Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 476 of 1013.
- CVE-2026-63920 ipv6: validate extension header length before copying to cmsg
- CVE-2026-6392 Tanium addressed an information disclosure vulnerability in Threat Response.
- CVE-2026-63919 xfrm: input: hold netns during deferred transport reinjection
- CVE-2026-63918 l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
- CVE-2026-63917 ip6: vti: Use ip6_tnl.net in vti6_changelink().
- CVE-2026-63916 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
- CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing
- CVE-2026-63914 xfrm: route MIGRATE notifications to caller's netns
- CVE-2026-63913 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
- CVE-2026-63912 xfrm: esp: restore combined single-frag length gate
- CVE-2026-63911 xfrm: iptfs: reset runtime state when cloning SAs
- CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint
- CVE-2026-6391 Cross-site request forgery in Sentence To SEO (keywords, description and tags)
- CVE-2026-63909 ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
- CVE-2026-63908 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
- CVE-2026-63907 uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory
- CVE-2026-63906 usb: musb: omap2430: Fix use-after-free in omap2430_probe()
- CVE-2026-63905 usbip: vudc: Fix use after free bug in vudc_remove due to race condition
- CVE-2026-63904 usb: usbtmc: check URB actual_length for interrupt-IN notifications
- CVE-2026-63903 USB: serial: belkin_sa: validate interrupt status length
- CVE-2026-63902 USB: serial: cypress_m8: validate interrupt packet headers
- CVE-2026-63901 USB: serial: digi_acceleport: fix memory corruption with small endpoints
- CVE-2026-63900 USB: serial: keyspan: fix missing indat transfer sanity check
- CVE-2026-6390 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-63899 USB: serial: mxuport: fix memory corruption with small endpoint
- CVE-2026-63898 USB: serial: mct_u232: fix memory corruption with small endpoint
- CVE-2026-63897 USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
- CVE-2026-63896 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
- CVE-2026-63895 usb: gadget: f_fs: copy only received bytes on short ep0 read
- CVE-2026-63894 usb: gadget: f_fs: serialize DMABUF cancel against request completion
- CVE-2026-63893 thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
- CVE-2026-63892 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
- CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
- CVE-2026-63890 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
- CVE-2026-6389 Misconfiguration in Turbonomic prometurbo agent
- CVE-2026-63889 scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
- CVE-2026-63888 scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
- CVE-2026-63887 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
- CVE-2026-63886 scsi: target: iscsi: Validate CHAP_R length before base64 decode
- CVE-2026-63885 drm/gem: fix race between change_handle and handle_delete
- CVE-2026-63884 drm/i915: Fix potential UAF in TTM object purge
- CVE-2026-63883 serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
- CVE-2026-63882 drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
- CVE-2026-63881 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
- CVE-2026-63880 drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
- CVE-2026-6388 Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation
- CVE-2026-63879 drm/amdgpu: fix amdgpu_hmm_range_get_pages
- CVE-2026-63878 drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
- CVE-2026-63877 serial: dz: Convert to use a platform device
- CVE-2026-63876 serial: zs: Convert to use a platform device
- CVE-2026-63875 arm64: tlb: Flush walk cache when unsharing PMD tables
- CVE-2026-63874 net: mctp: usb: fix race between urb completion and rx_retry cancellation
- CVE-2026-63873 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
- CVE-2026-63871 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
- CVE-2026-63870 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
- CVE-2026-6387 Auth bypass in System Update
- CVE-2026-63869 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
- CVE-2026-63868 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
- CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd
- CVE-2026-63866 wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()
- CVE-2026-63865 bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
- CVE-2026-63864 bpf: Propagate error from visit_tailcall_insn
- CVE-2026-63863 drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()
- CVE-2026-63862 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
- CVE-2026-63861 spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
- CVE-2026-63860 RDMA/core: Prefer NLA_NUL_STRING
- CVE-2026-6386 Missing large page handling in pmap_pkru_update_range()
- CVE-2026-63859 net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
- CVE-2026-63858 netfilter: nf_tables: add hook transactions for device deletions
- CVE-2026-63857 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
- CVE-2026-63856 drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
- CVE-2026-63855 drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
- CVE-2026-63854 drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
- CVE-2026-63853 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
- CVE-2026-63852 drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
- CVE-2026-63851 drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
- CVE-2026-63850 drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
- CVE-2026-6385 Integer overflow in Lightspeed Core
- CVE-2026-63849 drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring
- CVE-2026-63848 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
- CVE-2026-63847 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
- CVE-2026-63846 drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
- CVE-2026-63845 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
- CVE-2026-63844 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
- CVE-2026-63843 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
- CVE-2026-63842 drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
- CVE-2026-63841 drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring
- CVE-2026-63840 drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
- CVE-2026-6384 Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing
- CVE-2026-63839 platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()
- CVE-2026-63838 ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
- CVE-2026-63837 net: ena: PHC: Check return code before setting timestamp output
- CVE-2026-63836 batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
- CVE-2026-63835 batman-adv: v: prevent OGM aggregation on disabled hardif
- CVE-2026-63834 batman-adv: tp_meter: restrict number of unacked list entries
- CVE-2026-63833 ntfs3: reject direct userspace writes to reserved $LX* xattrs
- CVE-2026-63832 wifi: mt76: add wcid publish check in mt76_sta_add
- CVE-2026-63831 mac802154: llsec: add skb_cow_data() before in-place crypto
- CVE-2026-63830 net: skmsg: preserve sg.copy across SG transforms
- CVE-2026-6383 Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation