Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 563 of 1013.
- CVE-2026-53233 netdev: fix double-free in netdev_nl_bind_rx_doit()
- CVE-2026-53232 net: phy: clean the sfp upstream if phy probing fails
- CVE-2026-53231 net: phy: don't try to setup PHY-driven SFP cages when using genphy
- CVE-2026-53230 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
- CVE-2026-5323 priyankark a11y-mcp index.js A11yServer server-side request forgery
- CVE-2026-53229 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
- CVE-2026-53228 ipv6: sit: reload inner IPv6 header after GSO offloads
- CVE-2026-53227 net: openvswitch: fix possible kfree_skb of ERR_PTR
- CVE-2026-53226 gpio: rockchip: fix generic IRQ chip leak on remove
- CVE-2026-53225 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
- CVE-2026-53224 sctp: validate embedded INIT chunk and address list lengths in cookie
- CVE-2026-53223 net: guard timestamp cmsgs to real error queue skbs
- CVE-2026-53222 ptp: ocp: fix resource freeing order
- CVE-2026-53221 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
- CVE-2026-53220 netfilter: revalidate bridge ports
- CVE-2026-5322 AlejandroArciniegas mcp-data-vis MCP server.js request sql injection
- CVE-2026-53219 netfilter: x_tables: avoid leaking percpu counter pointers
- CVE-2026-53218 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
- CVE-2026-53217 net: mvpp2: sync RX data at the hardware packet offset
- CVE-2026-53216 net: mvpp2: limit XDP frame size to the RX buffer
- CVE-2026-53215 net: mvpp2: refill RX buffers before XDP or skb use
- CVE-2026-53214 ipv6: Fix a potential NPD in cleanup_prefix_route()
- CVE-2026-53213 drm/vc4: fix krealloc() memory leak
- CVE-2026-53212 netfilter: nft_tunnel: fix use-after-free on object destroy
- CVE-2026-53211 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
- CVE-2026-53210 tee: shm: fix shm leak in register_shm_helper()
- CVE-2026-5321 vanna-ai vanna FastAPI/Flask Server cross-domain policy
- CVE-2026-53209 Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
- CVE-2026-53208 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
- CVE-2026-53207 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
- CVE-2026-53206 accel/ivpu: Add bounds check for firmware runtime memory
- CVE-2026-53205 accel/ivpu: Add bounds checks for firmware log indices
- CVE-2026-53204 firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe
- CVE-2026-53203 accel/ivpu: Add buffer overflow check in MS get_info_ioctl
- CVE-2026-53202 accel/ivpu: Fix signed integer truncation in IPC receive
- CVE-2026-53201 Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend"
- CVE-2026-53200 KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
- CVE-2026-5320 vanna-ai vanna Chat API Endpoint v2 missing authentication
- CVE-2026-53199 hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
- CVE-2026-53198 ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
- CVE-2026-53197 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
- CVE-2026-53196 USB: serial: io_ti: fix heap overflow in get_manuf_info()
- CVE-2026-53195 USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
- CVE-2026-53194 USB: serial: kl5kusb105: fix bulk-out buffer overflow
- CVE-2026-53193 ALSA: timer: Forcibly close timer instances at closing
- CVE-2026-53192 ALSA: timer: Fix UAF at snd_timer_user_params()
- CVE-2026-53191 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
- CVE-2026-53190 drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
- CVE-2026-5319 itsourcecode Payroll Management System navbar.php cross site scripting
- CVE-2026-53189 mm/huge_memory: update file PMD counter before folio_put()
- CVE-2026-53188 RDMA/core: Validate the passed in fops for ib_get_ucaps()
- CVE-2026-53187 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
- CVE-2026-53186 RDMA/srp: bound SRP_RSP sense copy by the received length
- CVE-2026-53185 zram: fix use-after-free in zram_bvec_write_partial()
- CVE-2026-53184 udp: clear skb->dev before running a sockmap verdict
- CVE-2026-53183 mptcp: allow subflow rcv wnd to shrink
- CVE-2026-53182 wifi: nl80211: reject oversized EMA RNR lists
- CVE-2026-53181 vsock/vmci: fix sk_ack_backlog leak on failed handshake
- CVE-2026-53180 timers/migration: Fix livelock in tmigr_handle_remote_up()
- CVE-2026-5318 LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write
- CVE-2026-53179 staging: rtl8723bs: fix buffer over-read in rtw_update_protection
- CVE-2026-53178 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
- CVE-2026-53177 bnxt_en: Fix NULL pointer dereference
- CVE-2026-53176 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
- CVE-2026-53175 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
- CVE-2026-53174 ovl: keep err zero after successful ovl_cache_get()
- CVE-2026-53173 accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()
- CVE-2026-53172 accel/ethosu: fix IFM region index out-of-bounds in command stream parser
- CVE-2026-53171 accel/ethosu: fix arithmetic issues in dma_length()
- CVE-2026-53170 accel/ethosu: reject DMA commands with uninitialized length
- CVE-2026-5317 Nothings stb stb_vorbis.c start_decoder out-of-bounds write
- CVE-2026-53169 accel/ethosu: reject NPU_OP_RESIZE commands from userspace
- CVE-2026-53168 fuse: reject fuse_notify() pagecache ops on directories
- CVE-2026-53167 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
- CVE-2026-53165 iomap: avoid potential null folio->mapping deref during error reporting
- CVE-2026-53164 iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
- CVE-2026-53163 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
- CVE-2026-53162 memcg: use round-robin victim selection in refill_stock
- CVE-2026-53161 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
- CVE-2026-53160 misc: fastrpc: fix use-after-free race in fastrpc_map_create
- CVE-2026-5316 Nothings stb stb_vorbis.c setup_free allocation of resources
- CVE-2026-53159 misc: fastrpc: fix DMA address corruption due to find_vma misuse
- CVE-2026-53158 misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
- CVE-2026-53157 net: phonet: free phonet_device after RCU grace period
- CVE-2026-53156 nvmem: core: fix use-after-free bugs in error paths
- CVE-2026-53155 mm/huge_memory: use correct flags for device private PMD entry
- CVE-2026-53154 mm/hugetlb: restore reservation on error in hugetlb folio copy paths
- CVE-2026-53153 mm/list_lru: drain before clearing xarray entry on reparent
- CVE-2026-53152 mmc: dw_mmc-rockchip: Add missing private data for very old controllers
- CVE-2026-53151 rxrpc: Fix the ACK parser to extract the SACK table for parsing
- CVE-2026-53150 thunderbolt: Reject zero-length property entries in validator
- CVE-2026-5315 Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds
- CVE-2026-53149 thunderbolt: Bound root directory content to block size
- CVE-2026-53148 thunderbolt: Clamp XDomain response data copy to allocation size
- CVE-2026-53147 thunderbolt: Validate XDomain request packet size before type cast
- CVE-2026-53146 thunderbolt: Limit XDomain response copy to actual frame size
- CVE-2026-53145 drm/gem: Try to fix change_handle ioctl, attempt 4
- CVE-2026-53144 drm/amdkfd: fix NULL dereference in get_queue_ids()
- CVE-2026-53143 drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
- CVE-2026-53142 drm/xe/display: fix oops in suspend/shutdown without display