Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 445 of 1013.
- CVE-2026-6829 nesquena hermes-webui Arbitrary Workspace Directory Access
- CVE-2026-68289 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
- CVE-2026-68288 net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
- CVE-2026-68287 drop_monitor: fix size calculations for 64-bit attributes
- CVE-2026-68286 drop_monitor: perform u64_stats updates under IRQ-disabled section
- CVE-2026-68285 LoongArch: BPF: Fix memory leak in bpf_jit_free()
- CVE-2026-68284 bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
- CVE-2026-68283 tracing: Fix use-after-free freeing trigger private data
- CVE-2026-68282 drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()
- CVE-2026-68281 drm/imagination: Count paired job fence as dependency in prepare_job()
- CVE-2026-68280 drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
- CVE-2026-6828 Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2026-68279 drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
- CVE-2026-68278 drm/dp/mst: fix buffer overflows in sideband chunk accumulation
- CVE-2026-68277 drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
- CVE-2026-68276 drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
- CVE-2026-68275 drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
- CVE-2026-68274 drm/xe/guc: Fix buffer overflow in steered register list allocation
- CVE-2026-68273 drm/amdgpu: Fix context pstate override handling
- CVE-2026-68272 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
- CVE-2026-68271 drm/nouveau: fix reversed error cleanup order in ucopy functions
- CVE-2026-68270 drm/sysfb: Avoid possible truncation with calculating visible size
- CVE-2026-6827 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
- CVE-2026-68269 drm/i915/gem: Add missing nospec on parallel submit slot
- CVE-2026-68268 drm/xe: Return error on non-migratable faults requiring devmem
- CVE-2026-68267 drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
- CVE-2026-68266 drm/xe: Hold a dma-buf reference for imported BOs
- CVE-2026-68265 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
- CVE-2026-68264 drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
- CVE-2026-68263 drm/imagination: Fix double call to drm_sched_entity_fini()
- CVE-2026-68262 drm/imagination: Fix user array stride in pvr_set_uobj_array()
- CVE-2026-68261 drm/imagination: fix error checking of pvr_vm_context_lookup()
- CVE-2026-68260 drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
- CVE-2026-6826 Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller
- CVE-2026-68259 drm/amdkfd: Check bounds in allocate_event_notification_slot
- CVE-2026-68258 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
- CVE-2026-68257 drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
- CVE-2026-68256 drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
- CVE-2026-68255 drm/virtio: bound EDID block reads to the response buffer
- CVE-2026-68254 drm/i915/vrr: require valid min/max vfreq for VRR
- CVE-2026-68253 drm/i915/hdcp: check streams[] bounds before overflow
- CVE-2026-68252 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
- CVE-2026-68251 drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
- CVE-2026-68250 drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
- CVE-2026-68249 drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
- CVE-2026-68248 drm/i915: Return NULL on error in active_instance
- CVE-2026-68247 drm/i915/bios: range check LFP Data Block panel_type2
- CVE-2026-68246 drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
- CVE-2026-68245 drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
- CVE-2026-68244 drm/i915/gem: Do not leak siblings[] on proto context error
- CVE-2026-68243 drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
- CVE-2026-68242 drm/i915/gt: Fix NULL deref on sched_engine alloc failure
- CVE-2026-68241 drm/i915/mst: limit DP MST ESI service loop
- CVE-2026-68240 drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
- CVE-2026-6824 CP Plus 8 Ch. Network Video Recorder Cross-site Scripting
- CVE-2026-68239 drm/ttm: Account for NULL and handle pages in ttm_pool_backup
- CVE-2026-68238 drm/amdgpu: Release VFCT ACPI table reference
- CVE-2026-68237 drm/amdgpu/userq: fix indefinite fence wait during GPU reset
- CVE-2026-68236 drm/amd/display: set new_stream to NULL after release
- CVE-2026-68235 drm/amd/display: dce100: skip non-DP stream encoders for DP MST
- CVE-2026-68234 drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
- CVE-2026-68233 drm/vc4: Shut down BO cache timer before teardown
- CVE-2026-68232 drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
- CVE-2026-68231 media: airspy: Return queued buffers on start_streaming() failure
- CVE-2026-68230 media: amlogic-c3: Add validations for ae and awb config
- CVE-2026-6823 HKUDS OpenHarness Insecure Default Remote Channel Allowlist
- CVE-2026-68229 media: cedrus: skip invalid H.264 reference list entries
- CVE-2026-68228 media: chips-media: wave5: Move src_buf Removal to finish_encode
- CVE-2026-68227 media: cx231xx: fix devres lifetime
- CVE-2026-68226 media: cx23885: add ioremap return check and cleanup
- CVE-2026-68225 media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
- CVE-2026-68224 media: mali-c55: Fix possible ERR_PTR in enable_streams
- CVE-2026-68223 media: meson: vdec: Fix memory leak in error path of vdec_open
- CVE-2026-68222 media: msi2500: Return queued buffers on start_streaming() failure
- CVE-2026-68221 media: nuvoton: npcm-video: fix memory leaks in probe and remove
- CVE-2026-68220 media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
- CVE-2026-68219 media: nxp: imx8-isi: Fix potential out-of-bounds issues
- CVE-2026-68218 media: pci: dm1105: Free allocated workqueue
- CVE-2026-68217 media: pwc: Drain fill_buf on start_streaming() failure
- CVE-2026-68216 media: pwc: Return queued buffers on start_streaming() failure
- CVE-2026-68215 media: radio-si476x: Unregister v4l2_device on probe failure
- CVE-2026-68214 media: rtl2832: fix use-after-free in rtl2832_remove()
- CVE-2026-68213 media: rtl2832_sdr: Return queued buffers on start_streaming() failure
- CVE-2026-68212 media: saa7134: Fix a possible memory leak in saa7134_video_init1
- CVE-2026-68211 media: stm32-dcmipp: Return queued buffers on start_streaming() failure
- CVE-2026-68210 media: stm32: dcmi: unregister notifier on probe failure
- CVE-2026-6821 Missing Authorization in GitLab
- CVE-2026-68209 media: sun4i-csi: Return queued buffers on start_streaming() failure
- CVE-2026-68208 media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()
- CVE-2026-68207 media: ti: vpe: unwind v4l2 device registration on probe error
- CVE-2026-68206 media: v4l2-ctrls: validate HEVC active reference counts
- CVE-2026-68205 media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
- CVE-2026-68204 media: vivid: check for vb2_is_busy() when toggling caps
- CVE-2026-68203 media: vivid: fix cleanup bugs in vivid_init()
- CVE-2026-68202 ALSA: seq: close a re-opened queue timer in the destructor
- CVE-2026-68201 ALSA: timer: drain a slave's callback before its master detaches it
- CVE-2026-68200 ALSA: timer: don't re-enter an instance callback that is still running
- CVE-2026-6820 Cross-site scripting in VikBooking Hotel Booking Engine & PMS
- CVE-2026-68199 wifi: ath6kl: fix OOB access from firmware ADDBA window size
- CVE-2026-68198 wifi: ath6kl: fix use-after-free in aggr_reset_state()