Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 473 of 1013.
- CVE-2026-64197 Memory corruption in DASYLab
- CVE-2026-64196 Memory corruption in DASYLab
- CVE-2026-64195 Out Of Bounds Write parsing a .DSB file in DASYLab due to lack of proper validation of user-supplied data
- CVE-2026-64194 Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains
- CVE-2026-64193 Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR
- CVE-2026-64192 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- CVE-2026-64191 i2c: stub: Reject I2C block transfers with invalid length
- CVE-2026-64190 net: team: fix NULL pointer dereference in team_xmit during mode change
- CVE-2026-6419 Missing authorization in Wishlist Member
- CVE-2026-64189 netfilter: ipset: fix race between dump and ip_set_list resize
- CVE-2026-64188 net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
- CVE-2026-64187 xfs: fail recovery on a committed log item with no regions
- CVE-2026-64186 iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
- CVE-2026-64185 sysfs: don't remove existing directory on update failure
- CVE-2026-64184 mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
- CVE-2026-64183 efi: Allocate runtime workqueue before ACPI init
- CVE-2026-64182 drivers/base/memory: fix memory block reference leak in poison accounting
- CVE-2026-64181 mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()
- CVE-2026-64180 mm/memory_hotplug: fix memory block reference leak on remove
- CVE-2026-6418 PaperCut NG/MF: Path Traversal in Shared Account Synchronization
- CVE-2026-64179 net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
- CVE-2026-64178 Bluetooth: bnep: Fix UAF read of dev->name
- CVE-2026-64177 phonet/pep: disable BH around forwarded sk_receive_skb()
- CVE-2026-64176 wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
- CVE-2026-64175 wifi: iwlwifi: mld: stop TX during firmware restart
- CVE-2026-64174 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
- CVE-2026-64173 tracing: Do not call map->ops->elt_free() if elt_alloc() fails
- CVE-2026-64172 KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)
- CVE-2026-64171 i2c: tegra: fix pm_runtime leak on mutex_lock failure
- CVE-2026-64170 spi: qup: fix error pointer deref after DMA setup failure
- CVE-2026-6417 GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'
- CVE-2026-64169 spi: ep93xx: fix error pointer deref after DMA setup failure
- CVE-2026-64168 spi: sprd: fix error pointer deref after DMA setup failure
- CVE-2026-64167 kho: skip KHO for crash kernel
- CVE-2026-64166 firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
- CVE-2026-64165 ARM: integrator: Fix early initialization
- CVE-2026-64164 btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
- CVE-2026-64163 test_kprobes: clear kprobes between test runs
- CVE-2026-64162 idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
- CVE-2026-64161 net: ti: icssm-prueth: fix eth_ports_node leak in probe
- CVE-2026-64160 netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
- CVE-2026-6416 Tanium addressed an uncontrolled resource consumption vulnerability in Interact.
- CVE-2026-64159 netfs: Fix zeropoint update where i_size > remote_i_size
- CVE-2026-64157 netfs: Fix partial invalidation of streaming-write folio
- CVE-2026-64156 netfs, afs: Fix write skipping in dir/link writepages
- CVE-2026-64155 wifi: ath11k: fix error path leaks in some WMI WOW calls
- CVE-2026-64154 drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
- CVE-2026-64153 drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
- CVE-2026-64152 iommu: Handle unmap error when iommu_debug is enabled
- CVE-2026-64151 iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
- CVE-2026-64150 netfilter: nft_inner: release local_lock before re-enabling softirqs
- CVE-2026-6415 Cross-site scripting in Advanced Custom Fields: Font Awesome Field
- CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code
- CVE-2026-64148 pds_core: fix error handling in pdsc_devcmd_wait
- CVE-2026-64147 pds_core: fix debugfs_lookup dentry leak and error handling
- CVE-2026-64146 erofs: fix metabuf leak in inode xattr initialization
- CVE-2026-64145 wifi: wilc1000: fix dma_buffer leak on bus acquire failure
- CVE-2026-64144 Bluetooth: btmtk: fix urb->setup_packet leak in error paths
- CVE-2026-64143 platform/x86: uniwill-laptop: Do not enable the charging limit even when forced
- CVE-2026-64142 ksmbd: close durable scavenger races against m_fp_list lookups
- CVE-2026-64141 ksmbd: fix null pointer dereference in compare_guid_key()
- CVE-2026-64140 ksmbd: fix null pointer dereference in proc_show_files()
- CVE-2026-6414 @fastify/static vulnerable to route guard bypass via encoded path separators
- CVE-2026-64139 ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
- CVE-2026-64138 ksmbd: validate SID in parent security descriptor during ACL inheritance
- CVE-2026-64137 smb: client: require net admin for CIFS SWN netlink
- CVE-2026-64136 smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
- CVE-2026-64135 hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
- CVE-2026-64134 ALSA: pcm: Don't setup bogus iov_iter for silencing
- CVE-2026-64133 ALSA: asihpi: Fix potential OOB array access at reading cache
- CVE-2026-64132 ipv6: ioam: refresh hdr pointer before ioam6_event()
- CVE-2026-64131 mm/memory: fix spurious warning when unmapping device-private/exclusive pages
- CVE-2026-64130 mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free
- CVE-2026-64129 mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
- CVE-2026-64128 Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
- CVE-2026-64127 Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
- CVE-2026-64126 Bluetooth: MGMT: validate Add Extended Advertising Data length
- CVE-2026-64125 net: bcmgenet: keep RBUF EEE/PM disabled
- CVE-2026-64124 net: devmem: reject dma-buf bind with non-page-aligned size or SG length
- CVE-2026-64123 net: hsr: defer node table free until after RCU readers
- CVE-2026-64122 net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
- CVE-2026-64121 net: ifb: report ethtool stats over num_tx_queues
- CVE-2026-64120 net: ethtool: fix NULL pointer dereference in phy_reply_size
- CVE-2026-6412 Continued acceptance of SHA-1/MD5 digests in certificate processing
- CVE-2026-64119 l2tp: use list_del_rcu in l2tp_session_unhash
- CVE-2026-64118 qed: fix double free in qed_cxt_tables_alloc()
- CVE-2026-64117 wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
- CVE-2026-64116 ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
- CVE-2026-64115 vsock/vmci: fix UAF when peer resets connection during handshake
- CVE-2026-64114 ipv4: raw: reject IP_HDRINCL packets with ihl < 5
- CVE-2026-64113 ixgbevf: fix use-after-free in VEPA multicast source pruning
- CVE-2026-64112 rbd: eliminate a race in lock_dwork draining on unmap
- CVE-2026-64111 lsm: hold cred_guard_mutex for lsm_set_self_attr()
- CVE-2026-64110 igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
- CVE-2026-6411 MAXHUB Pivot Client Application Use of a Broken or Risky Cryptographic Algorithm
- CVE-2026-64109 af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
- CVE-2026-64108 cifs: Fix busy dentry used after unmounting
- CVE-2026-64107 ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()
- CVE-2026-64106 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
- CVE-2026-64105 KVM: arm64: vgic: Free private_irqs when init fails after allocation