# Vulnerabilities published in 2026


- [CVE-2026-53233](https://insights.sbomify.com/CVE-2026-53233/): netdev: fix double-free in netdev_nl_bind_rx_doit() (high 7.8)
- [CVE-2026-53232](https://insights.sbomify.com/CVE-2026-53232/): net: phy: clean the sfp upstream if phy probing fails (high 8.8)
- [CVE-2026-53231](https://insights.sbomify.com/CVE-2026-53231/): net: phy: don't try to setup PHY-driven SFP cages when using genphy (medium 5.5)
- [CVE-2026-53230](https://insights.sbomify.com/CVE-2026-53230/): net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (high 8.7)
- [CVE-2026-5323](https://insights.sbomify.com/CVE-2026-5323/): priyankark a11y-mcp index.js A11yServer server-side request forgery (medium 4.8)
- [CVE-2026-53229](https://insights.sbomify.com/CVE-2026-53229/): net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (high 7.5)
- [CVE-2026-53228](https://insights.sbomify.com/CVE-2026-53228/): ipv6: sit: reload inner IPv6 header after GSO offloads (critical 9.8)
- [CVE-2026-53227](https://insights.sbomify.com/CVE-2026-53227/): net: openvswitch: fix possible kfree_skb of ERR_PTR (medium 5.5)
- [CVE-2026-53226](https://insights.sbomify.com/CVE-2026-53226/): gpio: rockchip: fix generic IRQ chip leak on remove (medium 5.5)
- [CVE-2026-53225](https://insights.sbomify.com/CVE-2026-53225/): sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (critical 9.1)
- [CVE-2026-53224](https://insights.sbomify.com/CVE-2026-53224/): sctp: validate embedded INIT chunk and address list lengths in cookie (critical 9.1)
- [CVE-2026-53223](https://insights.sbomify.com/CVE-2026-53223/): net: guard timestamp cmsgs to real error queue skbs (high 7.1)
- [CVE-2026-53222](https://insights.sbomify.com/CVE-2026-53222/): ptp: ocp: fix resource freeing order (medium 5.5)
- [CVE-2026-53221](https://insights.sbomify.com/CVE-2026-53221/): ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (critical 9.8)
- [CVE-2026-53220](https://insights.sbomify.com/CVE-2026-53220/): netfilter: revalidate bridge ports (medium 5.5)
- [CVE-2026-5322](https://insights.sbomify.com/CVE-2026-5322/): AlejandroArciniegas mcp-data-vis MCP server.js request sql injection (medium 6.9)
- [CVE-2026-53219](https://insights.sbomify.com/CVE-2026-53219/): netfilter: x_tables: avoid leaking percpu counter pointers (medium 5.5)
- [CVE-2026-53218](https://insights.sbomify.com/CVE-2026-53218/): netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (medium 5.5)
- [CVE-2026-53217](https://insights.sbomify.com/CVE-2026-53217/): net: mvpp2: sync RX data at the hardware packet offset (high 8.6)
- [CVE-2026-53216](https://insights.sbomify.com/CVE-2026-53216/): net: mvpp2: limit XDP frame size to the RX buffer (critical 9.8)
- [CVE-2026-53215](https://insights.sbomify.com/CVE-2026-53215/): net: mvpp2: refill RX buffers before XDP or skb use (critical 9.8)
- [CVE-2026-53214](https://insights.sbomify.com/CVE-2026-53214/): ipv6: Fix a potential NPD in cleanup_prefix_route() (medium 5.5)
- [CVE-2026-53213](https://insights.sbomify.com/CVE-2026-53213/): drm/vc4: fix krealloc() memory leak (medium 5.5)
- [CVE-2026-53212](https://insights.sbomify.com/CVE-2026-53212/): netfilter: nft_tunnel: fix use-after-free on object destroy (high 7.8)
- [CVE-2026-53211](https://insights.sbomify.com/CVE-2026-53211/): netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register (medium 5.5)
- [CVE-2026-53210](https://insights.sbomify.com/CVE-2026-53210/): tee: shm: fix shm leak in register_shm_helper() (medium 5.5)
- [CVE-2026-5321](https://insights.sbomify.com/CVE-2026-5321/): vanna-ai vanna FastAPI/Flask Server cross-domain policy (medium 5.3)
- [CVE-2026-53209](https://insights.sbomify.com/CVE-2026-53209/): Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (high 7.8)
- [CVE-2026-53208](https://insights.sbomify.com/CVE-2026-53208/): Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (medium 5.5)
- [CVE-2026-53207](https://insights.sbomify.com/CVE-2026-53207/): mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (medium 5.5)
- [CVE-2026-53206](https://insights.sbomify.com/CVE-2026-53206/): accel/ivpu: Add bounds check for firmware runtime memory (medium 5.5)
- [CVE-2026-53205](https://insights.sbomify.com/CVE-2026-53205/): accel/ivpu: Add bounds checks for firmware log indices (high 7.1)
- [CVE-2026-53204](https://insights.sbomify.com/CVE-2026-53204/): firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe (medium 5.5)
- [CVE-2026-53203](https://insights.sbomify.com/CVE-2026-53203/): accel/ivpu: Add buffer overflow check in MS get_info_ioctl (high 7.1)
- [CVE-2026-53202](https://insights.sbomify.com/CVE-2026-53202/): accel/ivpu: Fix signed integer truncation in IPC receive (high 7.8)
- [CVE-2026-53201](https://insights.sbomify.com/CVE-2026-53201/): Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" (high 7.8)
- [CVE-2026-53200](https://insights.sbomify.com/CVE-2026-53200/): KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX (high 8.8)
- [CVE-2026-5320](https://insights.sbomify.com/CVE-2026-5320/): vanna-ai vanna Chat API Endpoint v2 missing authentication (medium 6.9)
- [CVE-2026-53199](https://insights.sbomify.com/CVE-2026-53199/): hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (high 7.5)
- [CVE-2026-53198](https://insights.sbomify.com/CVE-2026-53198/): ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL (high 8.8)
- [CVE-2026-53197](https://insights.sbomify.com/CVE-2026-53197/): xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() (medium 5.5)
- [CVE-2026-53196](https://insights.sbomify.com/CVE-2026-53196/): USB: serial: io_ti: fix heap overflow in get_manuf_info() (medium 6.8)
- [CVE-2026-53195](https://insights.sbomify.com/CVE-2026-53195/): USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (high 7.8)
- [CVE-2026-53194](https://insights.sbomify.com/CVE-2026-53194/): USB: serial: kl5kusb105: fix bulk-out buffer overflow (high 7.8)
- [CVE-2026-53193](https://insights.sbomify.com/CVE-2026-53193/): ALSA: timer: Forcibly close timer instances at closing (high 7.8)
- [CVE-2026-53192](https://insights.sbomify.com/CVE-2026-53192/): ALSA: timer: Fix UAF at snd_timer_user_params() (high 7.8)
- [CVE-2026-53191](https://insights.sbomify.com/CVE-2026-53191/): io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (high 7.8)
- [CVE-2026-53190](https://insights.sbomify.com/CVE-2026-53190/): drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (medium 5.5)
- [CVE-2026-5319](https://insights.sbomify.com/CVE-2026-5319/): itsourcecode Payroll Management System navbar.php cross site scripting (medium 5.3)
- [CVE-2026-53189](https://insights.sbomify.com/CVE-2026-53189/): mm/huge_memory: update file PMD counter before folio_put() (high 7.8)
- [CVE-2026-53188](https://insights.sbomify.com/CVE-2026-53188/): RDMA/core: Validate the passed in fops for ib_get_ucaps() (high 8.8)
- [CVE-2026-53187](https://insights.sbomify.com/CVE-2026-53187/): RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc (high 7.1)
- [CVE-2026-53186](https://insights.sbomify.com/CVE-2026-53186/): RDMA/srp: bound SRP_RSP sense copy by the received length (critical 9.1)
- [CVE-2026-53185](https://insights.sbomify.com/CVE-2026-53185/): zram: fix use-after-free in zram_bvec_write_partial() (high 7.8)
- [CVE-2026-53184](https://insights.sbomify.com/CVE-2026-53184/): udp: clear skb->dev before running a sockmap verdict (high 7.5)
- [CVE-2026-53183](https://insights.sbomify.com/CVE-2026-53183/): mptcp: allow subflow rcv wnd to shrink (high 7.5)
- [CVE-2026-53182](https://insights.sbomify.com/CVE-2026-53182/): wifi: nl80211: reject oversized EMA RNR lists (high 7.8)
- [CVE-2026-53181](https://insights.sbomify.com/CVE-2026-53181/): vsock/vmci: fix sk_ack_backlog leak on failed handshake (medium 5.5)
- [CVE-2026-53180](https://insights.sbomify.com/CVE-2026-53180/): timers/migration: Fix livelock in tmigr_handle_remote_up() (high 7.5)
- [CVE-2026-5318](https://insights.sbomify.com/CVE-2026-5318/): LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write (medium 5.3)
- [CVE-2026-53179](https://insights.sbomify.com/CVE-2026-53179/): staging: rtl8723bs: fix buffer over-read in rtw_update_protection (high 7.1)
- [CVE-2026-53178](https://insights.sbomify.com/CVE-2026-53178/): staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (high 8.1)
- [CVE-2026-53177](https://insights.sbomify.com/CVE-2026-53177/): bnxt_en: Fix NULL pointer dereference (medium 5.5)
- [CVE-2026-53176](https://insights.sbomify.com/CVE-2026-53176/): IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (critical 9.8)
- [CVE-2026-53175](https://insights.sbomify.com/CVE-2026-53175/): inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (critical 9.8)
- [CVE-2026-53174](https://insights.sbomify.com/CVE-2026-53174/): ovl: keep err zero after successful ovl_cache_get() (high 7.8)
- [CVE-2026-53173](https://insights.sbomify.com/CVE-2026-53173/): accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() (high 7.8)
- [CVE-2026-53172](https://insights.sbomify.com/CVE-2026-53172/): accel/ethosu: fix IFM region index out-of-bounds in command stream parser (high 7.8)
- [CVE-2026-53171](https://insights.sbomify.com/CVE-2026-53171/): accel/ethosu: fix arithmetic issues in dma_length() (high 8.8)
- [CVE-2026-53170](https://insights.sbomify.com/CVE-2026-53170/): accel/ethosu: reject DMA commands with uninitialized length (high 8.8)
- [CVE-2026-5317](https://insights.sbomify.com/CVE-2026-5317/): Nothings stb stb_vorbis.c start_decoder out-of-bounds write (medium 5.3)
- [CVE-2026-53169](https://insights.sbomify.com/CVE-2026-53169/): accel/ethosu: reject NPU_OP_RESIZE commands from userspace (medium 5.5)
- [CVE-2026-53168](https://insights.sbomify.com/CVE-2026-53168/): fuse: reject fuse_notify() pagecache ops on directories (medium 5.5)
- [CVE-2026-53167](https://insights.sbomify.com/CVE-2026-53167/): fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (medium 5.5)
- [CVE-2026-53165](https://insights.sbomify.com/CVE-2026-53165/): iomap: avoid potential null folio->mapping deref during error reporting (high 7.5)
- [CVE-2026-53164](https://insights.sbomify.com/CVE-2026-53164/): iommu/dma: Do not try to iommu_map a 0 length region in swiotlb (medium 5.5)
- [CVE-2026-53163](https://insights.sbomify.com/CVE-2026-53163/): locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (medium 5.5)
- [CVE-2026-53162](https://insights.sbomify.com/CVE-2026-53162/): memcg: use round-robin victim selection in refill_stock (high 7.8)
- [CVE-2026-53161](https://insights.sbomify.com/CVE-2026-53161/): misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (high 7.8)
- [CVE-2026-53160](https://insights.sbomify.com/CVE-2026-53160/): misc: fastrpc: fix use-after-free race in fastrpc_map_create (high 7.8)
- [CVE-2026-5316](https://insights.sbomify.com/CVE-2026-5316/): Nothings stb stb_vorbis.c setup_free allocation of resources (medium 5.3)
- [CVE-2026-53159](https://insights.sbomify.com/CVE-2026-53159/): misc: fastrpc: fix DMA address corruption due to find_vma misuse (high 8.8)
- [CVE-2026-53158](https://insights.sbomify.com/CVE-2026-53158/): misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (medium 5.5)
- [CVE-2026-53157](https://insights.sbomify.com/CVE-2026-53157/): net: phonet: free phonet_device after RCU grace period (high 7.8)
- [CVE-2026-53156](https://insights.sbomify.com/CVE-2026-53156/): nvmem: core: fix use-after-free bugs in error paths (high 7.8)
- [CVE-2026-53155](https://insights.sbomify.com/CVE-2026-53155/): mm/huge_memory: use correct flags for device private PMD entry (medium 5.5)
- [CVE-2026-53154](https://insights.sbomify.com/CVE-2026-53154/): mm/hugetlb: restore reservation on error in hugetlb folio copy paths (medium 5.5)
- [CVE-2026-53153](https://insights.sbomify.com/CVE-2026-53153/): mm/list_lru: drain before clearing xarray entry on reparent (high 7.8)
- [CVE-2026-53152](https://insights.sbomify.com/CVE-2026-53152/): mmc: dw_mmc-rockchip: Add missing private data for very old controllers (medium 5.5)
- [CVE-2026-53151](https://insights.sbomify.com/CVE-2026-53151/): rxrpc: Fix the ACK parser to extract the SACK table for parsing (critical 9.8)
- [CVE-2026-53150](https://insights.sbomify.com/CVE-2026-53150/): thunderbolt: Reject zero-length property entries in validator (medium 5.5)
- [CVE-2026-5315](https://insights.sbomify.com/CVE-2026-5315/): Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds (medium 5.3)
- [CVE-2026-53149](https://insights.sbomify.com/CVE-2026-53149/): thunderbolt: Bound root directory content to block size (high 7.1)
- [CVE-2026-53148](https://insights.sbomify.com/CVE-2026-53148/): thunderbolt: Clamp XDomain response data copy to allocation size (high 7.8)
- [CVE-2026-53147](https://insights.sbomify.com/CVE-2026-53147/): thunderbolt: Validate XDomain request packet size before type cast (high 8.1)
- [CVE-2026-53146](https://insights.sbomify.com/CVE-2026-53146/): thunderbolt: Limit XDomain response copy to actual frame size (high 7.1)
- [CVE-2026-53145](https://insights.sbomify.com/CVE-2026-53145/): drm/gem: Try to fix change_handle ioctl, attempt 4 (high 7.8)
- [CVE-2026-53144](https://insights.sbomify.com/CVE-2026-53144/): drm/amdkfd: fix NULL dereference in get_queue_ids() (medium 5.5)
- [CVE-2026-53143](https://insights.sbomify.com/CVE-2026-53143/): drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (high 7.8)
- [CVE-2026-53142](https://insights.sbomify.com/CVE-2026-53142/): drm/xe/display: fix oops in suspend/shutdown without display (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/563/