Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 470 of 1013.
- CVE-2026-64476 vfio/pci: Latch disable_idle_d3 per device
- CVE-2026-64475 vfio/pci: Release the VGA arbiter client on register_device() failure
- CVE-2026-64474 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
- CVE-2026-64473 vfio: Remove device debugfs before releasing devres
- CVE-2026-64472 vfio/mlx5: Fix racy bitfields and tighten struct layout
- CVE-2026-64471 Bluetooth: btusb: fix use-after-free on registration failure
- CVE-2026-64470 Bluetooth: btusb: fix use-after-free on marvell probe failure
- CVE-2026-6447 Cross-site scripting in Call for Price for WooCommerce
- CVE-2026-64469 binder: fix UAF in binder_thread_release()
- CVE-2026-64468 binder: fix UAF in binder_free_transaction()
- CVE-2026-64467 rust_binder: use a u64 stride when cleaning up the offsets array
- CVE-2026-64466 rust_binder: clear freeze listener on node removal
- CVE-2026-64465 usb: xhci: Fix sleep in atomic context in xhci_free_streams()
- CVE-2026-64464 xhci: sideband: fix ring sg table pages leak
- CVE-2026-64463 usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
- CVE-2026-64462 PCI: altera: Fix resource leaks on probe failure
- CVE-2026-64461 PCI: mediatek: Fix IRQ domain leak when port fails to enable
- CVE-2026-64460 PCI/IOV: Skip VF Resizable BAR restore on read error
- CVE-2026-6446 Missing authorization in My Social Feeds – Social Feeds Embedder Plugin for WordPress
- CVE-2026-64459 tcp: restore RCU grace period in tcp_ao_destroy_sock
- CVE-2026-64458 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
- CVE-2026-64457 virtio_pci: fix vq info pointer lookup via wrong index
- CVE-2026-64456 hwrng: virtio: clamp device-reported used.len at copy_data()
- CVE-2026-64455 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
- CVE-2026-64454 usb: dwc3: run gadget disconnect from sleepable suspend context
- CVE-2026-64453 usb: misc: usbio: fix disconnect UAF in client teardown
- CVE-2026-64452 6lowpan: fix NHC entry use-after-free on error path
- CVE-2026-64451 tracing: Fix NULL pointer dereference in func_set_flag()
- CVE-2026-64450 tipc: fix out-of-bounds read in broadcast Gap ACK blocks
- CVE-2026-6445 Information disclosure in FlashArray
- CVE-2026-64449 staging: vme_user: bound slave read/write to the kern_buf size
- CVE-2026-64448 smb: client: restrict implied bcc[0] exemption to responses without data area
- CVE-2026-64447 staging: media: ipu7: fix double-free and use-after-free in error paths
- CVE-2026-64446 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
- CVE-2026-64445 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
- CVE-2026-64444 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
- CVE-2026-64443 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
- CVE-2026-64442 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
- CVE-2026-64441 staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
- CVE-2026-64440 staging: rtl8723bs: fix OOB write in HT_caps_handler()
- CVE-2026-6444 Missing authorization in FlashArray
- CVE-2026-64439 crypto: krb5 - filter out async aead implementations at alloc
- CVE-2026-64438 crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
- CVE-2026-64437 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
- CVE-2026-64436 net: af_key: initialize alg_key_len for IPComp states
- CVE-2026-64435 audit: Fix data races of skb_queue_len() readers on audit_queue
- CVE-2026-64434 Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
- CVE-2026-64433 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
- CVE-2026-64432 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
- CVE-2026-64431 ntfs: avoid calling post_write_mst_fixup() for invalid index_block
- CVE-2026-64430 NTB: epf: Avoid calling pci_irq_vector() from hardirq context
- CVE-2026-6443 Essentialplugin Plugins (Various Versions) - Injected Backdoor
- CVE-2026-64429 gpio: eic-sprd: use raw_spinlock_t in the irq startup path
- CVE-2026-64428 gpio: sch: use raw_spinlock_t in the irq startup path
- CVE-2026-64427 HID: logitech-dj: Fix maxfield check in DJ short report validation
- CVE-2026-64426 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
- CVE-2026-64425 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
- CVE-2026-64424 netpoll: fix a use-after-free on shutdown path
- CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction
- CVE-2026-64422 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
- CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove
- CVE-2026-64420 mfd: cros_ec: Delay dev_set_drvdata() until probe success
- CVE-2026-6442 Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface
- CVE-2026-64419 mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
- CVE-2026-64418 mm: shrinker: fix shrinker_info teardown race with expansion
- CVE-2026-64417 mm: shrinker: fix NULL pointer dereference in debugfs
- CVE-2026-64416 mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
- CVE-2026-64415 mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
- CVE-2026-64414 netfilter: handle unreadable frags
- CVE-2026-64413 netfilter: ebtables: zero chainstack array
- CVE-2026-64412 netfilter: ebtables: module names must be null-terminated
- CVE-2026-64411 netfilter: ebtables: terminate table name before find_table_lock()
- CVE-2026-64410 netfilter: flowtable: IPIP tunnel hardware offload is not yet support
- CVE-2026-6441 Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification
- CVE-2026-64409 Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
- CVE-2026-64408 Bluetooth: bnep: pin L2CAP connection during netdev registration
- CVE-2026-64407 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
- CVE-2026-64406 Bluetooth: fix UAF in bt_accept_dequeue()
- CVE-2026-64405 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
- CVE-2026-64404 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
- CVE-2026-64403 Bluetooth: L2CAP: validate option length before reading conf opt value
- CVE-2026-64402 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
- CVE-2026-64401 smb: client: resolve SWN tcon from live registrations
- CVE-2026-64400 ksmbd: prevent path traversal bypass by restricting caseless retry
- CVE-2026-6440 Cross-site request forgery in GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference
- CVE-2026-64399 ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
- CVE-2026-64398 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
- CVE-2026-64397 ksmbd: serialize QUERY_DIRECTORY requests per file
- CVE-2026-64396 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
- CVE-2026-64395 ksmbd: require source read access for duplicate extents
- CVE-2026-64394 ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
- CVE-2026-64393 ksmbd: run set info with opener credentials
- CVE-2026-64392 ksmbd: use opener credentials for delete-on-close
- CVE-2026-64391 ksmbd: use opener credentials for ADS I/O
- CVE-2026-64390 ksmbd: track the connection owning a byte-range lock
- CVE-2026-6439 Cross-site scripting in VideoZen
- CVE-2026-64389 ksmbd: validate NTLMv2 response before updating session key
- CVE-2026-64388 smb/client: fix chown/chgrp with SMB3 POSIX Extensions
- CVE-2026-64387 smb: client: fix query directory replay double-free
- CVE-2026-64386 smb: client: fix query_info() replay double-free