Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 472 of 1013.
- CVE-2026-6429 netrc credential leak with reused proxy connection
- CVE-2026-64289 iommufd: Set upper bounds on cache invalidation entry_num and entry_len
- CVE-2026-64288 KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
- CVE-2026-64287 KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
- CVE-2026-64286 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
- CVE-2026-64285 KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
- CVE-2026-64284 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
- CVE-2026-64283 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
- CVE-2026-64282 KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
- CVE-2026-64281 svcrdma: wake sq waiters when the transport closes
- CVE-2026-64280 fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
- CVE-2026-6428 Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter
- CVE-2026-64279 i2c: core: fix adapter deregistration race
- CVE-2026-64278 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
- CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
- CVE-2026-64276 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
- CVE-2026-64275 Input: elan_i2c - prevent division by zero and arithmetic underflow
- CVE-2026-64274 Input: goodix - clamp the device-reported contact count
- CVE-2026-64273 Input: iforce - bound the device-reported force-feedback effect index
- CVE-2026-64272 Input: mms114 - fix touch indexing for MMS134S and MMS136
- CVE-2026-64271 Input: touchwin - reset the packet index on every complete packet
- CVE-2026-64270 Input: mms114 - reject an oversized device packet size
- CVE-2026-6427 a3 Lazy Load <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Element
- CVE-2026-64269 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
- CVE-2026-64268 RDMA/siw: bound Read Response placement to the RREAD length
- CVE-2026-64267 fuse: avoid 32-bit prune notification count wrap
- CVE-2026-64266 fuse: re-lock request before returning from fuse_ref_folio()
- CVE-2026-64265 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
- CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit
- CVE-2026-64263 fuse-uring: fix moving cancelled entry to ent_in_userspace list
- CVE-2026-64262 fuse-uring: end fuse_req on io-uring cancel task work
- CVE-2026-64261 fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
- CVE-2026-64260 fuse-uring: Avoid queue->stopped races and set/read that value under lock
- CVE-2026-6426 Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
- CVE-2026-64259 fuse-uring: make a fuse_req on SQE commit only findable after memcpy
- CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
- CVE-2026-64257 smb: client: reject overlapping data areas in SMB2 responses
- CVE-2026-64256 xfs: don't wrap around quota ids in dqiterate
- CVE-2026-64255 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
- CVE-2026-64254 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
- CVE-2026-64253 kernel/fork: clear PF_BLOCK_TS in copy_process()
- CVE-2026-64252 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
- CVE-2026-64251 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
- CVE-2026-64250 LoongArch: Report dying CPU to RCU in stop_this_cpu()
- CVE-2026-64249 fpga: region: fix use-after-free in child_regions_with_firmware()
- CVE-2026-64248 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
- CVE-2026-64247 KVM: x86: hyper-v: Bound the bank index when querying sparse banks
- CVE-2026-64246 power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
- CVE-2026-64245 fbdev: modedb: fix a possible UAF in fb_find_mode()
- CVE-2026-64244 drivers/base/memory: set mem->altmap after successful device registration
- CVE-2026-64243 ASoC: codecs: simple-mux: Fix enum control bounds check
- CVE-2026-64242 usb: gadget: net2280: Fix double free in probe error path
- CVE-2026-64241 gpio: rockchip: teardown bugs and resource leaks
- CVE-2026-64240 media: rc: igorplugusb: fix control request setup packet
- CVE-2026-6424 Use-after-free vulnerability in ESET security products for Linux
- CVE-2026-64239 mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
- CVE-2026-64238 gpio: shared: fix deadlock on shared proxy's parent removal
- CVE-2026-64237 Input: elan_i2c - validate firmware size before use
- CVE-2026-64236 i2c: davinci: fix division by zero on missing clock-frequency
- CVE-2026-64235 x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
- CVE-2026-64234 tty: serial: pch_uart: add check for dma_alloc_coherent()
- CVE-2026-64233 usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
- CVE-2026-64232 block: recompute nr_integrity_segments in blk_insert_cloned_request
- CVE-2026-64231 drm/msm/dsi: don't dump registers past the mapped region
- CVE-2026-64230 regulator: tps65219: fix irq_data.rdev not being assigned
- CVE-2026-6423 Local privilege escalation via unauthenticated ALPC in ESET Inspect Connector
- CVE-2026-64229 x86/mm: Disable broadcast TLB flush when PCID is disabled
- CVE-2026-64228 net: ethtool: phy: avoid NULL deref when PHY driver is unbound
- CVE-2026-64227 ACPI: driver: Check ACPI_COMPANION() against NULL during probe
- CVE-2026-64226 sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
- CVE-2026-64225 octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
- CVE-2026-64224 octeontx2-pf: fix double free in rvu_rep_rsrc_init()
- CVE-2026-64223 wifi: mac80211: consume only present negotiated TTLM maps
- CVE-2026-64222 octeontx2-pf: avoid double free of pool->stack on AQ init failure
- CVE-2026-64221 spi: ti-qspi: fix use-after-free after DMA setup failure
- CVE-2026-64220 device property: set fwnode->secondary to NULL in fwnode_init()
- CVE-2026-64219 drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
- CVE-2026-64218 batman-adv: bla: fix report_work leak on backbone_gw purge
- CVE-2026-64217 netfs: Fix overrun check in netfs_extract_user_iter()
- CVE-2026-64216 netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
- CVE-2026-64215 drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
- CVE-2026-64214 powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
- CVE-2026-64213 hwmon: (lm90) Add lock protection to lm90_alert
- CVE-2026-64212 wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it
- CVE-2026-64211 srcu: Don't queue workqueue handlers to never-online CPUs
- CVE-2026-64210 net/mlx5e: xsk: Fix unlocked writing to ICOSQ
- CVE-2026-6421 Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path
- CVE-2026-64209 phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
- CVE-2026-64208 crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
- CVE-2026-64207 net/sched: dualpi2: fix GSO backlog accounting
- CVE-2026-64206 Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
- CVE-2026-64205 i2c: i801: fix hardware state machine corruption in error path
- CVE-2026-64204 Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VI
- CVE-2026-64203 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI
- CVE-2026-64202 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI
- CVE-2026-64201 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI
- CVE-2026-64200 Out Of Bounds Read in during string conversionwhen parsing a .DSB file in DASYLab
- CVE-2026-6420 Keylime: keylime: security bypass due to hardcoded tpm quote nonce
- CVE-2026-64199 Out Of Bounds Read outside the bounds of an allocated data structure when parsing a .DSB file in DASYLab
- CVE-2026-64198 Out Of Bounds Read in file handling when parsing a .DSB file in DASYLab