Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 474 of 1013.
- CVE-2026-64104 virt: sev-guest: Explicitly leak pages in unknown state
- CVE-2026-64103 scsi: isci: Fix use-after-free in device removal path
- CVE-2026-64102 RDMA/siw: Reject MPA FPDU length underflow before signed receive math
- CVE-2026-64101 fwctl: pds: Validate RPC input size before parsing
- CVE-2026-64100 drm/msm: Fix shrinker deadlock
- CVE-2026-6410 @fastify/static vulnerable to path traversal in directory listing
- CVE-2026-64099 drm/v3d: Fix use-after-free of CPU job query arrays on error path
- CVE-2026-64098 drm/virtio: use uninterruptible resv lock for plane updates
- CVE-2026-64097 drm/amd/display: Validate GPIO pin LUT table size before iterating
- CVE-2026-64096 batman-adv: mcast: fix use-after-free in orig_node RCU release
- CVE-2026-64095 batman-adv: bla: avoid double decrement of bla.num_requests
- CVE-2026-64094 batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
- CVE-2026-64093 batman-adv: tp_meter: directly shut down timer on cleanup
- CVE-2026-64092 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
- CVE-2026-64091 batman-adv: tt: fix TOCTOU race for reported vlans
- CVE-2026-64090 batman-adv: tt: avoid empty VLAN responses
- CVE-2026-6409 Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
- CVE-2026-64089 batman-adv: tt: fix negative last_changeset_len
- CVE-2026-64088 batman-adv: tt: fix negative tt_buff_len
- CVE-2026-64087 hwmon: (pmbus/adm1266) reject implausible blackbox record_count
- CVE-2026-64086 hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
- CVE-2026-64085 hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
- CVE-2026-64084 hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
- CVE-2026-64083 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
- CVE-2026-64082 riscv: Fix register corruption from uninitialized cregs on error
- CVE-2026-64081 firmware: arm_ffa: Validate framework notification message layout
- CVE-2026-64080 firmware: arm_ffa: Snapshot notifier callbacks under lock
- CVE-2026-6408 Tanium addressed an information disclosure vulnerability in Tanium Server.
- CVE-2026-64079 netfilter: x_tables: allocate hook ops while under mutex
- CVE-2026-64078 netfilter: x_tables: add and use xtables_unregister_table_exit
- CVE-2026-64077 netfilter: ebtables: move to two-stage removal scheme
- CVE-2026-64076 netfilter: bridge: eb_tables: close module init race
- CVE-2026-64075 fprobe: Fix unregister_fprobe() to wait for RCU grace period
- CVE-2026-64074 fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
- CVE-2026-64073 irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
- CVE-2026-64072 nvme: fix bio leak on mapping failure
- CVE-2026-64071 nvme-pci: fix use-after-free in nvme_free_host_mem()
- CVE-2026-64070 powerpc/hv-gpci: fix preempt count leak in sysfs show paths
- CVE-2026-64069 netfs: Fix cancellation of a DIO and single read subrequests
- CVE-2026-64068 netfs: Fix missing locking around retry adding new subreqs
- CVE-2026-64067 netfs: Fix missing barriers when accessing stream->subrequests locklessly
- CVE-2026-64066 netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
- CVE-2026-64065 netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
- CVE-2026-64064 netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
- CVE-2026-64063 netfs: Fix streaming write being overwritten
- CVE-2026-64062 netfs: Fix potential deadlock in write-through mode
- CVE-2026-64061 netfs: Fix early put of sink folio in netfs_read_gaps()
- CVE-2026-64060 netfs: Fix leak of request in netfs_write_begin() error handling
- CVE-2026-6406 Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag
- CVE-2026-64059 netfs: Fix folio->private handling in netfs_perform_write()
- CVE-2026-64058 netfs: Fix netfs_read_folio() to wait on writeback
- CVE-2026-64057 afs: Fix the locking used by afs_get_link()
- CVE-2026-64056 net: ethernet: cortina: Make RX SKB per-port
- CVE-2026-64055 net: ethernet: cortina: Carry over frag counter
- CVE-2026-64054 net: shaper: reject duplicate leaves in GROUP request
- CVE-2026-64053 block: don't overwrite bip_vcnt in bio_integrity_copy_user()
- CVE-2026-64052 block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
- CVE-2026-64051 accel/qaic: Add overflow check to remap_pfn_range during mmap
- CVE-2026-64050 drm/msm/dpu: don't mix devm and drmm functions
- CVE-2026-6405 Anomify AI <= 0.3.6 - Cross-Site Request Forgery
- CVE-2026-64049 drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
- CVE-2026-64048 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
- CVE-2026-64047 net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
- CVE-2026-64046 net: tls: prevent chain-after-chain in plain text SG
- CVE-2026-64045 ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
- CVE-2026-64044 ovpn: respect peer refcount in CMD_NEW_PEER error path
- CVE-2026-64043 ovpn: fix race between deleting interface and adding new peer
- CVE-2026-64042 vfio/pci: Check BAR resources before exporting a DMABUF
- CVE-2026-64041 ASoC: codecs: fs210x: fix possible buffer overflow
- CVE-2026-64040 cachefiles: Fix error return when vfs_mkdir() fails
- CVE-2026-6404 Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter
- CVE-2026-64039 drm/msm/snapshot: fix dumping of the unaligned regions
- CVE-2026-64038 hwmon: (lm90) Stop work before releasing hwmon device
- CVE-2026-64037 wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
- CVE-2026-64036 cgroup/rstat: validate cpu before css_rstat_cpu() access
- CVE-2026-64035 igc: set tx buffer type for SMD frames
- CVE-2026-64034 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
- CVE-2026-64033 RDMA/rtrs: Fix use-after-free in path file creation cleanup
- CVE-2026-64032 bridge: mcast: Fix a possible use-after-free when removing a bridge port
- CVE-2026-64031 erofs: fix managed cache race for unaligned extents
- CVE-2026-64030 wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
- CVE-2026-6403 Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter
- CVE-2026-64029 ALSA: seq: Serialize UMP output teardown with event_input
- CVE-2026-64028 tracing: Avoid NULL return from hist_field_name() on truncation
- CVE-2026-64027 net: shaper: rework the VALID marking (again)
- CVE-2026-64026 rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
- CVE-2026-64025 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
- CVE-2026-64024 tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
- CVE-2026-64023 gpio: aggregator: fix a potential use-after-free
- CVE-2026-64022 gpio: aggregator: remove the software node when deactivating the aggregator
- CVE-2026-64021 drm/xe/oa: Fix exec_queue leak on width check in stream open
- CVE-2026-64020 nvme-pci: fix dma_vecs leak on p2p memory
- CVE-2026-6402 webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
- CVE-2026-64019 nvme-pci: fix dma mapping leak on data setup error
- CVE-2026-64018 net: mana: validate rx_req_idx to prevent out-of-bounds array access
- CVE-2026-64017 blk-mq: pop cached request if it is usable
- CVE-2026-64016 ksmbd: fix durable reconnect error path file lifetime
- CVE-2026-64015 security/keys: fix missed RCU read section on lookup
- CVE-2026-64014 Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
- CVE-2026-64013 ACPI: button: Fix ACPI GPE handler leak during removal