Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 477 of 1013.
- CVE-2026-63829 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-63828 apparmor: mediate the implicit connect of TCP fast open sendmsg
- CVE-2026-63827 apparmor: fix use-after-free in rawdata dedup loop
- CVE-2026-63826 fbdev: fix use-after-free in store_modes()
- CVE-2026-63825 gcov: use atomic counter updates to fix concurrent access crashes
- CVE-2026-63824 KEYS: fix overflow in keyctl_pkey_params_get_2()
- CVE-2026-63823 keys: Pin request_key_auth payload in instantiate paths
- CVE-2026-63822 wifi: ath11k: fix warning when unbinding
- CVE-2026-63821 wifi: rtw88: usb: fix memory leaks on USB write failures
- CVE-2026-63820 f2fs: fix missing read bio submission on large folio error
- CVE-2026-6382 Multiple elFinder Plugins - Authenticated OS Command Injection
- CVE-2026-63819 f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
- CVE-2026-63818 f2fs: validate orphan inode entry count
- CVE-2026-63817 f2fs: validate compress cache inode only when enabled
- CVE-2026-63816 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
- CVE-2026-63815 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
- CVE-2026-63814 f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
- CVE-2026-63813 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
- CVE-2026-63812 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
- CVE-2026-63811 f2fs: read COW data with the original inode during atomic write
- CVE-2026-63810 block: Avoid mounting the bdev pseudo-filesystem in userspace
- CVE-2026-6381 WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
- CVE-2026-63809 bpf: use kvfree() for replaced sysctl write buffer
- CVE-2026-63808 exfat: fix potential use-after-free in exfat_find_dir_entry()
- CVE-2026-63807 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
- CVE-2026-63806 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
- CVE-2026-63805 crypto: nx - fix nx_crypto_ctx_exit argument
- CVE-2026-63804 gfs2: fix use-after-free in gfs2_qd_dealloc
- CVE-2026-63803 hdlc_ppp: sync per-proto timers before freeing hdlc state
- CVE-2026-63802 blk-cgroup: fix UAF in __blkcg_rstat_flush()
- CVE-2026-63801 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
- CVE-2026-63800 pNFS: Fix use-after-free in pnfs_update_layout()
- CVE-2026-63799 sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
- CVE-2026-63798 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
- CVE-2026-63797 rpmsg: char: Fix use-after-free on probe error path
- CVE-2026-63796 ocfs2: reject oversized group bitmap descriptors
- CVE-2026-63795 9p: avoid putting oldfid in p9_client_walk() error path
- CVE-2026-63794 KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
- CVE-2026-63793 ntfs: serialize volume label accesses
- CVE-2026-63792 Gitea private reusable workflow disclosure to fork runs
- CVE-2026-6379 WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter
- CVE-2026-6378 Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API
- CVE-2026-63772 Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count
- CVE-2026-63771 Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
- CVE-2026-63770 Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
- CVE-2026-6377 Path Traversal in Next4Biz's CSM (Customer Service Management)
- CVE-2026-63769 Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method
- CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
- CVE-2026-63767 ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ
- CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py
- CVE-2026-63765 Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation
- CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
- CVE-2026-63763 SurrealDB before 2.5.0 Privilege Escalation via Future Fields
- CVE-2026-63762 SurrealDB before v2.6.1 Denial of Service via scripting
- CVE-2026-63761 SurrealDB before 3.1.0 Algorithm Downgrade via ES512
- CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
- CVE-2026-6376 Missing authentication for critical function in SpiceJet Online Booking System
- CVE-2026-63759 SurrealDB before 3.1.0 Denial of Service nested type annotations
- CVE-2026-63758 SurrealDB before 3.1.0 Authorization Bypass via KILL Statement
- CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
- CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
- CVE-2026-63755 SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
- CVE-2026-63754 SurrealDB before 3.1.0 Denial of Service via LIVE Query
- CVE-2026-63753 SurrealDB before 3.1.0 Authentication Bypass via LIVE Query
- CVE-2026-63752 SurrealDB before 3.1.0 RELATE Statement Record Overwrite
- CVE-2026-63751 SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch
- CVE-2026-63750 SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket
- CVE-2026-6375 Authorization bypass through User-Controlled key in SpiceJet Online Booking System
- CVE-2026-63749 SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT
- CVE-2026-63748 SurrealDB before 3.1.0 Information Disclosure via Error Messages
- CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
- CVE-2026-63746 SurrealDB before 3.1.0 Permission Bypass via Graph Traversal
- CVE-2026-63745 SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id
- CVE-2026-63744 SurrealDB before 3.1.5 SSRF via JWKS URL Redirect
- CVE-2026-63743 SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect
- CVE-2026-63742 SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT
- CVE-2026-63741 SurrealDB before 3.1.0 Authentication Bypass via USE statement
- CVE-2026-63740 SurrealDB before 3.1.4 Array Element Permission Bypass
- CVE-2026-6374 Hardcoded Credentials in Zyxel WAH7601 Router
- CVE-2026-63739 SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER
- CVE-2026-63738 SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal
- CVE-2026-63737 SurrealDB before 3.1.5 Denial of Service via deep operator chains
- CVE-2026-63736 SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution
- CVE-2026-63735 SurrealDB before 3.2.0 Authentication Bypass via Custom API
- CVE-2026-63734 SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import
- CVE-2026-63733 SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause
- CVE-2026-63732 9router before 0.4.60 Remote Code Execution via default password
- CVE-2026-63731 HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
- CVE-2026-63730 HyperDX < 2.31.0 SSRF via Webhook Test Endpoint
- CVE-2026-6373 Sensitive Data Exposure in Zyxel WAH7601 Router
- CVE-2026-63729 TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File
- CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature
- CVE-2026-63727 Anchore Enterprise Privilege Escalation via User Management API
- CVE-2026-63725 sysPass FileBackupService Authenticated OS Command Injection via Backup Path
- CVE-2026-63722 ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php
- CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
- CVE-2026-6372 WordPress Accept Cryptocurrencies with Plisio plugin <= 2.0.5 - Payment Bypass vulnerability
- CVE-2026-63718 Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
- CVE-2026-63713 Toptech TMS7 and TopHAT SQL Injection
- CVE-2026-6371 Stored XSS in Limatek's LimRAD NAC