Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 613 of 1013.
- CVE-2026-46341 Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
- CVE-2026-46340 Netty: SCTP reassembly nests buffers without bound
- CVE-2026-4634 Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
- CVE-2026-46339 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
- CVE-2026-46338 Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
- CVE-2026-46337 WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
- CVE-2026-46336 Manyfold: Authenticated Path Traversal via File Rename
- CVE-2026-46334 OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning
- CVE-2026-46333 ptrace: slightly saner 'get_dumpable()' logic
- CVE-2026-46332 greybus: gb-beagleplay: bound bootloader receive buffering
- CVE-2026-46331 net/sched: fix pedit partial COW leading to page cache corruption
- CVE-2026-46330 Revert "net/smc: Introduce TCP ULP support"
- CVE-2026-4633 Keycloak: keycloak: user enumeration via differential error messages
- CVE-2026-46329 erofs: handle end of filesystem properly for file-backed mounts
- CVE-2026-46328 apparmor: fix rlimit for posix cpu timers
- CVE-2026-46327 dm: fix unlocked test for dm_suspended_md
- CVE-2026-46326 iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
- CVE-2026-46325 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
- CVE-2026-46324 netfilter: nf_tables: use list_del_rcu for netlink hooks
- CVE-2026-46323 net: gro: don't merge zcopy skbs
- CVE-2026-46322 tun: free page on build_skb failure in tun_xdp_one()
- CVE-2026-46321 tun: free page on short-frame rejection in tun_xdp_one()
- CVE-2026-46320 tap: free page on error paths in tap_get_user_xdp()
- CVE-2026-4632 itsourcecode Online Enrollment System Parameter index.php sql injection
- CVE-2026-46319 net/sched: act_ct: Only release RCU read lock after ct_ft
- CVE-2026-46318 Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
- CVE-2026-46317 KVM: arm64: Reassign nested_mmus array behind mmu_lock
- CVE-2026-46316 KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
- CVE-2026-46315 io_uring/waitid: clear waitid info before copying it to userspace
- CVE-2026-46314 drm/v3d: Reject empty multisync extension to prevent infinite loop
- CVE-2026-46313 media: intel/ipu6: fix error pointer dereference
- CVE-2026-46312 media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
- CVE-2026-46311 drm/amdgpu/userq: fix access to stale wptr mapping
- CVE-2026-46310 media: renesas: vsp1: Fix NULL pointer deref on module unload
- CVE-2026-4631 Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
- CVE-2026-46309 drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
- CVE-2026-46308 pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
- CVE-2026-46307 wifi: ath5k: do not access array OOB
- CVE-2026-46306 flow_dissector: do not dissect PPPoE PFC frames
- CVE-2026-46305 staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
- CVE-2026-46304 nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
- CVE-2026-46303 isofs: validate Rock Ridge CE continuation extent against volume size
- CVE-2026-46302 selinux: allow multiple opens of /sys/fs/selinux/policy
- CVE-2026-46301 spi: topcliff-pch: fix use-after-free on unbind
- CVE-2026-46300 Linux Kernel Missing Initialization of a Variable
- CVE-2026-4630 Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference
- CVE-2026-46299 hfsplus: fix held lock freed on hfsplus_fill_super()
- CVE-2026-46298 pseries/papr-hvpipe: Fix race with interrupt handler
- CVE-2026-46297 net: libwx: use request_irq for VF misc interrupt
- CVE-2026-46296 spi: s3c64xx: fix NULL-deref on driver unbind
- CVE-2026-46295 KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty
- CVE-2026-46294 dm: fix a buffer overflow in ioctl processing
- CVE-2026-46293 clk: microchip: mpfs-ccc: fix out of bounds access during output registration
- CVE-2026-46292 pmdomain: core: Fix detach procedure for virtual devices in genpd
- CVE-2026-46291 crypto: caam - guard HMAC key hex dumps in hash_digest_key
- CVE-2026-46290 x86/efi: Fix graceful fault handling after FPU softirq changes
- CVE-2026-4629 Keycloak: keycloak: privilege escalation through hardcoded role mapper injection
- CVE-2026-46289 lib/scatterlist: fix length calculations in extract_kvec_to_sg
- CVE-2026-46288 of: unittest: fix use-after-free in of_unittest_changeset()
- CVE-2026-46287 net: txgbe: fix RTNL assertion warning when remove module
- CVE-2026-46286 leds: qcom-lpg: Check for array overflow when selecting the high resolution
- CVE-2026-46285 mtd: docg3: fix use-after-free in docg3_release()
- CVE-2026-46284 mm/hugetlb: fix early boot crash on parameters without '=' separator
- CVE-2026-46283 tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
- CVE-2026-46282 iio: frequency: admv1013: fix NULL pointer dereference on str
- CVE-2026-46281 vmalloc: fix buffer overflow in vrealloc_node_align()
- CVE-2026-46280 lib: test_hmm: evict device pages on file close to avoid use-after-free
- CVE-2026-4628 Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control
- CVE-2026-46279 mm/alloc_tag: clear codetag for pages allocated before page_ext initialization
- CVE-2026-46278 drm/imagination: Fix segfault when updating ftrace mask
- CVE-2026-46277 mm/zone_device: do not touch device folio after calling ->folio_free()
- CVE-2026-46276 drm/amdgpu: fix zero-size GDS range init on RDNA4
- CVE-2026-46275 Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
- CVE-2026-46274 io-wq: check that the predecessor is hashed in io_wq_remove_pending()
- CVE-2026-46273 ibmveth: Disable GSO for packets with small MSS
- CVE-2026-46272 coresight: tmc-etr: Fix race condition between sysfs and perf mode
- CVE-2026-46271 wifi: ath12k: do WoW offloads only on primary link
- CVE-2026-46270 power: supply: rt9455: Fix use-after-free in power_supply_changed()
- CVE-2026-4627 D-Link DIR-825/DIR-825R NTP Service libdeuteron_modules.so handler_update_system_time os command injection
- CVE-2026-46269 pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree
- CVE-2026-46268 PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition
- CVE-2026-46267 nfc: hci: shdlc: Stop timers and work before freeing context
- CVE-2026-46266 inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
- CVE-2026-46265 RDMA/hns: Fix WQ_MEM_RECLAIM warning
- CVE-2026-46264 drm/xe/pf: Fix sysfs initialization
- CVE-2026-46263 drm/amd/display: Fix out-of-bounds stream encoder index v3
- CVE-2026-46262 ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
- CVE-2026-46261 spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
- CVE-2026-46260 ipv6: Fix out-of-bound access in fib6_add_rt2node().
- CVE-2026-4626 projectworlds Lawyer Management System lawyer_booking.php cross site scripting
- CVE-2026-46259 procfs: fix missing RCU protection when reading real_parent in do_task_stat()
- CVE-2026-46258 gpio: cdev: Avoid NULL dereference in linehandle_create()
- CVE-2026-46257 Null dereference in Linux
- CVE-2026-46256 NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages
- CVE-2026-46255 dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
- CVE-2026-46254 AppArmor: Allow apparmor to handle unaligned dfa tables
- CVE-2026-46253 pstore/ram: fix buffer overflow in persistent_ram_save_old()
- CVE-2026-46252 regulator: core: fix locking in regulator_resolve_supply() error path
- CVE-2026-46251 btrfs: fix block_group_tree dirty_list corruption
- CVE-2026-46250 MIPS: Work around LLVM bug when gp is used as global register variable