# Vulnerabilities published in 2026


- [CVE-2026-72037](https://insights.sbomify.com/CVE-2026-72037/): net: lan743x: Initialize eth_syslock spinlock before use (not scored)
- [CVE-2026-72036](https://insights.sbomify.com/CVE-2026-72036/): net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (high 7.8)
- [CVE-2026-72035](https://insights.sbomify.com/CVE-2026-72035/): net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (high 8.2)
- [CVE-2026-72034](https://insights.sbomify.com/CVE-2026-72034/): fhandle: reject detached mounts in capable_wrt_mount() (high 7.8)
- [CVE-2026-72033](https://insights.sbomify.com/CVE-2026-72033/): orangefs: keep the readdir entry size 64-bit in fill_from_part() (critical 9.8)
- [CVE-2026-72032](https://insights.sbomify.com/CVE-2026-72032/): net/mlx5: HWS, fix matcher leak on resize target setup failure (not scored)
- [CVE-2026-72031](https://insights.sbomify.com/CVE-2026-72031/): ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD (not scored)
- [CVE-2026-72030](https://insights.sbomify.com/CVE-2026-72030/): ata: libata-core: Reject an invalid concurrent positioning ranges count (not scored)
- [CVE-2026-7203](https://insights.sbomify.com/CVE-2026-7203/): Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection (critical 9.3)
- [CVE-2026-72029](https://insights.sbomify.com/CVE-2026-72029/): net: wwan: iosm: bound device offsets in the MUX downlink decoder (high 8.8)
- [CVE-2026-72028](https://insights.sbomify.com/CVE-2026-72028/): riscv: probes: save original sp in rethook trampoline (not scored)
- [CVE-2026-72027](https://insights.sbomify.com/CVE-2026-72027/): mm/compaction: handle free_pages_prepare() properly in compaction_free() (high 7.8)
- [CVE-2026-72026](https://insights.sbomify.com/CVE-2026-72026/): irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure (not scored)
- [CVE-2026-72025](https://insights.sbomify.com/CVE-2026-72025/): s390/monwriter: Reject buffer reuse with different data length (not scored)
- [CVE-2026-72024](https://insights.sbomify.com/CVE-2026-72024/): mac802154: remove interfaces with RCU list deletion (high 7.8)
- [CVE-2026-72023](https://insights.sbomify.com/CVE-2026-72023/): octeontx2-pf: fix SQB pointer leak on init failure (not scored)
- [CVE-2026-72022](https://insights.sbomify.com/CVE-2026-72022/): llc: fix SAP refcount leak in llc_ui_autobind() (not scored)
- [CVE-2026-72021](https://insights.sbomify.com/CVE-2026-72021/): ipvs: use parsed transport offset in SCTP state lookup (high 8.2)
- [CVE-2026-72020](https://insights.sbomify.com/CVE-2026-72020/): ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (critical 9.8)
- [CVE-2026-7202](https://insights.sbomify.com/CVE-2026-7202/): Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection (critical 9.3)
- [CVE-2026-72019](https://insights.sbomify.com/CVE-2026-72019/): macsec: don't read an unset MAC header in macsec_encrypt() (high 7.3)
- [CVE-2026-72018](https://insights.sbomify.com/CVE-2026-72018/): dibs: loopback: validate offset and size in move_data() (high 7.8)
- [CVE-2026-72017](https://insights.sbomify.com/CVE-2026-72017/): net: macb: drop in-flight Tx SKBs on close (not scored)
- [CVE-2026-72016](https://insights.sbomify.com/CVE-2026-72016/): cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable() (not scored)
- [CVE-2026-72015](https://insights.sbomify.com/CVE-2026-72015/): fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (not scored)
- [CVE-2026-72014](https://insights.sbomify.com/CVE-2026-72014/): drbd: reject data replies with an out-of-range payload size (critical 9.8)
- [CVE-2026-72013](https://insights.sbomify.com/CVE-2026-72013/): riscv: Prevent NULL pointer dereference in machine_kexec_prepare() (not scored)
- [CVE-2026-72012](https://insights.sbomify.com/CVE-2026-72012/): tracing/osnoise: Call synchronize_rcu() when unregistering (high 7.8)
- [CVE-2026-72011](https://insights.sbomify.com/CVE-2026-72011/): s390/diag: Add missing array_index_nospec() call to memtop_get_page_count() (not scored)
- [CVE-2026-72010](https://insights.sbomify.com/CVE-2026-72010/): cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (not scored)
- [CVE-2026-7201](https://insights.sbomify.com/CVE-2026-7201/): CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity (high 8.8)
- [CVE-2026-72009](https://insights.sbomify.com/CVE-2026-72009/): pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI (high 7.8)
- [CVE-2026-72008](https://insights.sbomify.com/CVE-2026-72008/): pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check (not scored)
- [CVE-2026-72007](https://insights.sbomify.com/CVE-2026-72007/): pmdomain: imx: Fix i.MX8MP VC8000E power up sequence (not scored)
- [CVE-2026-72006](https://insights.sbomify.com/CVE-2026-72006/): net/mlx5: free mlx5_st_idx_data on final dealloc (not scored)
- [CVE-2026-72005](https://insights.sbomify.com/CVE-2026-72005/): wifi: rt2x00: avoid full teardown before work setup in probe (high 7.8)
- [CVE-2026-72004](https://insights.sbomify.com/CVE-2026-72004/): wifi: mac80211: fix memory leak in ieee80211_register_hw() (not scored)
- [CVE-2026-72003](https://insights.sbomify.com/CVE-2026-72003/): wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (high 8.8)
- [CVE-2026-72001](https://insights.sbomify.com/CVE-2026-72001/): Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint (high 8.6)
- [CVE-2026-7200](https://insights.sbomify.com/CVE-2026-7200/): SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting (medium 5.3)
- [CVE-2026-71993](https://insights.sbomify.com/CVE-2026-71993/): MSI Radix AXE6600 v781521 Command Injection via openvpn function (critical 9.3)
- [CVE-2026-71992](https://insights.sbomify.com/CVE-2026-71992/): MSI Radix AXE6600 v781521 Command Injection via macfilter (critical 9.3)
- [CVE-2026-71991](https://insights.sbomify.com/CVE-2026-71991/): MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function (critical 9.3)
- [CVE-2026-71990](https://insights.sbomify.com/CVE-2026-71990/): MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function (critical 9.3)
- [CVE-2026-7199](https://insights.sbomify.com/CVE-2026-7199/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-71989](https://insights.sbomify.com/CVE-2026-71989/): MSI Radix AXE6600 v781521 Command Injection via porTrigger function (critical 9.3)
- [CVE-2026-71988](https://insights.sbomify.com/CVE-2026-71988/): MSI Radix AXE6600 v781521 Command Injection via portFw function (critical 9.3)
- [CVE-2026-71987](https://insights.sbomify.com/CVE-2026-71987/): MSI Radix AXE6600 v781521 Command Injection via alg function (critical 9.3)
- [CVE-2026-71986](https://insights.sbomify.com/CVE-2026-71986/): MSI Radix AXE6600 v781521 Command Injection via dmz Function (critical 9.3)
- [CVE-2026-71985](https://insights.sbomify.com/CVE-2026-71985/): MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function (critical 9.3)
- [CVE-2026-71984](https://insights.sbomify.com/CVE-2026-71984/): MSI Radix AXE6600 v781521 Command Injection via urlfilter (critical 9.3)
- [CVE-2026-71983](https://insights.sbomify.com/CVE-2026-71983/): MSI Radix AXE6600 v781521 Command Injection via wps.cgi (critical 9.3)
- [CVE-2026-71981](https://insights.sbomify.com/CVE-2026-71981/): Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter (high 8.7)
- [CVE-2026-71980](https://insights.sbomify.com/CVE-2026-71980/): Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe() (high 8.7)
- [CVE-2026-7198](https://insights.sbomify.com/CVE-2026-7198/): CWE-284: Improper Access Control in web services in Progress Sitefinity (critical 9.8)
- [CVE-2026-71979](https://insights.sbomify.com/CVE-2026-71979/): INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing (high 8.7)
- [CVE-2026-71974](https://insights.sbomify.com/CVE-2026-71974/): U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read (medium 4.3)
- [CVE-2026-71973](https://insights.sbomify.com/CVE-2026-71973/): U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation (medium 5.2)
- [CVE-2026-71972](https://insights.sbomify.com/CVE-2026-71972/): U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder (medium 6.0)
- [CVE-2026-71971](https://insights.sbomify.com/CVE-2026-71971/): U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly (high 8.8)
- [CVE-2026-71969](https://insights.sbomify.com/CVE-2026-71969/): OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt Operations (high 8.4)
- [CVE-2026-71968](https://insights.sbomify.com/CVE-2026-71968/): OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT (high 8.4)
- [CVE-2026-71967](https://insights.sbomify.com/CVE-2026-71967/): OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_session (medium 5.7)
- [CVE-2026-71966](https://insights.sbomify.com/CVE-2026-71966/): CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer (high 8.7)
- [CVE-2026-71965](https://insights.sbomify.com/CVE-2026-71965/): CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature (high 8.7)
- [CVE-2026-71964](https://insights.sbomify.com/CVE-2026-71964/): CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload (high 7.1)
- [CVE-2026-71963](https://insights.sbomify.com/CVE-2026-71963/): Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection (high 8.6)
- [CVE-2026-71962](https://insights.sbomify.com/CVE-2026-71962/): Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download (high 8.7)
- [CVE-2026-71961](https://insights.sbomify.com/CVE-2026-71961/): Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler (high 8.7)
- [CVE-2026-71960](https://insights.sbomify.com/CVE-2026-71960/): Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT (critical 9.3)
- [CVE-2026-7196](https://insights.sbomify.com/CVE-2026-7196/): CodeAstro Online Classroom guestdetails sql injection (medium 5.3)
- [CVE-2026-71959](https://insights.sbomify.com/CVE-2026-71959/): Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect (medium 6.9)
- [CVE-2026-71958](https://insights.sbomify.com/CVE-2026-71958/): D-Link DWR-M961 Buffer Overflow via quicksetup.cgi (critical 9.3)
- [CVE-2026-71957](https://insights.sbomify.com/CVE-2026-71957/): D-Link DWR-M961 Buffer Overflow via app.cgi (critical 9.3)
- [CVE-2026-71956](https://insights.sbomify.com/CVE-2026-71956/): D-Link DWR-M961 Command Injection via app.cgi (critical 9.3)
- [CVE-2026-71955](https://insights.sbomify.com/CVE-2026-71955/): D-Link DWR-M961 Command Injection via /boafrm/formWsc (critical 9.3)
- [CVE-2026-71954](https://insights.sbomify.com/CVE-2026-71954/): D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup (critical 9.3)
- [CVE-2026-71953](https://insights.sbomify.com/CVE-2026-71953/): D-Link DWR-M961 Command Injection via /boafrm/formNtp (critical 9.3)
- [CVE-2026-71952](https://insights.sbomify.com/CVE-2026-71952/): D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup (critical 9.3)
- [CVE-2026-71951](https://insights.sbomify.com/CVE-2026-71951/): D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup (critical 9.3)
- [CVE-2026-71950](https://insights.sbomify.com/CVE-2026-71950/): D-Link DWR-M961 Command Injection via /boafrm/formSmsManage (critical 9.3)
- [CVE-2026-7195](https://insights.sbomify.com/CVE-2026-7195/): CWE-20: Improper Input Validation in web services in Progress Sitefinity (high 8.8)
- [CVE-2026-71949](https://insights.sbomify.com/CVE-2026-71949/): D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup (critical 9.3)
- [CVE-2026-71948](https://insights.sbomify.com/CVE-2026-71948/): D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun (critical 9.3)
- [CVE-2026-71947](https://insights.sbomify.com/CVE-2026-71947/): D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun (critical 9.3)
- [CVE-2026-71946](https://insights.sbomify.com/CVE-2026-71946/): D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun (critical 9.3)
- [CVE-2026-71945](https://insights.sbomify.com/CVE-2026-71945/): D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom (critical 9.3)
- [CVE-2026-71944](https://insights.sbomify.com/CVE-2026-71944/): D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel (critical 9.3)
- [CVE-2026-71943](https://insights.sbomify.com/CVE-2026-71943/): DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet (high 8.6)
- [CVE-2026-71942](https://insights.sbomify.com/CVE-2026-71942/): DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert (high 8.6)
- [CVE-2026-71941](https://insights.sbomify.com/CVE-2026-71941/): DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail (high 8.6)
- [CVE-2026-71940](https://insights.sbomify.com/CVE-2026-71940/): DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE (high 8.6)
- [CVE-2026-7194](https://insights.sbomify.com/CVE-2026-7194/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-71939](https://insights.sbomify.com/CVE-2026-71939/): DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACE (high 8.6)
- [CVE-2026-71938](https://insights.sbomify.com/CVE-2026-71938/): DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp (high 8.6)
- [CVE-2026-71937](https://insights.sbomify.com/CVE-2026-71937/): DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile (high 8.6)
- [CVE-2026-71936](https://insights.sbomify.com/CVE-2026-71936/): DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot (high 8.6)
- [CVE-2026-71935](https://insights.sbomify.com/CVE-2026-71935/): DrayTek VigorSwitch Multiple Models Buffer Overflow via webBackupAction (high 8.6)
- [CVE-2026-71934](https://insights.sbomify.com/CVE-2026-71934/): DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtrace (high 8.6)
- [CVE-2026-71933](https://insights.sbomify.com/CVE-2026-71933/): DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/415/