Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 561 of 1013.
- CVE-2026-53415 Zoom Clients - Use After Free
- CVE-2026-53414 Zoom Clients - Buffer Over-read
- CVE-2026-53413 Zoom Clients - Buffer Over-write
- CVE-2026-53412 Zoom Workplace VDI Plugin for Windows - Improper Input Validation
- CVE-2026-53411 Zoom Workplace VDI Plugin for Windows - Improper Input Validation
- CVE-2026-53410 Zoom Clients for Windows - Race Condition
- CVE-2026-5341 NMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-53409 Privilege escalation in Zoom Rooms
- CVE-2026-53408 Privilege escalation in Zoom Workplace
- CVE-2026-53407 Privilege escalation in Zoom Workplace
- CVE-2026-53406 Privilege escalation in Remote Control for Zoom Contact Center
- CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
- CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve
- CVE-2026-53403 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
- CVE-2026-53402 fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
- CVE-2026-53401 fbdev: omap2: fix use-after-free in omapfb_mmap
- CVE-2026-53400 i2c: core: fix adapter registration race
- CVE-2026-5340 Fancy Image Show <= 9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-53399 nfsd: release layout stid on setlease failure
- CVE-2026-53398 NFSD: Fix SECINFO_NO_NAME decode error cleanup
- CVE-2026-53397 nfsd: fix posix_acl leak on SETACL decode failure
- CVE-2026-53396 nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
- CVE-2026-53395 nfsd: fix dead ACL conflict guard in nfsd4_create
- CVE-2026-53394 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- CVE-2026-53393 nfsd: reset write verifier on deferred writeback errors
- CVE-2026-53392 NFSv4/flexfiles: reject zero filehandle version count
- CVE-2026-53391 NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- CVE-2026-53390 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- CVE-2026-5339 Tenda G103 Setting gpon.lua action_set_net_settings command injection
- CVE-2026-53389 net/tcp-ao: fix use-after-free of key in del_async path
- CVE-2026-53388 fuse: re-lock request before replacing page cache folio
- CVE-2026-53387 iio: light: veml6075: add bounds check to veml6075_it_ms index
- CVE-2026-53386 iio: adc: ti-ads1298: add bounds check to pga_settings index
- CVE-2026-53385 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- CVE-2026-53384 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- CVE-2026-53383 ksmbd: reject non-VALID session in compound request branch
- CVE-2026-53382 media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- CVE-2026-53381 virtiofs: fix UAF on submount umount
- CVE-2026-53380 media: rzv2h-ivc: Fix concurrent buffer list access
- CVE-2026-5338 Tenda G103 Setting system.lua action_set_system_settings command injection
- CVE-2026-53379 media: i2c: ov8856: free control handler on error in ov8856_init_controls()
- CVE-2026-53378 drm/colorop: Fix blob property reference tracking in state lifecycle
- CVE-2026-53377 drm/msm: always recover the gpu
- CVE-2026-53376 drm/amdkfd: Add upper bound check for num_of_nodes
- CVE-2026-53375 drm/amdgpu/vce: Prevent partial address patches
- CVE-2026-53374 drm/amdgpu: zero-initialize GART table on allocation
- CVE-2026-53373 mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()
- CVE-2026-53372 iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
- CVE-2026-53371 RDMA/ionic: bound node_desc sysfs read with %.64s
- CVE-2026-53370 perf/x86/intel: Improve validation and configuration of ACR masks
- CVE-2026-5337 Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDOR
- CVE-2026-53369 udf: reject descriptors with oversized CRC length
- CVE-2026-53368 f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
- CVE-2026-53367 selinux: fix avdcache auditing
- CVE-2026-53366 ipv4: account for fraggap on the paged allocation path
- CVE-2026-53365 vsock/virtio: fix zerocopy completion for multi-skb sends
- CVE-2026-53364 Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
- CVE-2026-53363 xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
- CVE-2026-53362 Linux Kernel Unspecified
- CVE-2026-53361 af_unix: Set gc_in_progress to true in unix_gc().
- CVE-2026-53360 KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
- CVE-2026-5336 Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure
- CVE-2026-53359 KVM: x86: Fix shadow paging use-after-free due to unexpected role
- CVE-2026-53358 Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
- CVE-2026-53357 Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
- CVE-2026-53356 drm/i915/gem: Fix phys BO pread/pwrite with offset
- CVE-2026-53355 net: rds: clear i_sends on setup unwind
- CVE-2026-53354 arm64: errata: Mitigate TLBI errata on various Arm CPUs
- CVE-2026-53353 hsr: Remove WARN_ONCE() in hsr_addr_is_self().
- CVE-2026-53352 signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
- CVE-2026-53351 riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
- CVE-2026-53350 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
- CVE-2026-5335 Magic Export & Import < 1.2.0 - Unauthenticated PII Disclosure
- CVE-2026-53349 netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
- CVE-2026-53348 ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions
- CVE-2026-53347 drm/virtio: Fix driver removal with disabled KMS
- CVE-2026-53346 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
- CVE-2026-53345 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
- CVE-2026-53344 pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
- CVE-2026-53343 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
- CVE-2026-53342 arm64: mm: call pagetable dtor when freeing hot-removed page tables
- CVE-2026-53341 fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
- CVE-2026-53340 i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
- CVE-2026-5334 itsourcecode Online Enrollment System Parameter index.php sql injection
- CVE-2026-53339 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
- CVE-2026-53338 net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
- CVE-2026-53337 net: bonding: fix NULL pointer dereference in bond_do_ioctl()
- CVE-2026-53336 nvmem: layouts: onie-tlv: fix hang on unknown types
- CVE-2026-53335 mm/damon/lru_sort: handle ctx allocation failure
- CVE-2026-53334 mm/damon/reclaim: handle ctx allocation failure
- CVE-2026-53333 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
- CVE-2026-53332 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
- CVE-2026-53331 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
- CVE-2026-53330 drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
- CVE-2026-5333 DefaultFuction Content-Management-System tools.php command injection
- CVE-2026-53329 drm/amd/display: Use krealloc_array() in dal_vector_reserve()
- CVE-2026-53328 sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
- CVE-2026-53327 debugobjects: Do not fill_pool() if pi_blocked_on
- CVE-2026-53326 debugobjects: Don't call fill_pool() in early boot hardirq context
- CVE-2026-53325 agp/amd64: Fix broken error propagation in agp_amd64_probe()