://insights.sbomify.com/CVE-2026-72089/): accel/ivpu: Reject firmware log with size smaller than header (high 7.1)
- [CVE-2026-72088](https://insights.sbomify.com/CVE-2026-72088/): scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path (not scored)
- [CVE-2026-72087](https://insights.sbomify.com/CVE-2026-72087/): scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() (not scored)
- [CVE-2026-72086](https://insights.sbomify.com/CVE-2026-72086/): scsi: xen: scsiback: Free the command tag on the TMR submit-failure path (not scored)
- [CVE-2026-72085](https://insights.sbomify.com/CVE-2026-72085/): scsi: xen: scsiback: Free unsubmitted command instead of double-putting it (critical 9.3)
- [CVE-2026-72084](https://insights.sbomify.com/CVE-2026-72084/): scsi: target: Bound PR-OUT TransportID parsing to the received buffer (critical 9.8)
- [CVE-2026-72083](https://insights.sbomify.com/CVE-2026-72083/): scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (critical 9.8)
- [CVE-2026-72082](https://insights.sbomify.com/CVE-2026-72082/): scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() (not scored)
- [CVE-2026-72081](https://insights.sbomify.com/CVE-2026-72081/): scsi: elx: efct: Fix I/O leak on unsupported additional CDB (not scored)
- [CVE-2026-72080](https://insights.sbomify.com/CVE-2026-72080/): fs/resctrl: Fix use-after-free during unmount (high 7.8)
- [CVE-2026-7208](https://insights.sbomify.com/CVE-2026-7208/): Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion (medium 6.0)
- [CVE-2026-72079](https://insights.sbomify.com/CVE-2026-72079/): Input: ims-pcu - fix use-after-free and double-free in disconnect (not scored)
- [CVE-2026-72078](https://insights.sbomify.com/CVE-2026-72078/): Input: ims-pcu - validate control endpoint type (not scored)
- [CVE-2026-72077](https://insights.sbomify.com/CVE-2026-72077/): Input: ims-pcu - fix firmware leak in async update (not scored)
- [CVE-2026-72076](https://insights.sbomify.com/CVE-2026-72076/): Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (not scored)
- [CVE-2026-72075](https://insights.sbomify.com/CVE-2026-72075/): Input: ims-pcu - fix race condition in reset_device sysfs callback (not scored)
- [CVE-2026-72074](https://insights.sbomify.com/CVE-2026-72074/): Input: ims-pcu - fix type confusion in CDC union descriptor parsing (not scored)
- [CVE-2026-72073](https://insights.sbomify.com/CVE-2026-72073/): mmc: vub300: fix use-after-free on probe failure (not scored)
- [CVE-2026-72072](https://insights.sbomify.com/CVE-2026-72072/): net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (high 7.8)
- [CVE-2026-72071](https://insights.sbomify.com/CVE-2026-72071/): tracing/user_events: Fix use-after-free in user_event_mm_dup() (high 7.8)
- [CVE-2026-72070](https://insights.sbomify.com/CVE-2026-72070/): wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (not scored)
- [CVE-2026-72069](https://insights.sbomify.com/CVE-2026-72069/): locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (critical 9.8)
- [CVE-2026-72068](https://insights.sbomify.com/CVE-2026-72068/): posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() (not scored)
- [CVE-2026-72067](https://insights.sbomify.com/CVE-2026-72067/): cpu: hotplug: Preserve per instance callback errors (high 7.8)
- [CVE-2026-72066](https://insights.sbomify.com/CVE-2026-72066/): cpu: hotplug: Bound hotplug states sysfs output (high 7.8)
- [CVE-2026-72065](https://insights.sbomify.com/CVE-2026-72065/): net: mana: Validate the packet length reported by the NIC (critical 9.8)
- [CVE-2026-72064](https://insights.sbomify.com/CVE-2026-72064/): net: mana: Sync page pool RX frags for CPU (critical 9.8)
- [CVE-2026-72063](https://insights.sbomify.com/CVE-2026-72063/): gpio: tegra: do not call pinctrl for GPIO direction (not scored)
- [CVE-2026-72062](https://insights.sbomify.com/CVE-2026-72062/): gpio: mt7621: avoid corruption of shared interrupt trigger state (not scored)
- [CVE-2026-72061](https://insights.sbomify.com/CVE-2026-72061/): net: sit: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-72060](https://insights.sbomify.com/CVE-2026-72060/): net: ethernet: ti: icssg: guard PA stat lookups (not scored)
- [CVE-2026-7206](https://insights.sbomify.com/CVE-2026-7206/): dubydu sqlite-mcp entry.py extract_to_json sql injection (medium 6.9)
- [CVE-2026-72059](https://insights.sbomify.com/CVE-2026-72059/): net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (not scored)
- [CVE-2026-72058](https://insights.sbomify.com/CVE-2026-72058/): net: ixp4xx_hss: fix duplicate HDLC netdev allocation (not scored)
- [CVE-2026-72057](https://insights.sbomify.com/CVE-2026-72057/): net/sched: act_ct: preserve tc_skb_cb across defragmentation (high 8.2)
- [CVE-2026-72056](https://insights.sbomify.com/CVE-2026-72056/): net: ena: clean up XDP TX queues when regular TX setup fails (not scored)
- [CVE-2026-72055](https://insights.sbomify.com/CVE-2026-72055/): net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-72054](https://insights.sbomify.com/CVE-2026-72054/): net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-72053](https://insights.sbomify.com/CVE-2026-72053/): net: ipip: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-72052](https://insights.sbomify.com/CVE-2026-72052/): net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-72051](https://insights.sbomify.com/CVE-2026-72051/): net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-72050](https://insights.sbomify.com/CVE-2026-72050/): octeontx2-af: Free BPID bitmap on setup failure (not scored)
- [CVE-2026-7205](https://insights.sbomify.com/CVE-2026-7205/): duartium papers-mcp-server main.py search_papers path traversal (medium 6.9)
- [CVE-2026-72049](https://insights.sbomify.com/CVE-2026-72049/): ieee802154: admin-gate legacy LLSEC dump operations (high 7.1)
- [CVE-2026-72048](https://insights.sbomify.com/CVE-2026-72048/): ieee802154: ca8210: fix cas_ctl leak on spi_async failure (not scored)
- [CVE-2026-72047](https://insights.sbomify.com/CVE-2026-72047/): ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (not scored)
- [CVE-2026-72046](https://insights.sbomify.com/CVE-2026-72046/): gve: fix header buffer corruption with header-split and HW-GRO (critical 9.8)
- [CVE-2026-72045](https://insights.sbomify.com/CVE-2026-72045/): octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (high 8.8)
- [CVE-2026-72043](https://insights.sbomify.com/CVE-2026-72043/): LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() (high 7.1)
- [CVE-2026-72042](https://insights.sbomify.com/CVE-2026-72042/): ipmi: Fix user refcount underflow in event delivery (high 7.8)
- [CVE-2026-72041](https://insights.sbomify.com/CVE-2026-72041/): espintcp: use sk_msg_free_partial to fix partial send (critical 9.8)
- [CVE-2026-72040](https://insights.sbomify.com/CVE-2026-72040/): ipmi: fix refcount leak in i_ipmi_request() (not scored)
- [CVE-2026-7204](https://insights.sbomify.com/CVE-2026-7204/): Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection (critical 9.3)
- [CVE-2026-72039](https://insights.sbomify.com/CVE-2026-72039/): bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() (not scored)
- [CVE-2026-72038](https://insights.sbomify.com/CVE-2026-72038/): net: liquidio: fix BAR resource leak on PF number failure (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/414/