Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 444 of 1013.
- CVE-2026-68382 drm/xe/guc: Hold device ref until queue teardown completes
- CVE-2026-68381 ksmbd: pin conn during async oplock break notification
- CVE-2026-68380 accel/amdxdna: Fix use-after-free of mm_struct in job scheduler
- CVE-2026-68379 tcp: fix TIME_WAIT socket reference leak on PSP policy failure
- CVE-2026-68378 dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
- CVE-2026-68377 net/sched: act_tunnel_key: Defer dst_release to RCU callback
- CVE-2026-68376 sctp: fix auth_hmacs array size in struct sctp_cookie
- CVE-2026-68375 bnxt_en: Handle partially initialized auxiliary devices
- CVE-2026-68374 usb: core: sysfs: add lock to bos_descriptors_read()
- CVE-2026-68373 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
- CVE-2026-68372 usb: core: port: Deattach Type-C connector on component unbind
- CVE-2026-68371 usb: musb: omap2430: Do not put borrowed of_node in probe
- CVE-2026-68370 usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
- CVE-2026-6837 Command injection in WAX650S firmware
- CVE-2026-68369 usb: gadget: printer: fix infinite loop in printer_read()
- CVE-2026-68368 usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
- CVE-2026-68367 usb: gadget: f_tcm: synchronize delayed set_alt with teardown
- CVE-2026-68366 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
- CVE-2026-68365 USB: serial: io_edgeport: cap received transmit credits
- CVE-2026-68364 drm/amd/display: Fix ISM dc_lock deadlock during suspend
- CVE-2026-68363 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
- CVE-2026-68362 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
- CVE-2026-68361 hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
- CVE-2026-68360 hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
- CVE-2026-68359 hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
- CVE-2026-68358 hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
- CVE-2026-68357 watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
- CVE-2026-68356 watchdog: airoha: Prevent division by zero when clock frequency is zero
- CVE-2026-68355 wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
- CVE-2026-68354 firewire: net: Fix fragmented datagram reassembly
- CVE-2026-68353 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
- CVE-2026-68352 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
- CVE-2026-68351 wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
- CVE-2026-68350 wifi: carl9170: fix OOB read from off-by-two in TX status handler
- CVE-2026-6835 aEnrich｜a+HCM - Arbitrary File Upload
- CVE-2026-68349 wifi: carl9170: fix buffer overflow in rx_stream failover path
- CVE-2026-68348 ASoC: tas2781: bound firmware description string parsing
- CVE-2026-68347 iommu/amd: Fix IRQ unsafe locking in gdom allocation
- CVE-2026-68346 ALSA: hda: cs35l41: validate and free ACPI mute object
- CVE-2026-68345 arm_mpam: guard MBWU state before adding it to garbage
- CVE-2026-68344 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
- CVE-2026-68343 smb: client: validate DFS referral PathConsumed
- CVE-2026-68342 ovpn: avoid putting unrelated P2P peer on socket release
- CVE-2026-68341 ovpn: fix use after free in unlock_ovpn()
- CVE-2026-68340 hwmon: occ: validate poll response sensor blocks
- CVE-2026-6834 aEnrich｜a+HRD - Missing Authorization
- CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length
- CVE-2026-68338 net/packet: avoid fanout hook re-registration after unregister
- CVE-2026-68337 bpf: Reject redirect helpers without a bpf_net_context
- CVE-2026-68336 bonding: fix devconf_all NULL dereference when IPv6 is disabled
- CVE-2026-68335 rds: drop incoming messages that cross network namespace boundaries
- CVE-2026-68334 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
- CVE-2026-68333 dpaa2-switch: put MAC endpoint device on disconnect
- CVE-2026-68332 net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
- CVE-2026-68331 dpaa2-eth: put MAC endpoint device on disconnect
- CVE-2026-68330 net: airoha: Fix DMA direction for NPU mailbox buffer
- CVE-2026-6833 aEnrich｜a+HRD - SQL Injection
- CVE-2026-68329 iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
- CVE-2026-68328 nfp: Check resource mutex allocation
- CVE-2026-68327 wan: wanxl: Only reset hardware after BAR mapping
- CVE-2026-68326 wifi: mwifiex: bound uAP association event IEs to the event buffer
- CVE-2026-68325 iommu/amd: Bound the early ACPI HID map
- CVE-2026-68324 iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
- CVE-2026-68323 tipc: serialize udp bearer replicast list updates
- CVE-2026-68322 rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
- CVE-2026-68321 net: txgbe: fix FDIR filter leak on remove
- CVE-2026-68320 sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
- CVE-2026-6832 Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id
- CVE-2026-68319 pds_core: fix deadlock between reset thread and remove
- CVE-2026-68318 pds_core: fix use-after-free on workqueue during remove
- CVE-2026-68317 pds_core: fix auxiliary device add/del races
- CVE-2026-68316 accel: ethosu: Fix element size accounting for cmd stream validation
- CVE-2026-68315 sctp: validate stream count in sctp_process_strreset_inreq()
- CVE-2026-68314 net: mctp i3c: clean up notifier and buses if driver register fails
- CVE-2026-68313 tipc: fix infinite loop in __tipc_nl_compat_dumpit
- CVE-2026-68312 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
- CVE-2026-68311 wifi: mt76: mt7925: guard link STA in decap offload
- CVE-2026-68310 wifi: mt76: mt7915: guard HE capability lookups
- CVE-2026-6831 Missing authorization in Advanced Contact form 7 DB
- CVE-2026-68309 wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
- CVE-2026-68308 wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
- CVE-2026-68307 wifi: mt76: mt7925: fix crash in reset link replay
- CVE-2026-68306 wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
- CVE-2026-68305 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
- CVE-2026-68304 wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
- CVE-2026-68303 drm/vc4: hvs/v3d: Fix null dereference in unbind
- CVE-2026-68302 amt: re-read skb header pointers after every pull
- CVE-2026-68301 net: hsr: fix memory leak on slave unregistration by removing synced VLANs
- CVE-2026-68300 sctp: auth: verify auth requirement when auth_chunk is NULL
- CVE-2026-6830 Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch
- CVE-2026-68299 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
- CVE-2026-68298 drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
- CVE-2026-68297 tipc: fix u16 MTU truncation in media and bearer MTU validation
- CVE-2026-68296 net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
- CVE-2026-68295 LoongArch: BPF: Zero-extend signed ALU32 div/mod results
- CVE-2026-68294 net: qrtr: restrict socket creation to the initial network namespace
- CVE-2026-68293 net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
- CVE-2026-68292 ice: prevent tstamp ring allocation for non-PF VSI types
- CVE-2026-68291 idpf: fix max_vport related crash on allocation error during init
- CVE-2026-68290 rds: tcp: unregister sysctl before tearing down listen socket