Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 566 of 1013.
- CVE-2026-52957 libceph: Fix potential null-ptr-deref in decode_choose_args()
- CVE-2026-52956 libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
- CVE-2026-52955 libceph: Fix potential out-of-bounds access in crush_decode()
- CVE-2026-52954 libceph: handle rbtree insertion error in decode_choose_args()
- CVE-2026-52953 iommu/vt-d: Fix oops due to out of scope access
- CVE-2026-52952 iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
- CVE-2026-52951 drm/xe/dma-buf: handle empty bo and UAF races
- CVE-2026-52950 drm/xe/dma-buf: fix UAF with retry loop
- CVE-2026-5295 Stack Buffer Overflow in wolfSSL PKCS7 wc_PKCS7_DecryptOri() via Oversized OID
- CVE-2026-52949 drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
- CVE-2026-52948 i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
- CVE-2026-52947 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
- CVE-2026-52946 fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
- CVE-2026-52945 Revert "wireguard: device: enable threaded NAPI"
- CVE-2026-52944 ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
- CVE-2026-52943 net: skbuff: fix missing zerocopy reference in pskb_carve helpers
- CVE-2026-52942 netfilter: nf_log: validate MAC header was set before dumping it
- CVE-2026-52941 net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
- CVE-2026-52940 tun: zero the whole vnet header in tun_put_user()
- CVE-2026-5294 Missing authorization in GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content
- CVE-2026-52939 net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
- CVE-2026-52938 bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
- CVE-2026-52937 tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
- CVE-2026-52936 crypto: jitterentropy - replace long-held spinlock with mutex
- CVE-2026-52935 xfrm: espintcp: do not reuse an in-progress partial send
- CVE-2026-52934 batman-adv: tvlv: reject oversized TVLV packets
- CVE-2026-52933 io_uring/poll: fix signed comparison in io_poll_get_ownership()
- CVE-2026-52932 xfrm: ipcomp: Free destination pages on acomp errors
- CVE-2026-52931 batman-adv: tp_meter: avoid use of uninit sender vars
- CVE-2026-52930 ipc/shm: serialize orphan cleanup with shm_nattch updates
- CVE-2026-5293 診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter
- CVE-2026-52929 sctp: stream: fully roll back denied add-stream state
- CVE-2026-52928 af_unix: Reject SIOCATMARK on non-stream sockets
- CVE-2026-52927 netfilter: ebtables: fix OOB read in compat_mtw_from_user
- CVE-2026-52926 batman-adv: clear current gateway during teardown
- CVE-2026-52925 vrf: Fix a potential NPD when removing a port from a VRF
- CVE-2026-52924 sctp: purge outqueue on stale COOKIE-ECHO handling
- CVE-2026-52923 ipc: limit next_id allocation to the valid ID range
- CVE-2026-52922 batman-adv: dat: handle forward allocation error
- CVE-2026-52921 netfilter: ipset: stop hash:* range iteration at end
- CVE-2026-52920 netfilter: xt_policy: fix strict mode inbound policy matching
- CVE-2026-5292 Memory corruption in Chrome
- CVE-2026-52919 batman-adv: fix tp_meter counter underflow during shutdown
- CVE-2026-52918 Bluetooth: serialize accept_q access
- CVE-2026-52917 sctp: diag: reject stale associations in dump_one path
- CVE-2026-52916 batman-adv: frag: disallow unicast fragment in fragment
- CVE-2026-52915 netfilter: ip6t_hbh: reject oversized option lists
- CVE-2026-52914 batman-adv: fix fragment reassembly length accounting
- CVE-2026-52913 batman-adv: v: stop OGMv2 on disabled interface
- CVE-2026-52912 netfilter: nf_queue: hold bridge skb->dev while queued
- CVE-2026-52911 ksmbd: scope conn->binding slowpath to bound sessions only
- CVE-2026-52910 bpf: Free reuseport cBPF prog after RCU grace period.
- CVE-2026-5291 Information disclosure in Chrome
- CVE-2026-52909 ip6_vti: set netns_immutable on the fallback device.
- CVE-2026-52908 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
- CVE-2026-52907 media: rockchip: rkcif: fix off by one bugs
- CVE-2026-52906 9p: fix access mode flags being ORed instead of replaced
- CVE-2026-52905 mm/damon/core: disallow non-power of two min_region_sz on damon_start()
- CVE-2026-52904 drm/nouveau: fix nvkm_device leak on aperture removal failure
- CVE-2026-52903 YAML safe_load production fallback to unsafe_load enables RCE via deserialization
- CVE-2026-52902 Awxkit: path traversal via yaml !include directive
- CVE-2026-5290 Use after free in Chrome
- CVE-2026-52893 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
- CVE-2026-52892 Missing authorization in wekan
- CVE-2026-52891 Wekan: Shell Injection via Avatar Upload
- CVE-2026-52890 Wekan: Arbitrary file read and server DoS via attachment versions.original.path
- CVE-2026-5289 Use after free in Chrome
- CVE-2026-52889 Formie: Server-Side Template Injection in Formie Hidden field defaults
- CVE-2026-52888 NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
- CVE-2026-52887 NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
- CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass
- CVE-2026-52885 Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory
- CVE-2026-52884 Notepad++: CVE-2026-48800 Bypass
- CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
- CVE-2026-5288 Use after free in Chrome
- CVE-2026-52879 Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS
- CVE-2026-52878 Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain
- CVE-2026-52877 Streambert : Insecure Protocol Execution in open-external IPC Handler
- CVE-2026-52876 Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback
- CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler
- CVE-2026-52873 Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer
- CVE-2026-52872 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol
- CVE-2026-52870 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
- CVE-2026-5287 Use after free in Chrome
- CVE-2026-52869 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
- CVE-2026-52868 OFFIS DCMTK Toolkit Path Traversal
- CVE-2026-52866 Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing Authorization
- CVE-2026-52865 NGINX Ingress Controller vulnerability
- CVE-2026-52863 Memory corruption could lead to crash and denial of service
- CVE-2026-52860 Vim: Arbitrary Code Execution via Python Omni-Completion
- CVE-2026-5286 Use after free in Chrome
- CVE-2026-52859 Vim: Out-of-bounds Read in Terminal Screen Snapshot
- CVE-2026-52858 Vim: Arbitrary Code Execution via Python Omni-Completion
- CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
- CVE-2026-52856 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
- CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating
- CVE-2026-52854 mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function
- CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER
- CVE-2026-52852 Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle
- CVE-2026-52851 Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions