# Vulnerabilities published in 2026


- [CVE-2026-63829](https://insights.sbomify.com/CVE-2026-63829/): net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-63828](https://insights.sbomify.com/CVE-2026-63828/): apparmor: mediate the implicit connect of TCP fast open sendmsg (high 8.4)
- [CVE-2026-63827](https://insights.sbomify.com/CVE-2026-63827/): apparmor: fix use-after-free in rawdata dedup loop (high 7.8)
- [CVE-2026-63826](https://insights.sbomify.com/CVE-2026-63826/): fbdev: fix use-after-free in store_modes() (not scored)
- [CVE-2026-63825](https://insights.sbomify.com/CVE-2026-63825/): gcov: use atomic counter updates to fix concurrent access crashes (critical 9.8)
- [CVE-2026-63824](https://insights.sbomify.com/CVE-2026-63824/): KEYS: fix overflow in keyctl_pkey_params_get_2() (high 7.8)
- [CVE-2026-63823](https://insights.sbomify.com/CVE-2026-63823/): keys: Pin request_key_auth payload in instantiate paths (high 7.8)
- [CVE-2026-63822](https://insights.sbomify.com/CVE-2026-63822/): wifi: ath11k: fix warning when unbinding (not scored)
- [CVE-2026-63821](https://insights.sbomify.com/CVE-2026-63821/): wifi: rtw88: usb: fix memory leaks on USB write failures (not scored)
- [CVE-2026-63820](https://insights.sbomify.com/CVE-2026-63820/): f2fs: fix missing read bio submission on large folio error (not scored)
- [CVE-2026-6382](https://insights.sbomify.com/CVE-2026-6382/): Multiple elFinder Plugins - Authenticated OS Command Injection (critical 9.1)
- [CVE-2026-63819](https://insights.sbomify.com/CVE-2026-63819/): f2fs: fix to do sanity check on f2fs_get_node_folio_ra() (high 7.8)
- [CVE-2026-63818](https://insights.sbomify.com/CVE-2026-63818/): f2fs: validate orphan inode entry count (high 8.4)
- [CVE-2026-63817](https://insights.sbomify.com/CVE-2026-63817/): f2fs: validate compress cache inode only when enabled (high 7.8)
- [CVE-2026-63816](https://insights.sbomify.com/CVE-2026-63816/): f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode (high 7.8)
- [CVE-2026-63815](https://insights.sbomify.com/CVE-2026-63815/): f2fs: bound i_inline_xattr_size for non-inline-xattr inodes (high 8.4)
- [CVE-2026-63814](https://insights.sbomify.com/CVE-2026-63814/): f2fs: validate ACL entry sizes in f2fs_acl_from_disk() (high 7.8)
- [CVE-2026-63813](https://insights.sbomify.com/CVE-2026-63813/): Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" (high 7.8)
- [CVE-2026-63812](https://insights.sbomify.com/CVE-2026-63812/): f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() (high 7.8)
- [CVE-2026-63811](https://insights.sbomify.com/CVE-2026-63811/): f2fs: read COW data with the original inode during atomic write (not scored)
- [CVE-2026-63810](https://insights.sbomify.com/CVE-2026-63810/): block: Avoid mounting the bdev pseudo-filesystem in userspace (not scored)
- [CVE-2026-6381](https://insights.sbomify.com/CVE-2026-6381/): WP Maps < 4.9.3 - Subscriber+ Local File Inclusion (high 7.5)
- [CVE-2026-63809](https://insights.sbomify.com/CVE-2026-63809/): bpf: use kvfree() for replaced sysctl write buffer (high 7.8)
- [CVE-2026-63808](https://insights.sbomify.com/CVE-2026-63808/): exfat: fix potential use-after-free in exfat_find_dir_entry() (critical 9.8)
- [CVE-2026-63807](https://insights.sbomify.com/CVE-2026-63807/): KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (high 8.8)
- [CVE-2026-63806](https://insights.sbomify.com/CVE-2026-63806/): KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (high 7.1)
- [CVE-2026-63805](https://insights.sbomify.com/CVE-2026-63805/): crypto: nx - fix nx_crypto_ctx_exit argument (high 7.8)
- [CVE-2026-63804](https://insights.sbomify.com/CVE-2026-63804/): gfs2: fix use-after-free in gfs2_qd_dealloc (high 7.8)
- [CVE-2026-63803](https://insights.sbomify.com/CVE-2026-63803/): hdlc_ppp: sync per-proto timers before freeing hdlc state (high 7.8)
- [CVE-2026-63802](https://insights.sbomify.com/CVE-2026-63802/): blk-cgroup: fix UAF in __blkcg_rstat_flush() (high 7.8)
- [CVE-2026-63801](https://insights.sbomify.com/CVE-2026-63801/): tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (high 8.8)
- [CVE-2026-63800](https://insights.sbomify.com/CVE-2026-63800/): pNFS: Fix use-after-free in pnfs_update_layout() (critical 9.8)
- [CVE-2026-63799](https://insights.sbomify.com/CVE-2026-63799/): sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path (high 7.8)
- [CVE-2026-63798](https://insights.sbomify.com/CVE-2026-63798/): irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove (medium 5.5)
- [CVE-2026-63797](https://insights.sbomify.com/CVE-2026-63797/): rpmsg: char: Fix use-after-free on probe error path (high 8.4)
- [CVE-2026-63796](https://insights.sbomify.com/CVE-2026-63796/): ocfs2: reject oversized group bitmap descriptors (high 8.8)
- [CVE-2026-63795](https://insights.sbomify.com/CVE-2026-63795/): 9p: avoid putting oldfid in p9_client_walk() error path (critical 10.0)
- [CVE-2026-63794](https://insights.sbomify.com/CVE-2026-63794/): KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (high 7.8)
- [CVE-2026-63793](https://insights.sbomify.com/CVE-2026-63793/): ntfs: serialize volume label accesses (high 7.8)
- [CVE-2026-63792](https://insights.sbomify.com/CVE-2026-63792/): Gitea private reusable workflow disclosure to fork runs (medium 5.3)
- [CVE-2026-6379](https://insights.sbomify.com/CVE-2026-6379/): WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter (high 8.6)
- [CVE-2026-6378](https://insights.sbomify.com/CVE-2026-6378/): Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API (medium 6.4)
- [CVE-2026-63772](https://insights.sbomify.com/CVE-2026-63772/): Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count (high 8.7)
- [CVE-2026-63771](https://insights.sbomify.com/CVE-2026-63771/): Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header (medium 6.0)
- [CVE-2026-63770](https://insights.sbomify.com/CVE-2026-63770/): Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass (high 8.2)
- [CVE-2026-6377](https://insights.sbomify.com/CVE-2026-6377/): Path Traversal in Next4Biz's CSM (Customer Service Management) (high 7.5)
- [CVE-2026-63769](https://insights.sbomify.com/CVE-2026-63769/): Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method (medium 6.3)
- [CVE-2026-63768](https://insights.sbomify.com/CVE-2026-63768/): cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State (medium 5.3)
- [CVE-2026-63767](https://insights.sbomify.com/CVE-2026-63767/): ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ (critical 9.3)
- [CVE-2026-63766](https://insights.sbomify.com/CVE-2026-63766/): GPT-SoVITS 20250606v2pro OS Command Injection via webui.py (critical 9.3)
- [CVE-2026-63765](https://insights.sbomify.com/CVE-2026-63765/): Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation (high 8.8)
- [CVE-2026-63764](https://insights.sbomify.com/CVE-2026-63764/): LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass (high 7.7)
- [CVE-2026-63763](https://insights.sbomify.com/CVE-2026-63763/): SurrealDB before 2.5.0 Privilege Escalation via Future Fields (high 7.5)
- [CVE-2026-63762](https://insights.sbomify.com/CVE-2026-63762/): SurrealDB before v2.6.1 Denial of Service via scripting (medium 6.0)
- [CVE-2026-63761](https://insights.sbomify.com/CVE-2026-63761/): SurrealDB before 3.1.0 Algorithm Downgrade via ES512 (medium 5.3)
- [CVE-2026-63760](https://insights.sbomify.com/CVE-2026-63760/): SurrealDB before 3.1.0 Denial of Service via JSON Parser (high 8.7)
- [CVE-2026-6376](https://insights.sbomify.com/CVE-2026-6376/): Missing authentication for critical function in SpiceJet Online Booking System (high 8.7)
- [CVE-2026-63759](https://insights.sbomify.com/CVE-2026-63759/): SurrealDB before 3.1.0 Denial of Service nested type annotations (high 7.1)
- [CVE-2026-63758](https://insights.sbomify.com/CVE-2026-63758/): SurrealDB before 3.1.0 Authorization Bypass via KILL Statement (medium 5.3)
- [CVE-2026-63757](https://insights.sbomify.com/CVE-2026-63757/): SurrealDB before 3.1.0 Session Hijacking via /rpc sessions (high 8.7)
- [CVE-2026-63756](https://insights.sbomify.com/CVE-2026-63756/): SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition (critical 9.2)
- [CVE-2026-63755](https://insights.sbomify.com/CVE-2026-63755/): SurrealDB before 3.1.0 Permission Bypass via WHERE Clause (high 7.1)
- [CVE-2026-63754](https://insights.sbomify.com/CVE-2026-63754/): SurrealDB before 3.1.0 Denial of Service via LIVE Query (high 7.1)
- [CVE-2026-63753](https://insights.sbomify.com/CVE-2026-63753/): SurrealDB before 3.1.0 Authentication Bypass via LIVE Query (medium 5.3)
- [CVE-2026-63752](https://insights.sbomify.com/CVE-2026-63752/): SurrealDB before 3.1.0 RELATE Statement Record Overwrite (medium 5.3)
- [CVE-2026-63751](https://insights.sbomify.com/CVE-2026-63751/): SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch (medium 5.3)
- [CVE-2026-63750](https://insights.sbomify.com/CVE-2026-63750/): SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket (medium 6.9)
- [CVE-2026-6375](https://insights.sbomify.com/CVE-2026-6375/): Authorization bypass through User-Controlled key in SpiceJet Online Booking System (high 8.7)
- [CVE-2026-63749](https://insights.sbomify.com/CVE-2026-63749/): SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT (medium 5.3)
- [CVE-2026-63748](https://insights.sbomify.com/CVE-2026-63748/): SurrealDB before 3.1.0 Information Disclosure via Error Messages (medium 5.3)
- [CVE-2026-63747](https://insights.sbomify.com/CVE-2026-63747/): SurrealDB before 3.1.0 Denial of Service via malformed RPC use (high 8.7)
- [CVE-2026-63746](https://insights.sbomify.com/CVE-2026-63746/): SurrealDB before 3.1.0 Permission Bypass via Graph Traversal (high 7.1)
- [CVE-2026-63745](https://insights.sbomify.com/CVE-2026-63745/): SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id (medium 5.3)
- [CVE-2026-63744](https://insights.sbomify.com/CVE-2026-63744/): SurrealDB before 3.1.5 SSRF via JWKS URL Redirect (medium 5.1)
- [CVE-2026-63743](https://insights.sbomify.com/CVE-2026-63743/): SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect (medium 5.3)
- [CVE-2026-63742](https://insights.sbomify.com/CVE-2026-63742/): SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT (medium 5.3)
- [CVE-2026-63741](https://insights.sbomify.com/CVE-2026-63741/): SurrealDB before 3.1.0 Authentication Bypass via USE statement (medium 6.9)
- [CVE-2026-63740](https://insights.sbomify.com/CVE-2026-63740/): SurrealDB before 3.1.4 Array Element Permission Bypass (high 7.1)
- [CVE-2026-6374](https://insights.sbomify.com/CVE-2026-6374/): Hardcoded Credentials in Zyxel WAH7601 Router (high 7.3)
- [CVE-2026-63739](https://insights.sbomify.com/CVE-2026-63739/): SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER (high 8.3)
- [CVE-2026-63738](https://insights.sbomify.com/CVE-2026-63738/): SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal (medium 5.3)
- [CVE-2026-63737](https://insights.sbomify.com/CVE-2026-63737/): SurrealDB before 3.1.5 Denial of Service via deep operator chains (high 7.1)
- [CVE-2026-63736](https://insights.sbomify.com/CVE-2026-63736/): SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution (medium 5.1)
- [CVE-2026-63735](https://insights.sbomify.com/CVE-2026-63735/): SurrealDB before 3.2.0 Authentication Bypass via Custom API (high 8.6)
- [CVE-2026-63734](https://insights.sbomify.com/CVE-2026-63734/): SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import (medium 6.9)
- [CVE-2026-63733](https://insights.sbomify.com/CVE-2026-63733/): SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause (medium 5.3)
- [CVE-2026-63732](https://insights.sbomify.com/CVE-2026-63732/): 9router before 0.4.60 Remote Code Execution via default password (critical 9.4)
- [CVE-2026-63731](https://insights.sbomify.com/CVE-2026-63731/): HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint (medium 6.3)
- [CVE-2026-63730](https://insights.sbomify.com/CVE-2026-63730/): HyperDX < 2.31.0 SSRF via Webhook Test Endpoint (medium 5.3)
- [CVE-2026-6373](https://insights.sbomify.com/CVE-2026-6373/): Sensitive Data Exposure in Zyxel WAH7601 Router (medium 6.5)
- [CVE-2026-63729](https://insights.sbomify.com/CVE-2026-63729/): TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File (medium 6.8)
- [CVE-2026-63728](https://insights.sbomify.com/CVE-2026-63728/): Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature (high 8.1)
- [CVE-2026-63727](https://insights.sbomify.com/CVE-2026-63727/): Anchore Enterprise Privilege Escalation via User Management API (high 8.7)
- [CVE-2026-63725](https://insights.sbomify.com/CVE-2026-63725/): sysPass FileBackupService Authenticated OS Command Injection via Backup Path (high 8.6)
- [CVE-2026-63722](https://insights.sbomify.com/CVE-2026-63722/): ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php (high 8.7)
- [CVE-2026-63720](https://insights.sbomify.com/CVE-2026-63720/): datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field (high 7.5)
- [CVE-2026-6372](https://insights.sbomify.com/CVE-2026-6372/): WordPress Accept Cryptocurrencies with Plisio plugin <= 2.0.5 - Payment Bypass vulnerability (high 7.5)
- [CVE-2026-63718](https://insights.sbomify.com/CVE-2026-63718/): Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling (high 7.5)
- [CVE-2026-63713](https://insights.sbomify.com/CVE-2026-63713/): Toptech TMS7 and TopHAT SQL Injection (high 8.5)
- [CVE-2026-6371](https://insights.sbomify.com/CVE-2026-6371/): Stored XSS in Limatek's LimRAD NAC (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/477/