Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 469 of 1013.
- CVE-2026-64567 btrfs: reject free space cache with more entries than pages
- CVE-2026-64566 xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
- CVE-2026-64565 Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
- CVE-2026-64564 sctp: don't free the ASCONF's own transport in DEL-IP processing
- CVE-2026-64563 rhashtable: clear stale iter->p on table restart
- CVE-2026-64562 KVM: nVMX: Hide shadow VMCS right after VMCLEAR
- CVE-2026-64561 KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
- CVE-2026-64560 posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- CVE-2026-6456 Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation
- CVE-2026-64559 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
- CVE-2026-64558 s390/pkey: Check length in pkey_pckmo handler implementation
- CVE-2026-64557 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- CVE-2026-64556 perf/core: Detach event groups during remove_on_exec
- CVE-2026-64555 KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
- CVE-2026-64554 netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
- CVE-2026-64553 net: psample: fix info leak in PSAMPLE_ATTR_DATA
- CVE-2026-64552 virtio-net: fix len check in receive_big()
- CVE-2026-64551 sctp: validate STALE_COOKIE cause length before reading staleness
- CVE-2026-64550 net: qualcomm: rmnet: validate MAP frame length before ingress parsing
- CVE-2026-6455 Cross-site request forgery in WP Contact Form 7 DB Handler
- CVE-2026-64549 Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
- CVE-2026-64548 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
- CVE-2026-64547 net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
- CVE-2026-64546 drm/edid: fix OOB read in drm_parse_tiled_block()
- CVE-2026-64545 net, bpf: check master for NULL in xdp_master_redirect()
- CVE-2026-64544 crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
- CVE-2026-64543 tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
- CVE-2026-64542 ipv6: ndisc: fix NULL deref in accept_untracked_na()
- CVE-2026-64541 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
- CVE-2026-64540 usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
- CVE-2026-6454 Cross-site scripting in Firelight Lightbox
- CVE-2026-64539 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
- CVE-2026-64538 ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
- CVE-2026-64537 bridge: cfm: reject invalid CCM interval at configuration time
- CVE-2026-64536 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
- CVE-2026-64535 nvmet-tcp: Fix potential UAF when ddgst mismatch
- CVE-2026-64534 nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
- CVE-2026-64533 fs/ntfs3: validate lcns_follow in log_replay conversion
- CVE-2026-64532 fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
- CVE-2026-64531 net: openvswitch: reject oversized nested action attrs
- CVE-2026-64530 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
- CVE-2026-6453 CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
- CVE-2026-64529 crypto: qat - remove unused character device and IOCTLs
- CVE-2026-64528 tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
- CVE-2026-64527 drm/hyperv: validate VMBus packet size in receive callback
- CVE-2026-64526 ethtool: tsconfig: fix missing ethnl_ops_complete()
- CVE-2026-64525 xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
- CVE-2026-64524 drm/hyperv: validate resolution_count and fix WIN8 fallback
- CVE-2026-64523 net/handshake: Take a long-lived file reference at submit
- CVE-2026-64522 net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
- CVE-2026-64521 pinctrl: meson: amlogic-a4: fix deadlock issue
- CVE-2026-64520 firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
- CVE-2026-6452 Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update
- CVE-2026-64519 NFSD: Fix infinite loop in layout state revocation
- CVE-2026-64518 tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
- CVE-2026-64517 drm/xe/gsc: Fix double-free of managed BO in error path
- CVE-2026-64516 drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
- CVE-2026-64515 wifi: mac80211: fix MLE defragmentation
- CVE-2026-64514 userfaultfd: gate must_wait writability check on pte_present()
- CVE-2026-64513 KVM: x86: Unconditionally recompute CR8 intercept on PPR update
- CVE-2026-64512 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
- CVE-2026-64511 ACPI: NFIT: core: Fix possible NULL pointer dereference
- CVE-2026-64510 ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
- CVE-2026-6451 CMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery
- CVE-2026-64509 rust: block: fix GenDisk cleanup paths
- CVE-2026-64508 bpf: Support for hardening against JIT spraying
- CVE-2026-64507 x86/bugs: Enable IBPB flush on BPF JIT allocation
- CVE-2026-64506 wifi: rtw89: correct drop logic for malformed AMPDU frames
- CVE-2026-64505 usb: gadget: function: rndis: add length check for header
- CVE-2026-64504 iio: accel: bmc150: clamp the device-reported FIFO frame count
- CVE-2026-64503 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
- CVE-2026-64502 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
- CVE-2026-64501 iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
- CVE-2026-64500 iio: adc: lpc32xx: Initialize completion before requesting IRQ
- CVE-2026-6450 CRL critical extension bypass in ParseCRL_Extensions
- CVE-2026-64499 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
- CVE-2026-64498 iio: buffer: hw-consumer: free scan_mask on buffer release
- CVE-2026-64497 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
- CVE-2026-64496 iio: event: Fix event FIFO reset race
- CVE-2026-64495 iio: gyro: bmg160: bail out when bandwidth/filter is not in table
- CVE-2026-64494 iio: light: gp2ap002: fix runtime PM leak on read error
- CVE-2026-64493 iio: pressure: mpl115: fix runtime PM leak on read error
- CVE-2026-64492 iio: temperature: tmp006: use devm_iio_trigger_register
- CVE-2026-64491 ALSA: usx2y: us144mkii: fix work UAF on disconnect
- CVE-2026-64490 ALSA: virtio: Validate control metadata from the device
- CVE-2026-6449 Missing authorization in Booking for Appointments and Events Calendar – Amelia
- CVE-2026-64489 ALSA: ymfpci: check snd_ctl_new1() return value
- CVE-2026-64488 ALSA: aoa: check snd_ctl_new1() return value
- CVE-2026-64487 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
- CVE-2026-64486 ALSA: cmipci: check snd_ctl_new1() return value
- CVE-2026-64485 ALSA: compress: Fix task creation error unwind
- CVE-2026-64484 ALSA: es1938: check snd_ctl_new1() return value
- CVE-2026-64483 ALSA: firewire: isight: bound the sample count to the packet payload
- CVE-2026-64482 ALSA: gus: check snd_ctl_new1() return value
- CVE-2026-64481 ALSA: hda/cs35l41: Fix firmware load work teardown
- CVE-2026-64480 ALSA: ice1712: check snd_ctl_new1() return value
- CVE-2026-6448 Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
- CVE-2026-64479 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
- CVE-2026-64478 ALSA: usb-audio: avoid kobject path lookup in DualSense match
- CVE-2026-64477 x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled