Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 471 of 1013.
- CVE-2026-64385 smb: client: fix double-free in SMB2_ioctl() replay
- CVE-2026-64384 smb: client: fix change notify replay double-free
- CVE-2026-64383 smb: client: fix double-free in SMB2_flush() replay
- CVE-2026-64382 smb: client: fix double-free in SMB2_open() replay
- CVE-2026-64381 smb: client: Fix next buffer leak in receive_encrypted_standard()
- CVE-2026-64380 smb: client: harden POSIX SID length parsing
- CVE-2026-64379 smb: client: mask server-provided mode to 07777 in modefromsid
- CVE-2026-64378 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
- CVE-2026-64377 cpufreq: qcom-cpufreq-hw: Fix possible double free
- CVE-2026-64376 firmware_loader: fix device reference leak in firmware_upload_register()
- CVE-2026-64375 proc: protect ptrace_may_access() with exec_update_lock (FD links)
- CVE-2026-64374 sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
- CVE-2026-64373 cpufreq: Fix hotplug-suspend race during reboot
- CVE-2026-64372 cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
- CVE-2026-64371 proc: protect ptrace_may_access() with exec_update_lock (part 1)
- CVE-2026-64370 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
- CVE-2026-6437 AWS EFS CSI Driver Mount Option Injection
- CVE-2026-64369 s390: Revert support for DCACHE_WORD_ACCESS
- CVE-2026-64368 mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
- CVE-2026-64367 HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
- CVE-2026-64366 HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
- CVE-2026-64365 HID: letsketch: fix UAF on inrange_timer at driver unbind
- CVE-2026-64364 HID: multitouch: fix out-of-bounds bit access on mt_io_flags
- CVE-2026-64363 HID: appleir: fix UAF on pending key_up_timer in remove()
- CVE-2026-64362 HID: lg-g15: cancel pending work on remove to fix a use-after-free
- CVE-2026-64361 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- CVE-2026-64360 hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
- CVE-2026-64359 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
- CVE-2026-64358 media: mtk-jpeg: cancel workqueue on release for supported platforms only
- CVE-2026-64357 xfs: fix exchmaps reservation limit check
- CVE-2026-64356 xfs: fix memory leak in xfs_dqinode_metadir_create()
- CVE-2026-64355 bpf: Reject fragmented frames in devmap
- CVE-2026-64354 bpf: Validate BTF repeated field counts before expansion
- CVE-2026-64353 bpf: Keep dynamic inner array lookups nullable
- CVE-2026-64352 bpf: Allow LPM map access from sleepable BPF programs
- CVE-2026-64351 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
- CVE-2026-64350 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
- CVE-2026-64349 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
- CVE-2026-64348 usb: free iso schedules on failed submit
- CVE-2026-64347 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
- CVE-2026-64346 usb: gadget: udc: Fix use-after-free in gadget_match_driver
- CVE-2026-64345 usb: gadget: f_printer: take kref only for successful open
- CVE-2026-64344 USB: idmouse: fix use-after-free on disconnect race
- CVE-2026-64343 USB: ldusb: fix use-after-free on disconnect race
- CVE-2026-64342 USB: iowarrior: fix use-after-free on disconnect
- CVE-2026-64341 USB: iowarrior: fix use-after-free on disconnect race
- CVE-2026-64340 USB: legousbtower: fix use-after-free on disconnect race
- CVE-2026-64339 usb: misc: usbio: bound bulk IN response length to the received transfer
- CVE-2026-64338 USB: misc: uss720: unregister parport on probe failure
- CVE-2026-64337 usb: mtu3: unmap request DMA on queue failure
- CVE-2026-64336 USB: serial: keyspan_pda: fix information leak
- CVE-2026-64335 USB: serial: digi_acceleport: fix broken rx after throttle
- CVE-2026-64334 USB: serial: digi_acceleport: fix hard lockup on disconnect
- CVE-2026-64333 USB: serial: digi_acceleport: fix write buffer corruption
- CVE-2026-64332 USB: ulpi: fix memory leak on registration failure
- CVE-2026-64331 usbip: vudc: fix NULL deref in vep_dequeue()
- CVE-2026-64330 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
- CVE-2026-6433 Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE
- CVE-2026-64329 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
- CVE-2026-64328 usb: gadget: f_fs: Fix DMA fence leak
- CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
- CVE-2026-64326 block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
- CVE-2026-64325 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
- CVE-2026-64324 udf: validate free block extents against the partition length
- CVE-2026-64323 udf: validate VAT header length against the VAT inode size
- CVE-2026-64322 udf: validate sparing table length as an entry count, not a byte count
- CVE-2026-64321 nvme: target: rdma: fix ndev refcount leak on queue connect
- CVE-2026-64320 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
- CVE-2026-6432 Improper bounds validation in EmberZNet SDK
- CVE-2026-64319 nvmet-auth: validate reply message payload bounds against transfer length
- CVE-2026-64318 partitions: aix: bound the pp_count scan to the ppe array
- CVE-2026-64317 isofs: bound Rock Ridge symlink components to the SL record
- CVE-2026-64316 crypto: caam - use print_hex_dump_devel to guard key hex dumps
- CVE-2026-64315 crypto: caam - use print_hex_dump_devel to guard key hex dumps
- CVE-2026-64314 crypto: chacha20poly1305 - validate poly1305 template argument
- CVE-2026-64313 crypto: ecc - Fix carry overflow in vli multiplication
- CVE-2026-64312 crypto: pcrypt - restore callback for non-parallel fallback
- CVE-2026-64311 crypto: loongson - Remove broken and unused loongson-rng
- CVE-2026-64310 crypto: ccp - Do not initialize SNP for SEV ioctls
- CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
- CVE-2026-64309 crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
- CVE-2026-64308 crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
- CVE-2026-64307 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
- CVE-2026-64306 crypto: drbg - Fix returning success on failure in CTR_DRBG
- CVE-2026-64305 crypto: qat - protect service table iterations with service_lock
- CVE-2026-64304 crypto: qat - validate RSA CRT component lengths
- CVE-2026-64303 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
- CVE-2026-64302 x86/mm: Fix freeing of PMD-sized vmemmap pages
- CVE-2026-64301 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
- CVE-2026-64300 perf/aux: Fix page UAF in map_range()
- CVE-2026-64299 tracing: Prevent out-of-bounds read in glob matching
- CVE-2026-64298 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
- CVE-2026-64297 module: decompress: check return value of module_extend_max_pages()
- CVE-2026-64296 exfat: bound uniname advance in exfat_find_dir_entry()
- CVE-2026-64295 mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
- CVE-2026-64294 mm: do file ownership checks with the proper mount idmap
- CVE-2026-64293 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
- CVE-2026-64292 iommufd: Move vevent memory allocation outside spinlock
- CVE-2026-64291 iommufd: Set veventq_depth upper bound
- CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()