# Vulnerabilities published in 2026


- [CVE-2026-53415](https://insights.sbomify.com/CVE-2026-53415/): Zoom Clients - Use After Free (high 8.3)
- [CVE-2026-53414](https://insights.sbomify.com/CVE-2026-53414/): Zoom Clients - Buffer Over-read (medium 6.5)
- [CVE-2026-53413](https://insights.sbomify.com/CVE-2026-53413/): Zoom Clients - Buffer Over-write (high 8.3)
- [CVE-2026-53412](https://insights.sbomify.com/CVE-2026-53412/): Zoom Workplace VDI Plugin for Windows - Improper Input Validation (critical 9.8)
- [CVE-2026-53411](https://insights.sbomify.com/CVE-2026-53411/): Zoom Workplace VDI Plugin for Windows - Improper Input Validation (high 7.8)
- [CVE-2026-53410](https://insights.sbomify.com/CVE-2026-53410/): Zoom Clients for Windows - Race Condition (high 7.0)
- [CVE-2026-5341](https://insights.sbomify.com/CVE-2026-5341/): NMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-53409](https://insights.sbomify.com/CVE-2026-53409/): Privilege escalation in Zoom Rooms (high 7.8)
- [CVE-2026-53408](https://insights.sbomify.com/CVE-2026-53408/): Privilege escalation in Zoom Workplace (high 8.1)
- [CVE-2026-53407](https://insights.sbomify.com/CVE-2026-53407/): Privilege escalation in Zoom Workplace (high 8.1)
- [CVE-2026-53406](https://insights.sbomify.com/CVE-2026-53406/): Privilege escalation in Remote Control for Zoom Contact Center (high 7.8)
- [CVE-2026-53405](https://insights.sbomify.com/CVE-2026-53405/): Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask (critical 9.8)
- [CVE-2026-53404](https://insights.sbomify.com/CVE-2026-53404/): Apache Tomcat: Bad ornext processing in RewriteValve (high 7.3)
- [CVE-2026-53403](https://insights.sbomify.com/CVE-2026-53403/): fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (medium 5.5)
- [CVE-2026-53402](https://insights.sbomify.com/CVE-2026-53402/): fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() (high 7.1)
- [CVE-2026-53401](https://insights.sbomify.com/CVE-2026-53401/): fbdev: omap2: fix use-after-free in omapfb_mmap (high 7.8)
- [CVE-2026-53400](https://insights.sbomify.com/CVE-2026-53400/): i2c: core: fix adapter registration race (high 7.8)
- [CVE-2026-5340](https://insights.sbomify.com/CVE-2026-5340/): Fancy Image Show <= 9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-53399](https://insights.sbomify.com/CVE-2026-53399/): nfsd: release layout stid on setlease failure (critical 9.8)
- [CVE-2026-53398](https://insights.sbomify.com/CVE-2026-53398/): NFSD: Fix SECINFO_NO_NAME decode error cleanup (critical 9.8)
- [CVE-2026-53397](https://insights.sbomify.com/CVE-2026-53397/): nfsd: fix posix_acl leak on SETACL decode failure (high 7.5)
- [CVE-2026-53396](https://insights.sbomify.com/CVE-2026-53396/): nfsd: fix posix_acl leak and ignored error in nfsd4_create_file (high 7.1)
- [CVE-2026-53395](https://insights.sbomify.com/CVE-2026-53395/): nfsd: fix dead ACL conflict guard in nfsd4_create (high 7.5)
- [CVE-2026-53394](https://insights.sbomify.com/CVE-2026-53394/): nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (high 7.5)
- [CVE-2026-53393](https://insights.sbomify.com/CVE-2026-53393/): nfsd: reset write verifier on deferred writeback errors (medium 5.5)
- [CVE-2026-53392](https://insights.sbomify.com/CVE-2026-53392/): NFSv4/flexfiles: reject zero filehandle version count (high 7.5)
- [CVE-2026-53391](https://insights.sbomify.com/CVE-2026-53391/): NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (high 7.5)
- [CVE-2026-53390](https://insights.sbomify.com/CVE-2026-53390/): ksmbd: fix out-of-bounds read in smb_check_perm_dacl() (high 8.1)
- [CVE-2026-5339](https://insights.sbomify.com/CVE-2026-5339/): Tenda G103 Setting gpon.lua action_set_net_settings command injection (medium 5.1)
- [CVE-2026-53389](https://insights.sbomify.com/CVE-2026-53389/): net/tcp-ao: fix use-after-free of key in del_async path (high 7.8)
- [CVE-2026-53388](https://insights.sbomify.com/CVE-2026-53388/): fuse: re-lock request before replacing page cache folio (high 7.8)
- [CVE-2026-53387](https://insights.sbomify.com/CVE-2026-53387/): iio: light: veml6075: add bounds check to veml6075_it_ms index (high 7.1)
- [CVE-2026-53386](https://insights.sbomify.com/CVE-2026-53386/): iio: adc: ti-ads1298: add bounds check to pga_settings index (high 7.8)
- [CVE-2026-53385](https://insights.sbomify.com/CVE-2026-53385/): vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (medium 5.5)
- [CVE-2026-53384](https://insights.sbomify.com/CVE-2026-53384/): serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (critical 9.8)
- [CVE-2026-53383](https://insights.sbomify.com/CVE-2026-53383/): ksmbd: reject non-VALID session in compound request branch (high 7.5)
- [CVE-2026-53382](https://insights.sbomify.com/CVE-2026-53382/): media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (medium 5.5)
- [CVE-2026-53381](https://insights.sbomify.com/CVE-2026-53381/): virtiofs: fix UAF on submount umount (high 7.8)
- [CVE-2026-53380](https://insights.sbomify.com/CVE-2026-53380/): media: rzv2h-ivc: Fix concurrent buffer list access (high 7.8)
- [CVE-2026-5338](https://insights.sbomify.com/CVE-2026-5338/): Tenda G103 Setting system.lua action_set_system_settings command injection (medium 5.1)
- [CVE-2026-53379](https://insights.sbomify.com/CVE-2026-53379/): media: i2c: ov8856: free control handler on error in ov8856_init_controls() (medium 5.5)
- [CVE-2026-53378](https://insights.sbomify.com/CVE-2026-53378/): drm/colorop: Fix blob property reference tracking in state lifecycle (medium 5.5)
- [CVE-2026-53377](https://insights.sbomify.com/CVE-2026-53377/): drm/msm: always recover the gpu (medium 5.5)
- [CVE-2026-53376](https://insights.sbomify.com/CVE-2026-53376/): drm/amdkfd: Add upper bound check for num_of_nodes (medium 5.5)
- [CVE-2026-53375](https://insights.sbomify.com/CVE-2026-53375/): drm/amdgpu/vce: Prevent partial address patches (high 8.8)
- [CVE-2026-53374](https://insights.sbomify.com/CVE-2026-53374/): drm/amdgpu: zero-initialize GART table on allocation (high 8.8)
- [CVE-2026-53373](https://insights.sbomify.com/CVE-2026-53373/): mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap() (high 7.8)
- [CVE-2026-53372](https://insights.sbomify.com/CVE-2026-53372/): iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (medium 5.5)
- [CVE-2026-53371](https://insights.sbomify.com/CVE-2026-53371/): RDMA/ionic: bound node_desc sysfs read with %.64s (medium 5.5)
- [CVE-2026-53370](https://insights.sbomify.com/CVE-2026-53370/): perf/x86/intel: Improve validation and configuration of ACR masks (medium 5.5)
- [CVE-2026-5337](https://insights.sbomify.com/CVE-2026-5337/): Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDOR (medium 6.5)
- [CVE-2026-53369](https://insights.sbomify.com/CVE-2026-53369/): udf: reject descriptors with oversized CRC length (high 8.4)
- [CVE-2026-53368](https://insights.sbomify.com/CVE-2026-53368/): f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage (high 7.1)
- [CVE-2026-53367](https://insights.sbomify.com/CVE-2026-53367/): selinux: fix avdcache auditing (medium 5.5)
- [CVE-2026-53366](https://insights.sbomify.com/CVE-2026-53366/): ipv4: account for fraggap on the paged allocation path (high 7.8)
- [CVE-2026-53365](https://insights.sbomify.com/CVE-2026-53365/): vsock/virtio: fix zerocopy completion for multi-skb sends (high 7.8)
- [CVE-2026-53364](https://insights.sbomify.com/CVE-2026-53364/): Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (medium 5.5)
- [CVE-2026-53363](https://insights.sbomify.com/CVE-2026-53363/): xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() (critical 9.8)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)
- [CVE-2026-53361](https://insights.sbomify.com/CVE-2026-53361/): af_unix: Set gc_in_progress to true in unix_gc(). (high 7.1)
- [CVE-2026-53360](https://insights.sbomify.com/CVE-2026-53360/): KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (high 8.8)
- [CVE-2026-5336](https://insights.sbomify.com/CVE-2026-5336/): Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure (medium 6.8)
- [CVE-2026-53359](https://insights.sbomify.com/CVE-2026-53359/): KVM: x86: Fix shadow paging use-after-free due to unexpected role (high 8.8)
- [CVE-2026-53358](https://insights.sbomify.com/CVE-2026-53358/): Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (high 8.8)
- [CVE-2026-53357](https://insights.sbomify.com/CVE-2026-53357/): Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (high 8.0)
- [CVE-2026-53356](https://insights.sbomify.com/CVE-2026-53356/): drm/i915/gem: Fix phys BO pread/pwrite with offset (high 7.8)
- [CVE-2026-53355](https://insights.sbomify.com/CVE-2026-53355/): net: rds: clear i_sends on setup unwind (critical 9.8)
- [CVE-2026-53354](https://insights.sbomify.com/CVE-2026-53354/): arm64: errata: Mitigate TLBI errata on various Arm CPUs (high 8.8)
- [CVE-2026-53353](https://insights.sbomify.com/CVE-2026-53353/): hsr: Remove WARN_ONCE() in hsr_addr_is_self(). (medium 5.5)
- [CVE-2026-53352](https://insights.sbomify.com/CVE-2026-53352/): signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() (medium 4.7)
- [CVE-2026-53351](https://insights.sbomify.com/CVE-2026-53351/): riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI (medium 5.5)
- [CVE-2026-53350](https://insights.sbomify.com/CVE-2026-53350/): ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (medium 5.5)
- [CVE-2026-5335](https://insights.sbomify.com/CVE-2026-5335/): Magic Export & Import < 1.2.0 - Unauthenticated PII Disclosure (medium 5.3)
- [CVE-2026-53349](https://insights.sbomify.com/CVE-2026-53349/): netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (medium 5.5)
- [CVE-2026-53348](https://insights.sbomify.com/CVE-2026-53348/): ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (medium 5.5)
- [CVE-2026-53347](https://insights.sbomify.com/CVE-2026-53347/): drm/virtio: Fix driver removal with disabled KMS (medium 5.5)
- [CVE-2026-53346](https://insights.sbomify.com/CVE-2026-53346/): rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES (high 7.1)
- [CVE-2026-53345](https://insights.sbomify.com/CVE-2026-53345/): KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (medium 5.5)
- [CVE-2026-53344](https://insights.sbomify.com/CVE-2026-53344/): pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init (medium 5.5)
- [CVE-2026-53343](https://insights.sbomify.com/CVE-2026-53343/): ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow (medium 5.5)
- [CVE-2026-53342](https://insights.sbomify.com/CVE-2026-53342/): arm64: mm: call pagetable dtor when freeing hot-removed page tables (medium 5.5)
- [CVE-2026-53341](https://insights.sbomify.com/CVE-2026-53341/): fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (high 7.8)
- [CVE-2026-53340](https://insights.sbomify.com/CVE-2026-53340/): i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (medium 5.5)
- [CVE-2026-5334](https://insights.sbomify.com/CVE-2026-5334/): itsourcecode Online Enrollment System Parameter index.php sql injection (medium 6.9)
- [CVE-2026-53339](https://insights.sbomify.com/CVE-2026-53339/): i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (medium 5.5)
- [CVE-2026-53338](https://insights.sbomify.com/CVE-2026-53338/): net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() (medium 5.5)
- [CVE-2026-53337](https://insights.sbomify.com/CVE-2026-53337/): net: bonding: fix NULL pointer dereference in bond_do_ioctl() (medium 5.5)
- [CVE-2026-53336](https://insights.sbomify.com/CVE-2026-53336/): nvmem: layouts: onie-tlv: fix hang on unknown types (medium 5.5)
- [CVE-2026-53335](https://insights.sbomify.com/CVE-2026-53335/): mm/damon/lru_sort: handle ctx allocation failure (medium 5.5)
- [CVE-2026-53334](https://insights.sbomify.com/CVE-2026-53334/): mm/damon/reclaim: handle ctx allocation failure (medium 5.5)
- [CVE-2026-53333](https://insights.sbomify.com/CVE-2026-53333/): mm/mincore: handle non-swap entries before !CONFIG_SWAP guard (medium 5.5)
- [CVE-2026-53332](https://insights.sbomify.com/CVE-2026-53332/): slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (medium 5.5)
- [CVE-2026-53331](https://insights.sbomify.com/CVE-2026-53331/): slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock (medium 5.5)
- [CVE-2026-53330](https://insights.sbomify.com/CVE-2026-53330/): drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() (high 7.1)
- [CVE-2026-5333](https://insights.sbomify.com/CVE-2026-5333/): DefaultFuction Content-Management-System tools.php command injection (medium 6.9)
- [CVE-2026-53329](https://insights.sbomify.com/CVE-2026-53329/): drm/amd/display: Use krealloc_array() in dal_vector_reserve() (high 7.0)
- [CVE-2026-53328](https://insights.sbomify.com/CVE-2026-53328/): sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() (medium 5.5)
- [CVE-2026-53327](https://insights.sbomify.com/CVE-2026-53327/): debugobjects: Do not fill_pool() if pi_blocked_on (medium 5.5)
- [CVE-2026-53326](https://insights.sbomify.com/CVE-2026-53326/): debugobjects: Don't call fill_pool() in early boot hardirq context (medium 5.5)
- [CVE-2026-53325](https://insights.sbomify.com/CVE-2026-53325/): agp/amd64: Fix broken error propagation in agp_amd64_probe() (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/561/