Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 446 of 1013.
- CVE-2026-68197 wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
- CVE-2026-68196 wifi: wilc1000: validate assoc response length before subtracting header
- CVE-2026-68195 wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
- CVE-2026-68194 wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
- CVE-2026-68193 wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
- CVE-2026-68192 wifi: brcmfmac: make release_scratchbuffers idempotent
- CVE-2026-68191 wifi: ath12k: fix NULL pointer dereference in rhash table destroy
- CVE-2026-68190 staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
- CVE-2026-6819 HKUDS OpenHarness Plugin Management Command Exposure
- CVE-2026-68189 Bluetooth: hci_sync: Protect UUID list traversal
- CVE-2026-68188 Bluetooth: RFCOMM: Fix session UAF in set_termios
- CVE-2026-68187 exec: fix unsigned loop counter wrap in transfer_args_to_stack()
- CVE-2026-68186 binfmt_misc: set have_execfd only once the interpreter is opened
- CVE-2026-68185 LoongArch: Move jump_label_init() before parse_early_param()
- CVE-2026-68184 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
- CVE-2026-68183 firmware: stratix10-svc: fix memory leaks and list corruption bugs
- CVE-2026-68182 comedi: comedi_parport: deal with premature interrupt
- CVE-2026-68181 mei: bus: access mei_device under device_lock on cleanup
- CVE-2026-68180 intel_th: fix MSC output device reference leak
- CVE-2026-6818 Cross-site scripting in VikBooking Hotel Booking Engine & PMS
- CVE-2026-68179 misc: nsm: only unlock nsm_dev on post-lock error paths
- CVE-2026-68178 misc: nsm: pin the module while the device is open
- CVE-2026-68177 tracing: Delay module ref count for "enable_event" trigger
- CVE-2026-68176 tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
- CVE-2026-68175 tracing: Fix resource leak on mmiotrace trace_pipe close
- CVE-2026-68174 tracing: Fix union collision of module and refcnt for dynamic events
- CVE-2026-68173 ublk: wait on ublk_dev_ready() instead of ub->completion
- CVE-2026-68172 arm64: make huge_ptep_get handled unaligned addresses
- CVE-2026-68170 mptcp: fix stale skb->sk reference on subflow close
- CVE-2026-6817 Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'
- CVE-2026-68169 mptcp: pm: userspace: fix use-after-free in get_local_id
- CVE-2026-68168 afs: Fix afs_edit_dir_remove() to get, not find, block 0
- CVE-2026-68167 btrfs: do not try compression for data reloc inodes
- CVE-2026-68166 userfaultfd: prevent registration of special VMAs
- CVE-2026-68165 mm/damon/core: validate ranges in damon_set_regions()
- CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()
- CVE-2026-68163 mm/page_vma_mapped: fix device-private PMD handling
- CVE-2026-68162 sctp: avoid auth_enable sysctl UAF during netns teardown
- CVE-2026-68161 sctp: close UDP tunnel sockets during netns teardown
- CVE-2026-68160 ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
- CVE-2026-6816 TFA Basic Plugins - Access Bypass
- CVE-2026-68159 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
- CVE-2026-68158 libceph: Fix multiplication overflow in decode_new_up_state_weight()
- CVE-2026-68157 libceph: guard missing CRUSH type name lookup
- CVE-2026-68156 libceph: refresh auth->authorizer_buf{,_len} after authorizer update
- CVE-2026-68155 libceph: Reject monmaps advertising zero monitors
- CVE-2026-68154 libceph: reject zero bucket types in crush_decode
- CVE-2026-68153 libceph: remove debugfs files before client teardown
- CVE-2026-68152 amt: fix use-after-free in AMT delayed works
- CVE-2026-68151 binfmt_elf_fdpic: only honour the first PT_INTERP
- CVE-2026-68150 fs/super: fix emergency thaw double-unlock of s_umount
- CVE-2026-6815 CVE-2026-6815
- CVE-2026-68149 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
- CVE-2026-68148 fscrypt: Add missing superblock check in find_or_insert_direct_key()
- CVE-2026-68147 fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
- CVE-2026-68146 ftrace: Add global mutex to serialize trace_parser access
- CVE-2026-68145 iomap: fix out-of-bounds bitmap_set() with zero-length range
- CVE-2026-68144 phonet: pep: fix use-after-free in pep_get_sb()
- CVE-2026-68143 net: slip: serialize receive against buffer reallocation
- CVE-2026-68142 geneve: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-68141 net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
- CVE-2026-68140 net/iucv: fix use-after-free of a severed iucv_path
- CVE-2026-68139 net/mlx5e: Use sender devcom for MPV master-up
- CVE-2026-68138 net/sched: serialize qdisc_rtab_list against concurrent get/put
- CVE-2026-68137 net/x25: fix use-after-free in x25_kill_by_neigh()
- CVE-2026-68136 net: gro: fix double aggregation of flush-marked skbs
- CVE-2026-68135 net: hip04: fix RX buffer leak on build_skb failure
- CVE-2026-68134 ptp: ptp_s390: Add missing facility check
- CVE-2026-68133 ice: fix PTP Call Trace during PTP release
- CVE-2026-68132 super: fix emergency thaw deadlock on frozen block devices
- CVE-2026-68131 rbd: Reset positive result codes to zero in object map update path
- CVE-2026-68130 ksmbd: defer destroy_previous_session() until after NTLM authentication
- CVE-2026-6813 Cross-site scripting in Continually
- CVE-2026-68129 gve: fix Rx queue stall on alloc failure
- CVE-2026-68128 ice: reject out-of-range ptype in ice_parser_profile_init
- CVE-2026-68127 ila: reload IPv6 header after pskb_may_pull in checksum adjust
- CVE-2026-68126 mac802154: hold an interface reference across the scan worker
- CVE-2026-68125 mac802154: llsec: reject frames shorter than the authentication tag
- CVE-2026-68124 mctp: serial: handle zero-length frames to prevent rx buffer overflow
- CVE-2026-68123 openvswitch: fix GSO userspace truncation underflow
- CVE-2026-68122 ovpn: fix peer refcount leak in TCP error paths
- CVE-2026-68121 pppoe: reload header pointer after dev_hard_header()
- CVE-2026-68120 rtase: Workaround for TX hang caused by hardware packet parsing
- CVE-2026-6812 Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter
- CVE-2026-68119 tcp: initialize standalone TCP-AO response padding
- CVE-2026-68118 tcp: challenge ACK for non-exact RST in SYN-RECEIVED
- CVE-2026-68117 tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
- CVE-2026-68116 vxlan: mdb: Fix source list corruption on a failed replace
- CVE-2026-68115 drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
- CVE-2026-68114 drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
- CVE-2026-68113 drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
- CVE-2026-68112 drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
- CVE-2026-68111 drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
- CVE-2026-68110 drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
- CVE-2026-6811 PHP Stack Exhaustion
- CVE-2026-68109 drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
- CVE-2026-68108 drm/amdgpu/vce: fix integer overflow in image size
- CVE-2026-68107 drm/amdgpu/vcn4: avoid rereading IB param length
- CVE-2026-68106 drm/amdgpu: fix division by zero with invalid uvd dimensions
- CVE-2026-68105 drm/amdgpu: Fix kernel panic during driver load failure