# Vulnerabilities published in 2026


- [CVE-2026-52957](https://insights.sbomify.com/CVE-2026-52957/): libceph: Fix potential null-ptr-deref in decode_choose_args() (high 7.5)
- [CVE-2026-52956](https://insights.sbomify.com/CVE-2026-52956/): libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (high 7.5)
- [CVE-2026-52955](https://insights.sbomify.com/CVE-2026-52955/): libceph: Fix potential out-of-bounds access in crush_decode() (critical 9.8)
- [CVE-2026-52954](https://insights.sbomify.com/CVE-2026-52954/): libceph: handle rbtree insertion error in decode_choose_args() (high 7.5)
- [CVE-2026-52953](https://insights.sbomify.com/CVE-2026-52953/): iommu/vt-d: Fix oops due to out of scope access (high 7.1)
- [CVE-2026-52952](https://insights.sbomify.com/CVE-2026-52952/): iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset (high 8.8)
- [CVE-2026-52951](https://insights.sbomify.com/CVE-2026-52951/): drm/xe/dma-buf: handle empty bo and UAF races (high 7.8)
- [CVE-2026-52950](https://insights.sbomify.com/CVE-2026-52950/): drm/xe/dma-buf: fix UAF with retry loop (high 7.8)
- [CVE-2026-5295](https://insights.sbomify.com/CVE-2026-5295/): Stack Buffer Overflow in wolfSSL PKCS7 wc_PKCS7_DecryptOri() via Oversized OID (medium 5.9)
- [CVE-2026-52949](https://insights.sbomify.com/CVE-2026-52949/): drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure (medium 5.5)
- [CVE-2026-52948](https://insights.sbomify.com/CVE-2026-52948/): i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (medium 5.5)
- [CVE-2026-52947](https://insights.sbomify.com/CVE-2026-52947/): net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (high 7.8)
- [CVE-2026-52946](https://insights.sbomify.com/CVE-2026-52946/): fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (high 7.5)
- [CVE-2026-52945](https://insights.sbomify.com/CVE-2026-52945/): Revert "wireguard: device: enable threaded NAPI" (high 7.5)
- [CVE-2026-52944](https://insights.sbomify.com/CVE-2026-52944/): ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE (medium 5.5)
- [CVE-2026-52943](https://insights.sbomify.com/CVE-2026-52943/): net: skbuff: fix missing zerocopy reference in pskb_carve helpers (high 7.8)
- [CVE-2026-52942](https://insights.sbomify.com/CVE-2026-52942/): netfilter: nf_log: validate MAC header was set before dumping it (high 7.1)
- [CVE-2026-52941](https://insights.sbomify.com/CVE-2026-52941/): net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint (medium 5.5)
- [CVE-2026-52940](https://insights.sbomify.com/CVE-2026-52940/): tun: zero the whole vnet header in tun_put_user() (medium 5.5)
- [CVE-2026-5294](https://insights.sbomify.com/CVE-2026-5294/): Missing authorization in GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content (critical 9.8)
- [CVE-2026-52939](https://insights.sbomify.com/CVE-2026-52939/): net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (medium 5.5)
- [CVE-2026-52938](https://insights.sbomify.com/CVE-2026-52938/): bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths (medium 5.5)
- [CVE-2026-52937](https://insights.sbomify.com/CVE-2026-52937/): tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (medium 5.5)
- [CVE-2026-52936](https://insights.sbomify.com/CVE-2026-52936/): crypto: jitterentropy - replace long-held spinlock with mutex (medium 5.5)
- [CVE-2026-52935](https://insights.sbomify.com/CVE-2026-52935/): xfrm: espintcp: do not reuse an in-progress partial send (high 7.8)
- [CVE-2026-52934](https://insights.sbomify.com/CVE-2026-52934/): batman-adv: tvlv: reject oversized TVLV packets (high 8.8)
- [CVE-2026-52933](https://insights.sbomify.com/CVE-2026-52933/): io_uring/poll: fix signed comparison in io_poll_get_ownership() (high 7.8)
- [CVE-2026-52932](https://insights.sbomify.com/CVE-2026-52932/): xfrm: ipcomp: Free destination pages on acomp errors (high 7.5)
- [CVE-2026-52931](https://insights.sbomify.com/CVE-2026-52931/): batman-adv: tp_meter: avoid use of uninit sender vars (critical 9.8)
- [CVE-2026-52930](https://insights.sbomify.com/CVE-2026-52930/): ipc/shm: serialize orphan cleanup with shm_nattch updates (medium 5.5)
- [CVE-2026-5293](https://insights.sbomify.com/CVE-2026-5293/): 診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter (medium 6.4)
- [CVE-2026-52929](https://insights.sbomify.com/CVE-2026-52929/): sctp: stream: fully roll back denied add-stream state (high 7.5)
- [CVE-2026-52928](https://insights.sbomify.com/CVE-2026-52928/): af_unix: Reject SIOCATMARK on non-stream sockets (medium 5.5)
- [CVE-2026-52927](https://insights.sbomify.com/CVE-2026-52927/): netfilter: ebtables: fix OOB read in compat_mtw_from_user (high 7.8)
- [CVE-2026-52926](https://insights.sbomify.com/CVE-2026-52926/): batman-adv: clear current gateway during teardown (medium 5.5)
- [CVE-2026-52925](https://insights.sbomify.com/CVE-2026-52925/): vrf: Fix a potential NPD when removing a port from a VRF (medium 5.5)
- [CVE-2026-52924](https://insights.sbomify.com/CVE-2026-52924/): sctp: purge outqueue on stale COOKIE-ECHO handling (critical 9.8)
- [CVE-2026-52923](https://insights.sbomify.com/CVE-2026-52923/): ipc: limit next_id allocation to the valid ID range (high 7.8)
- [CVE-2026-52922](https://insights.sbomify.com/CVE-2026-52922/): batman-adv: dat: handle forward allocation error (high 7.5)
- [CVE-2026-52921](https://insights.sbomify.com/CVE-2026-52921/): netfilter: ipset: stop hash:* range iteration at end (medium 5.5)
- [CVE-2026-52920](https://insights.sbomify.com/CVE-2026-52920/): netfilter: xt_policy: fix strict mode inbound policy matching (high 8.3)
- [CVE-2026-5292](https://insights.sbomify.com/CVE-2026-5292/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-52919](https://insights.sbomify.com/CVE-2026-52919/): batman-adv: fix tp_meter counter underflow during shutdown (high 7.8)
- [CVE-2026-52918](https://insights.sbomify.com/CVE-2026-52918/): Bluetooth: serialize accept_q access (high 8.8)
- [CVE-2026-52917](https://insights.sbomify.com/CVE-2026-52917/): sctp: diag: reject stale associations in dump_one path (high 7.1)
- [CVE-2026-52916](https://insights.sbomify.com/CVE-2026-52916/): batman-adv: frag: disallow unicast fragment in fragment (medium 5.5)
- [CVE-2026-52915](https://insights.sbomify.com/CVE-2026-52915/): netfilter: ip6t_hbh: reject oversized option lists (high 7.1)
- [CVE-2026-52914](https://insights.sbomify.com/CVE-2026-52914/): batman-adv: fix fragment reassembly length accounting (critical 9.8)
- [CVE-2026-52913](https://insights.sbomify.com/CVE-2026-52913/): batman-adv: v: stop OGMv2 on disabled interface (medium 5.5)
- [CVE-2026-52912](https://insights.sbomify.com/CVE-2026-52912/): netfilter: nf_queue: hold bridge skb->dev while queued (high 7.8)
- [CVE-2026-52911](https://insights.sbomify.com/CVE-2026-52911/): ksmbd: scope conn->binding slowpath to bound sessions only (high 8.8)
- [CVE-2026-52910](https://insights.sbomify.com/CVE-2026-52910/): bpf: Free reuseport cBPF prog after RCU grace period. (high 7.8)
- [CVE-2026-5291](https://insights.sbomify.com/CVE-2026-5291/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-52909](https://insights.sbomify.com/CVE-2026-52909/): ip6_vti: set netns_immutable on the fallback device. (high 7.8)
- [CVE-2026-52908](https://insights.sbomify.com/CVE-2026-52908/): RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (high 7.8)
- [CVE-2026-52907](https://insights.sbomify.com/CVE-2026-52907/): media: rockchip: rkcif: fix off by one bugs (high 7.8)
- [CVE-2026-52906](https://insights.sbomify.com/CVE-2026-52906/): 9p: fix access mode flags being ORed instead of replaced (high 7.7)
- [CVE-2026-52905](https://insights.sbomify.com/CVE-2026-52905/): mm/damon/core: disallow non-power of two min_region_sz on damon_start() (medium 5.5)
- [CVE-2026-52904](https://insights.sbomify.com/CVE-2026-52904/): drm/nouveau: fix nvkm_device leak on aperture removal failure (medium 5.5)
- [CVE-2026-52903](https://insights.sbomify.com/CVE-2026-52903/): YAML safe_load production fallback to unsafe_load enables RCE via deserialization (high 8.8)
- [CVE-2026-52902](https://insights.sbomify.com/CVE-2026-52902/): Awxkit: path traversal via yaml !include directive (medium 4.7)
- [CVE-2026-5290](https://insights.sbomify.com/CVE-2026-5290/): Use after free in Chrome (critical 9.6)
- [CVE-2026-52893](https://insights.sbomify.com/CVE-2026-52893/): Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook (critical 9.2)
- [CVE-2026-52892](https://insights.sbomify.com/CVE-2026-52892/): Missing authorization in wekan (medium 6.5)
- [CVE-2026-52891](https://insights.sbomify.com/CVE-2026-52891/): Wekan: Shell Injection via Avatar Upload (critical 9.9)
- [CVE-2026-52890](https://insights.sbomify.com/CVE-2026-52890/): Wekan: Arbitrary file read and server DoS via attachment versions.original.path (high 7.1)
- [CVE-2026-5289](https://insights.sbomify.com/CVE-2026-5289/): Use after free in Chrome (critical 9.6)
- [CVE-2026-52889](https://insights.sbomify.com/CVE-2026-52889/): Formie: Server-Side Template Injection in Formie Hidden field defaults (critical 9.8)
- [CVE-2026-52888](https://insights.sbomify.com/CVE-2026-52888/): NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass (medium 6.8)
- [CVE-2026-52887](https://insights.sbomify.com/CVE-2026-52887/): NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE (critical 10.0)
- [CVE-2026-52886](https://insights.sbomify.com/CVE-2026-52886/): Notepad++: session.xml backupFilePath starts_with Bypass (medium 5.1)
- [CVE-2026-52885](https://insights.sbomify.com/CVE-2026-52885/): Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory (high 7.5)
- [CVE-2026-52884](https://insights.sbomify.com/CVE-2026-52884/): Notepad++: CVE-2026-48800 Bypass (high 7.8)
- [CVE-2026-52880](https://insights.sbomify.com/CVE-2026-52880/): Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run (high 7.5)
- [CVE-2026-5288](https://insights.sbomify.com/CVE-2026-5288/): Use after free in Chrome (critical 9.6)
- [CVE-2026-52879](https://insights.sbomify.com/CVE-2026-52879/): Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS (high 7.5)
- [CVE-2026-52878](https://insights.sbomify.com/CVE-2026-52878/): Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain (high 7.5)
- [CVE-2026-52877](https://insights.sbomify.com/CVE-2026-52877/): Streambert : Insecure Protocol Execution in open-external IPC Handler (high 8.3)
- [CVE-2026-52876](https://insights.sbomify.com/CVE-2026-52876/): Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback (high 8.8)
- [CVE-2026-52875](https://insights.sbomify.com/CVE-2026-52875/): Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler (high 8.4)
- [CVE-2026-52873](https://insights.sbomify.com/CVE-2026-52873/): Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer (medium 6.9)
- [CVE-2026-52872](https://insights.sbomify.com/CVE-2026-52872/): Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol (high 8.8)
- [CVE-2026-52870](https://insights.sbomify.com/CVE-2026-52870/): MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks (high 7.6)
- [CVE-2026-5287](https://insights.sbomify.com/CVE-2026-5287/): Use after free in Chrome (high 8.8)
- [CVE-2026-52869](https://insights.sbomify.com/CVE-2026-52869/): MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal (high 7.1)
- [CVE-2026-52868](https://insights.sbomify.com/CVE-2026-52868/): OFFIS DCMTK Toolkit Path Traversal (high 8.8)
- [CVE-2026-52866](https://insights.sbomify.com/CVE-2026-52866/): Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing Authorization (high 7.1)
- [CVE-2026-52865](https://insights.sbomify.com/CVE-2026-52865/): NGINX Ingress Controller vulnerability (high 7.1)
- [CVE-2026-52863](https://insights.sbomify.com/CVE-2026-52863/): Memory corruption could lead to crash and denial of service (medium 5.9)
- [CVE-2026-52860](https://insights.sbomify.com/CVE-2026-52860/): Vim: Arbitrary Code Execution via Python Omni-Completion (high 7.5)
- [CVE-2026-5286](https://insights.sbomify.com/CVE-2026-5286/): Use after free in Chrome (high 8.8)
- [CVE-2026-52859](https://insights.sbomify.com/CVE-2026-52859/): Vim: Out-of-bounds Read in Terminal Screen Snapshot (medium 6.9)
- [CVE-2026-52858](https://insights.sbomify.com/CVE-2026-52858/): Vim: Arbitrary Code Execution via Python Omni-Completion (high 7.3)
- [CVE-2026-52857](https://insights.sbomify.com/CVE-2026-52857/): Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM (medium 5.5)
- [CVE-2026-52856](https://insights.sbomify.com/CVE-2026-52856/): Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service (high 7.5)
- [CVE-2026-52855](https://insights.sbomify.com/CVE-2026-52855/): Wings exposes node configuration secrets through egg configuration-file templating (critical 9.9)
- [CVE-2026-52854](https://insights.sbomify.com/CVE-2026-52854/): mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function (high 8.6)
- [CVE-2026-52853](https://insights.sbomify.com/CVE-2026-52853/): Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER (medium 5.2)
- [CVE-2026-52852](https://insights.sbomify.com/CVE-2026-52852/): Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle (medium 6.5)
- [CVE-2026-52851](https://insights.sbomify.com/CVE-2026-52851/): Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/566/