Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 475 of 1013.
- CVE-2026-64012 net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- CVE-2026-64011 nfc: llcp: Fix use-after-free in llcp_sock_release()
- CVE-2026-64010 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
- CVE-2026-6401 Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update
- CVE-2026-64009 xfrm: Check for underflow in xfrm_state_mtu
- CVE-2026-64008 accel/rocket: fix UAF via dangling GEM handle in create_bo
- CVE-2026-64007 netfilter: synproxy: refresh tcphdr after skb_ensure_writable
- CVE-2026-64006 netfilter: nf_tables: fix dst corruption in same register operation
- CVE-2026-64005 net/smc: Do not re-initialize smc hashtables
- CVE-2026-64004 net/iucv: fix locking in .getsockopt
- CVE-2026-64003 scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
- CVE-2026-64002 ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
- CVE-2026-64001 ALSA: pcm: oss: Fix setup list UAF on proc write error
- CVE-2026-64000 net: hsr: fix potential OOB access in supervision frame handling
- CVE-2026-6400 Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form
- CVE-2026-63999 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
- CVE-2026-63998 ethtool: module: call ethnl_ops_complete() on module flash errors
- CVE-2026-63997 ethtool: module: avoid leaking a netdev ref on module flash errors
- CVE-2026-63996 ethtool: cmis: require exact CDB reply length
- CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module
- CVE-2026-63994 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
- CVE-2026-63993 vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
- CVE-2026-63992 tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
- CVE-2026-63991 Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
- CVE-2026-63990 bonding: refuse to enslave CAN devices
- CVE-2026-6399 General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter
- CVE-2026-63989 bridge: Fix sleep in atomic context in netlink path
- CVE-2026-63988 bridge: Fix sleep in atomic context in sysfs path
- CVE-2026-63987 ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
- CVE-2026-63986 ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
- CVE-2026-63985 ethtool: eeprom: add more safeties to EEPROM Netlink fallback
- CVE-2026-63984 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
- CVE-2026-63983 net/sched: fix packet loop on netem when duplicate is on
- CVE-2026-63982 net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
- CVE-2026-63981 net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow
- CVE-2026-63980 net/handshake: Use spin_lock_bh for hn_lock
- CVE-2026-63979 net/handshake: hand off the pinned file reference to accept_doit
- CVE-2026-63978 net/handshake: Drain pending requests at net namespace exit
- CVE-2026-63977 dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
- CVE-2026-63976 Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
- CVE-2026-63975 Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
- CVE-2026-63974 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
- CVE-2026-63973 net: mana: Add NULL guards in teardown path to prevent panic on attach failure
- CVE-2026-63972 net: mana: Skip redundant detach on already-detached port
- CVE-2026-63971 sctp: fix race between sctp_wait_for_connect and peeloff
- CVE-2026-63970 vsock/virtio: bind uarg before filling zerocopy skb
- CVE-2026-6397 Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute
- CVE-2026-63969 ipv6: fix possible infinite loop in rt6_fill_node()
- CVE-2026-63968 ipv6: fix possible infinite loop in fib6_select_path()
- CVE-2026-63967 iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
- CVE-2026-63966 iio: imu: adis16550: fix stack leak in trigger handler
- CVE-2026-63965 iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
- CVE-2026-63964 usb: typec: ucsi: ccg: reject firmware images without a ':' record header
- CVE-2026-63963 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
- CVE-2026-63962 usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
- CVE-2026-63961 usb: typec: altmodes/displayport: validate count before reading Status Update VDO
- CVE-2026-63960 usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
- CVE-2026-6396 Cross-site request forgery in Fast & Fancy Filter – 3F
- CVE-2026-63959 usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
- CVE-2026-63958 usb: typec: ucsi: validate connector number in ucsi_connector_change()
- CVE-2026-63957 USB: serial: safe_serial: fix memory corruption with small endpoint
- CVE-2026-63956 USB: serial: cypress_m8: fix memory corruption with small endpoint
- CVE-2026-63955 mm/vmalloc: do not trigger BUG() on BH disabled context
- CVE-2026-63954 hpfs: fix a crash if hpfs_map_dnode_bitmap fails
- CVE-2026-63953 mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page
- CVE-2026-63952 memfd: deny writeable mappings when implying SEAL_WRITE
- CVE-2026-63951 zram: fix use-after-free in zram_writeback_endio
- CVE-2026-63950 mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
- CVE-2026-6395 Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page
- CVE-2026-63949 auxdisplay: line-display: fix OOB read on zero-length message_store()
- CVE-2026-63948 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
- CVE-2026-63947 Bluetooth: HIDP: fix missing length checks in hidp_input_report()
- CVE-2026-63946 Bluetooth: ISO: fix UAF in iso_recv_frame
- CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
- CVE-2026-63944 Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
- CVE-2026-63943 Input: xpad - fix out-of-bounds access for Share button
- CVE-2026-63942 parport: Fix race between port and client registration
- CVE-2026-63941 KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
- CVE-2026-63940 KVM: SEV: Ignore Port I/O requests of length '0'
- CVE-2026-6394 Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
- CVE-2026-63939 KVM: SEV: Compute the correct max length of the in-GHCB scratch area
- CVE-2026-63938 KVM: SEV: Check PSC request indices against the actual size of the buffer
- CVE-2026-63937 KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
- CVE-2026-63936 iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
- CVE-2026-63935 iio: adc: nxp-sar-adc: fix division by zero in write_raw
- CVE-2026-63934 iio: gyro: itg3200: fix i2c read into the wrong stack location
- CVE-2026-63933 iio: gyro: adis16260: fix division by zero in write_raw
- CVE-2026-63932 iio: chemical: mhz19b: reject oversized serial replies
- CVE-2026-63931 iio: chemical: scd30: fix division by zero in write_raw
- CVE-2026-63930 iio: buffer: hw-consumer: fix use-after-free in error path
- CVE-2026-6393 BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage
- CVE-2026-63929 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
- CVE-2026-63928 USB: serial: omninet: fix memory corruption with small endpoint
- CVE-2026-63927 usb: dwc2: Fix use after free in debug code
- CVE-2026-63926 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
- CVE-2026-63925 macsec: fix replay protection at XPN lower-PN wrap
- CVE-2026-63924 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
- CVE-2026-63923 octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
- CVE-2026-63922 ipv6: exthdrs: refresh nh after handling HAO option
- CVE-2026-63921 ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().