Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 415 of 1013.
- CVE-2026-72037 net: lan743x: Initialize eth_syslock spinlock before use
- CVE-2026-72036 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- CVE-2026-72035 net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- CVE-2026-72034 fhandle: reject detached mounts in capable_wrt_mount()
- CVE-2026-72033 orangefs: keep the readdir entry size 64-bit in fill_from_part()
- CVE-2026-72032 net/mlx5: HWS, fix matcher leak on resize target setup failure
- CVE-2026-72031 ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
- CVE-2026-72030 ata: libata-core: Reject an invalid concurrent positioning ranges count
- CVE-2026-7203 Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection
- CVE-2026-72029 net: wwan: iosm: bound device offsets in the MUX downlink decoder
- CVE-2026-72028 riscv: probes: save original sp in rethook trampoline
- CVE-2026-72027 mm/compaction: handle free_pages_prepare() properly in compaction_free()
- CVE-2026-72026 irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
- CVE-2026-72025 s390/monwriter: Reject buffer reuse with different data length
- CVE-2026-72024 mac802154: remove interfaces with RCU list deletion
- CVE-2026-72023 octeontx2-pf: fix SQB pointer leak on init failure
- CVE-2026-72022 llc: fix SAP refcount leak in llc_ui_autobind()
- CVE-2026-72021 ipvs: use parsed transport offset in SCTP state lookup
- CVE-2026-72020 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
- CVE-2026-7202 Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection
- CVE-2026-72019 macsec: don't read an unset MAC header in macsec_encrypt()
- CVE-2026-72018 dibs: loopback: validate offset and size in move_data()
- CVE-2026-72017 net: macb: drop in-flight Tx SKBs on close
- CVE-2026-72016 cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
- CVE-2026-72015 fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
- CVE-2026-72014 drbd: reject data replies with an out-of-range payload size
- CVE-2026-72013 riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
- CVE-2026-72012 tracing/osnoise: Call synchronize_rcu() when unregistering
- CVE-2026-72011 s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()
- CVE-2026-72010 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
- CVE-2026-7201 CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity
- CVE-2026-72009 pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
- CVE-2026-72008 pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
- CVE-2026-72007 pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
- CVE-2026-72006 net/mlx5: free mlx5_st_idx_data on final dealloc
- CVE-2026-72005 wifi: rt2x00: avoid full teardown before work setup in probe
- CVE-2026-72004 wifi: mac80211: fix memory leak in ieee80211_register_hw()
- CVE-2026-72003 wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
- CVE-2026-72001 Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
- CVE-2026-7200 SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting
- CVE-2026-71993 MSI Radix AXE6600 v781521 Command Injection via openvpn function
- CVE-2026-71992 MSI Radix AXE6600 v781521 Command Injection via macfilter
- CVE-2026-71991 MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function
- CVE-2026-71990 MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function
- CVE-2026-7199 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
- CVE-2026-71989 MSI Radix AXE6600 v781521 Command Injection via porTrigger function
- CVE-2026-71988 MSI Radix AXE6600 v781521 Command Injection via portFw function
- CVE-2026-71987 MSI Radix AXE6600 v781521 Command Injection via alg function
- CVE-2026-71986 MSI Radix AXE6600 v781521 Command Injection via dmz Function
- CVE-2026-71985 MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function
- CVE-2026-71984 MSI Radix AXE6600 v781521 Command Injection via urlfilter
- CVE-2026-71983 MSI Radix AXE6600 v781521 Command Injection via wps.cgi
- CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
- CVE-2026-71980 Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()
- CVE-2026-7198 CWE-284: Improper Access Control in web services in Progress Sitefinity
- CVE-2026-71979 INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing
- CVE-2026-71974 U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read
- CVE-2026-71973 U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation
- CVE-2026-71972 U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder
- CVE-2026-71971 U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly
- CVE-2026-71969 OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt Operations
- CVE-2026-71968 OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT
- CVE-2026-71967 OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_session
- CVE-2026-71966 CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer
- CVE-2026-71965 CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
- CVE-2026-71964 CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload
- CVE-2026-71963 Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
- CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
- CVE-2026-71961 Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler
- CVE-2026-71960 Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT
- CVE-2026-7196 CodeAstro Online Classroom guestdetails sql injection
- CVE-2026-71959 Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect
- CVE-2026-71958 D-Link DWR-M961 Buffer Overflow via quicksetup.cgi
- CVE-2026-71957 D-Link DWR-M961 Buffer Overflow via app.cgi
- CVE-2026-71956 D-Link DWR-M961 Command Injection via app.cgi
- CVE-2026-71955 D-Link DWR-M961 Command Injection via /boafrm/formWsc
- CVE-2026-71954 D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup
- CVE-2026-71953 D-Link DWR-M961 Command Injection via /boafrm/formNtp
- CVE-2026-71952 D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup
- CVE-2026-71951 D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup
- CVE-2026-71950 D-Link DWR-M961 Command Injection via /boafrm/formSmsManage
- CVE-2026-7195 CWE-20: Improper Input Validation in web services in Progress Sitefinity
- CVE-2026-71949 D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup
- CVE-2026-71948 D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun
- CVE-2026-71947 D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun
- CVE-2026-71946 D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun
- CVE-2026-71945 D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom
- CVE-2026-71944 D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel
- CVE-2026-71943 DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet
- CVE-2026-71942 DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert
- CVE-2026-71941 DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail
- CVE-2026-71940 DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE
- CVE-2026-7194 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
- CVE-2026-71939 DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACE
- CVE-2026-71938 DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp
- CVE-2026-71937 DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile
- CVE-2026-71936 DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot
- CVE-2026-71935 DrayTek VigorSwitch Multiple Models Buffer Overflow via webBackupAction
- CVE-2026-71934 DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtrace
- CVE-2026-71933 DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions