# Vulnerabilities published in 2026


- [CVE-2026-6829](https://insights.sbomify.com/CVE-2026-6829/): nesquena hermes-webui Arbitrary Workspace Directory Access (medium 5.3)
- [CVE-2026-68289](https://insights.sbomify.com/CVE-2026-68289/): tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (not scored)
- [CVE-2026-68288](https://insights.sbomify.com/CVE-2026-68288/): net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (not scored)
- [CVE-2026-68287](https://insights.sbomify.com/CVE-2026-68287/): drop_monitor: fix size calculations for 64-bit attributes (high 7.5)
- [CVE-2026-68286](https://insights.sbomify.com/CVE-2026-68286/): drop_monitor: perform u64_stats updates under IRQ-disabled section (not scored)
- [CVE-2026-68285](https://insights.sbomify.com/CVE-2026-68285/): LoongArch: BPF: Fix memory leak in bpf_jit_free() (not scored)
- [CVE-2026-68284](https://insights.sbomify.com/CVE-2026-68284/): bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (high 7.8)
- [CVE-2026-68283](https://insights.sbomify.com/CVE-2026-68283/): tracing: Fix use-after-free freeing trigger private data (high 8.8)
- [CVE-2026-68282](https://insights.sbomify.com/CVE-2026-68282/): drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() (not scored)
- [CVE-2026-68281](https://insights.sbomify.com/CVE-2026-68281/): drm/imagination: Count paired job fence as dependency in prepare_job() (not scored)
- [CVE-2026-68280](https://insights.sbomify.com/CVE-2026-68280/): drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (not scored)
- [CVE-2026-6828](https://insights.sbomify.com/CVE-2026-6828/): Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 6.4)
- [CVE-2026-68279](https://insights.sbomify.com/CVE-2026-68279/): drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (not scored)
- [CVE-2026-68278](https://insights.sbomify.com/CVE-2026-68278/): drm/dp/mst: fix buffer overflows in sideband chunk accumulation (not scored)
- [CVE-2026-68277](https://insights.sbomify.com/CVE-2026-68277/): drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (not scored)
- [CVE-2026-68276](https://insights.sbomify.com/CVE-2026-68276/): drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (not scored)
- [CVE-2026-68275](https://insights.sbomify.com/CVE-2026-68275/): drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO (not scored)
- [CVE-2026-68274](https://insights.sbomify.com/CVE-2026-68274/): drm/xe/guc: Fix buffer overflow in steered register list allocation (high 7.8)
- [CVE-2026-68273](https://insights.sbomify.com/CVE-2026-68273/): drm/amdgpu: Fix context pstate override handling (high 7.8)
- [CVE-2026-68272](https://insights.sbomify.com/CVE-2026-68272/): drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (not scored)
- [CVE-2026-68271](https://insights.sbomify.com/CVE-2026-68271/): drm/nouveau: fix reversed error cleanup order in ucopy functions (not scored)
- [CVE-2026-68270](https://insights.sbomify.com/CVE-2026-68270/): drm/sysfb: Avoid possible truncation with calculating visible size (not scored)
- [CVE-2026-6827](https://insights.sbomify.com/CVE-2026-6827/): justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities (medium 5.1)
- [CVE-2026-68269](https://insights.sbomify.com/CVE-2026-68269/): drm/i915/gem: Add missing nospec on parallel submit slot (not scored)
- [CVE-2026-68268](https://insights.sbomify.com/CVE-2026-68268/): drm/xe: Return error on non-migratable faults requiring devmem (not scored)
- [CVE-2026-68267](https://insights.sbomify.com/CVE-2026-68267/): drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (not scored)
- [CVE-2026-68266](https://insights.sbomify.com/CVE-2026-68266/): drm/xe: Hold a dma-buf reference for imported BOs (high 7.8)
- [CVE-2026-68265](https://insights.sbomify.com/CVE-2026-68265/): drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC (high 7.3)
- [CVE-2026-68264](https://insights.sbomify.com/CVE-2026-68264/): drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (high 7.8)
- [CVE-2026-68263](https://insights.sbomify.com/CVE-2026-68263/): drm/imagination: Fix double call to drm_sched_entity_fini() (high 7.8)
- [CVE-2026-68262](https://insights.sbomify.com/CVE-2026-68262/): drm/imagination: Fix user array stride in pvr_set_uobj_array() (high 7.1)
- [CVE-2026-68261](https://insights.sbomify.com/CVE-2026-68261/): drm/imagination: fix error checking of pvr_vm_context_lookup() (not scored)
- [CVE-2026-68260](https://insights.sbomify.com/CVE-2026-68260/): drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM (high 7.8)
- [CVE-2026-6826](https://insights.sbomify.com/CVE-2026-6826/): Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller (medium 6.9)
- [CVE-2026-68259](https://insights.sbomify.com/CVE-2026-68259/): drm/amdkfd: Check bounds in allocate_event_notification_slot (not scored)
- [CVE-2026-68258](https://insights.sbomify.com/CVE-2026-68258/): drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (high 7.1)
- [CVE-2026-68257](https://insights.sbomify.com/CVE-2026-68257/): drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (high 7.8)
- [CVE-2026-68256](https://insights.sbomify.com/CVE-2026-68256/): drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (not scored)
- [CVE-2026-68255](https://insights.sbomify.com/CVE-2026-68255/): drm/virtio: bound EDID block reads to the response buffer (high 7.7)
- [CVE-2026-68254](https://insights.sbomify.com/CVE-2026-68254/): drm/i915/vrr: require valid min/max vfreq for VRR (not scored)
- [CVE-2026-68253](https://insights.sbomify.com/CVE-2026-68253/): drm/i915/hdcp: check streams[] bounds before overflow (high 7.8)
- [CVE-2026-68252](https://insights.sbomify.com/CVE-2026-68252/): drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68251](https://insights.sbomify.com/CVE-2026-68251/): drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68250](https://insights.sbomify.com/CVE-2026-68250/): drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68249](https://insights.sbomify.com/CVE-2026-68249/): drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68248](https://insights.sbomify.com/CVE-2026-68248/): drm/i915: Return NULL on error in active_instance (not scored)
- [CVE-2026-68247](https://insights.sbomify.com/CVE-2026-68247/): drm/i915/bios: range check LFP Data Block panel_type2 (not scored)
- [CVE-2026-68246](https://insights.sbomify.com/CVE-2026-68246/): drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68245](https://insights.sbomify.com/CVE-2026-68245/): drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (high 7.8)
- [CVE-2026-68244](https://insights.sbomify.com/CVE-2026-68244/): drm/i915/gem: Do not leak siblings[] on proto context error (not scored)
- [CVE-2026-68243](https://insights.sbomify.com/CVE-2026-68243/): drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (not scored)
- [CVE-2026-68242](https://insights.sbomify.com/CVE-2026-68242/): drm/i915/gt: Fix NULL deref on sched_engine alloc failure (not scored)
- [CVE-2026-68241](https://insights.sbomify.com/CVE-2026-68241/): drm/i915/mst: limit DP MST ESI service loop (not scored)
- [CVE-2026-68240](https://insights.sbomify.com/CVE-2026-68240/): drm/gpusvm: publish dpagemap early to avoid device mapping leak on error (high 8.8)
- [CVE-2026-6824](https://insights.sbomify.com/CVE-2026-6824/): CP Plus 8 Ch. Network Video Recorder Cross-site Scripting (high 8.4)
- [CVE-2026-68239](https://insights.sbomify.com/CVE-2026-68239/): drm/ttm: Account for NULL and handle pages in ttm_pool_backup (not scored)
- [CVE-2026-68238](https://insights.sbomify.com/CVE-2026-68238/): drm/amdgpu: Release VFCT ACPI table reference (not scored)
- [CVE-2026-68237](https://insights.sbomify.com/CVE-2026-68237/): drm/amdgpu/userq: fix indefinite fence wait during GPU reset (not scored)
- [CVE-2026-68236](https://insights.sbomify.com/CVE-2026-68236/): drm/amd/display: set new_stream to NULL after release (high 7.8)
- [CVE-2026-68235](https://insights.sbomify.com/CVE-2026-68235/): drm/amd/display: dce100: skip non-DP stream encoders for DP MST (not scored)
- [CVE-2026-68234](https://insights.sbomify.com/CVE-2026-68234/): drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved (not scored)
- [CVE-2026-68233](https://insights.sbomify.com/CVE-2026-68233/): drm/vc4: Shut down BO cache timer before teardown (not scored)
- [CVE-2026-68232](https://insights.sbomify.com/CVE-2026-68232/): drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict (not scored)
- [CVE-2026-68231](https://insights.sbomify.com/CVE-2026-68231/): media: airspy: Return queued buffers on start_streaming() failure (not scored)
- [CVE-2026-68230](https://insights.sbomify.com/CVE-2026-68230/): media: amlogic-c3: Add validations for ae and awb config (high 7.3)
- [CVE-2026-6823](https://insights.sbomify.com/CVE-2026-6823/): HKUDS OpenHarness Insecure Default Remote Channel Allowlist (high 8.3)
- [CVE-2026-68229](https://insights.sbomify.com/CVE-2026-68229/): media: cedrus: skip invalid H.264 reference list entries (high 7.1)
- [CVE-2026-68228](https://insights.sbomify.com/CVE-2026-68228/): media: chips-media: wave5: Move src_buf Removal to finish_encode (high 7.8)
- [CVE-2026-68227](https://insights.sbomify.com/CVE-2026-68227/): media: cx231xx: fix devres lifetime (not scored)
- [CVE-2026-68226](https://insights.sbomify.com/CVE-2026-68226/): media: cx23885: add ioremap return check and cleanup (not scored)
- [CVE-2026-68225](https://insights.sbomify.com/CVE-2026-68225/): media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (not scored)
- [CVE-2026-68224](https://insights.sbomify.com/CVE-2026-68224/): media: mali-c55: Fix possible ERR_PTR in enable_streams (not scored)
- [CVE-2026-68223](https://insights.sbomify.com/CVE-2026-68223/): media: meson: vdec: Fix memory leak in error path of vdec_open (not scored)
- [CVE-2026-68222](https://insights.sbomify.com/CVE-2026-68222/): media: msi2500: Return queued buffers on start_streaming() failure (high 7.8)
- [CVE-2026-68221](https://insights.sbomify.com/CVE-2026-68221/): media: nuvoton: npcm-video: fix memory leaks in probe and remove (not scored)
- [CVE-2026-68220](https://insights.sbomify.com/CVE-2026-68220/): media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (not scored)
- [CVE-2026-68219](https://insights.sbomify.com/CVE-2026-68219/): media: nxp: imx8-isi: Fix potential out-of-bounds issues (high 7.8)
- [CVE-2026-68218](https://insights.sbomify.com/CVE-2026-68218/): media: pci: dm1105: Free allocated workqueue (not scored)
- [CVE-2026-68217](https://insights.sbomify.com/CVE-2026-68217/): media: pwc: Drain fill_buf on start_streaming() failure (not scored)
- [CVE-2026-68216](https://insights.sbomify.com/CVE-2026-68216/): media: pwc: Return queued buffers on start_streaming() failure (high 7.8)
- [CVE-2026-68215](https://insights.sbomify.com/CVE-2026-68215/): media: radio-si476x: Unregister v4l2_device on probe failure (not scored)
- [CVE-2026-68214](https://insights.sbomify.com/CVE-2026-68214/): media: rtl2832: fix use-after-free in rtl2832_remove() (not scored)
- [CVE-2026-68213](https://insights.sbomify.com/CVE-2026-68213/): media: rtl2832_sdr: Return queued buffers on start_streaming() failure (high 7.8)
- [CVE-2026-68212](https://insights.sbomify.com/CVE-2026-68212/): media: saa7134: Fix a possible memory leak in saa7134_video_init1 (not scored)
- [CVE-2026-68211](https://insights.sbomify.com/CVE-2026-68211/): media: stm32-dcmipp: Return queued buffers on start_streaming() failure (not scored)
- [CVE-2026-68210](https://insights.sbomify.com/CVE-2026-68210/): media: stm32: dcmi: unregister notifier on probe failure (high 7.8)
- [CVE-2026-6821](https://insights.sbomify.com/CVE-2026-6821/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-68209](https://insights.sbomify.com/CVE-2026-68209/): media: sun4i-csi: Return queued buffers on start_streaming() failure (high 7.8)
- [CVE-2026-68208](https://insights.sbomify.com/CVE-2026-68208/): media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice() (not scored)
- [CVE-2026-68207](https://insights.sbomify.com/CVE-2026-68207/): media: ti: vpe: unwind v4l2 device registration on probe error (not scored)
- [CVE-2026-68206](https://insights.sbomify.com/CVE-2026-68206/): media: v4l2-ctrls: validate HEVC active reference counts (high 7.8)
- [CVE-2026-68205](https://insights.sbomify.com/CVE-2026-68205/): media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (not scored)
- [CVE-2026-68204](https://insights.sbomify.com/CVE-2026-68204/): media: vivid: check for vb2_is_busy() when toggling caps (high 7.8)
- [CVE-2026-68203](https://insights.sbomify.com/CVE-2026-68203/): media: vivid: fix cleanup bugs in vivid_init() (not scored)
- [CVE-2026-68202](https://insights.sbomify.com/CVE-2026-68202/): ALSA: seq: close a re-opened queue timer in the destructor (high 7.8)
- [CVE-2026-68201](https://insights.sbomify.com/CVE-2026-68201/): ALSA: timer: drain a slave's callback before its master detaches it (high 7.8)
- [CVE-2026-68200](https://insights.sbomify.com/CVE-2026-68200/): ALSA: timer: don't re-enter an instance callback that is still running (high 7.8)
- [CVE-2026-6820](https://insights.sbomify.com/CVE-2026-6820/): Cross-site scripting in VikBooking Hotel Booking Engine & PMS (high 7.2)
- [CVE-2026-68199](https://insights.sbomify.com/CVE-2026-68199/): wifi: ath6kl: fix OOB access from firmware ADDBA window size (high 8.8)
- [CVE-2026-68198](https://insights.sbomify.com/CVE-2026-68198/): wifi: ath6kl: fix use-after-free in aggr_reset_state() (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/445/