# Vulnerabilities published in 2026


- [CVE-2026-46341](https://insights.sbomify.com/CVE-2026-46341/): Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching (medium 6.1)
- [CVE-2026-46340](https://insights.sbomify.com/CVE-2026-46340/): Netty: SCTP reassembly nests buffers without bound (high 7.5)
- [CVE-2026-4634](https://insights.sbomify.com/CVE-2026-4634/): Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters (high 7.5)
- [CVE-2026-46339](https://insights.sbomify.com/CVE-2026-46339/): 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes (critical 10.0)
- [CVE-2026-46338](https://insights.sbomify.com/CVE-2026-46338/): Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path (medium 4.3)
- [CVE-2026-46337](https://insights.sbomify.com/CVE-2026-46337/): WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` (medium 6.9)
- [CVE-2026-46336](https://insights.sbomify.com/CVE-2026-46336/): Manyfold: Authenticated Path Traversal via File Rename (high 7.1)
- [CVE-2026-46334](https://insights.sbomify.com/CVE-2026-46334/): OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning (high 8.7)
- [CVE-2026-46333](https://insights.sbomify.com/CVE-2026-46333/): ptrace: slightly saner 'get_dumpable()' logic (high 7.1)
- [CVE-2026-46332](https://insights.sbomify.com/CVE-2026-46332/): greybus: gb-beagleplay: bound bootloader receive buffering (high 8.0)
- [CVE-2026-46331](https://insights.sbomify.com/CVE-2026-46331/): net/sched: fix pedit partial COW leading to page cache corruption (high 7.8)
- [CVE-2026-46330](https://insights.sbomify.com/CVE-2026-46330/): Revert "net/smc: Introduce TCP ULP support" (high 7.8)
- [CVE-2026-4633](https://insights.sbomify.com/CVE-2026-4633/): Keycloak: keycloak: user enumeration via differential error messages (low 3.7)
- [CVE-2026-46329](https://insights.sbomify.com/CVE-2026-46329/): erofs: handle end of filesystem properly for file-backed mounts (medium 5.5)
- [CVE-2026-46328](https://insights.sbomify.com/CVE-2026-46328/): apparmor: fix rlimit for posix cpu timers (high 7.3)
- [CVE-2026-46327](https://insights.sbomify.com/CVE-2026-46327/): dm: fix unlocked test for dm_suspended_md (high 7.8)
- [CVE-2026-46326](https://insights.sbomify.com/CVE-2026-46326/): iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (high 8.4)
- [CVE-2026-46325](https://insights.sbomify.com/CVE-2026-46325/): RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (critical 9.8)
- [CVE-2026-46324](https://insights.sbomify.com/CVE-2026-46324/): netfilter: nf_tables: use list_del_rcu for netlink hooks (high 7.8)
- [CVE-2026-46323](https://insights.sbomify.com/CVE-2026-46323/): net: gro: don't merge zcopy skbs (high 7.8)
- [CVE-2026-46322](https://insights.sbomify.com/CVE-2026-46322/): tun: free page on build_skb failure in tun_xdp_one() (high 7.1)
- [CVE-2026-46321](https://insights.sbomify.com/CVE-2026-46321/): tun: free page on short-frame rejection in tun_xdp_one() (high 7.1)
- [CVE-2026-46320](https://insights.sbomify.com/CVE-2026-46320/): tap: free page on error paths in tap_get_user_xdp() (high 7.4)
- [CVE-2026-4632](https://insights.sbomify.com/CVE-2026-4632/): itsourcecode Online Enrollment System Parameter index.php sql injection (medium 6.9)
- [CVE-2026-46319](https://insights.sbomify.com/CVE-2026-46319/): net/sched: act_ct: Only release RCU read lock after ct_ft (high 7.8)
- [CVE-2026-46318](https://insights.sbomify.com/CVE-2026-46318/): Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" (medium 5.5)
- [CVE-2026-46317](https://insights.sbomify.com/CVE-2026-46317/): KVM: arm64: Reassign nested_mmus array behind mmu_lock (high 8.8)
- [CVE-2026-46316](https://insights.sbomify.com/CVE-2026-46316/): KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (critical 9.3)
- [CVE-2026-46315](https://insights.sbomify.com/CVE-2026-46315/): io_uring/waitid: clear waitid info before copying it to userspace (medium 5.5)
- [CVE-2026-46314](https://insights.sbomify.com/CVE-2026-46314/): drm/v3d: Reject empty multisync extension to prevent infinite loop (medium 5.5)
- [CVE-2026-46313](https://insights.sbomify.com/CVE-2026-46313/): media: intel/ipu6: fix error pointer dereference (medium 5.5)
- [CVE-2026-46312](https://insights.sbomify.com/CVE-2026-46312/): media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (medium 5.5)
- [CVE-2026-46311](https://insights.sbomify.com/CVE-2026-46311/): drm/amdgpu/userq: fix access to stale wptr mapping (high 7.8)
- [CVE-2026-46310](https://insights.sbomify.com/CVE-2026-46310/): media: renesas: vsp1: Fix NULL pointer deref on module unload (medium 5.5)
- [CVE-2026-4631](https://insights.sbomify.com/CVE-2026-4631/): Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection (critical 9.8)
- [CVE-2026-46309](https://insights.sbomify.com/CVE-2026-46309/): drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (high 7.0)
- [CVE-2026-46308](https://insights.sbomify.com/CVE-2026-46308/): pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() (high 7.8)
- [CVE-2026-46307](https://insights.sbomify.com/CVE-2026-46307/): wifi: ath5k: do not access array OOB (high 8.3)
- [CVE-2026-46306](https://insights.sbomify.com/CVE-2026-46306/): flow_dissector: do not dissect PPPoE PFC frames (high 7.5)
- [CVE-2026-46305](https://insights.sbomify.com/CVE-2026-46305/): staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc (medium 5.5)
- [CVE-2026-46304](https://insights.sbomify.com/CVE-2026-46304/): nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (high 7.5)
- [CVE-2026-46303](https://insights.sbomify.com/CVE-2026-46303/): isofs: validate Rock Ridge CE continuation extent against volume size (high 8.2)
- [CVE-2026-46302](https://insights.sbomify.com/CVE-2026-46302/): selinux: allow multiple opens of /sys/fs/selinux/policy (medium 5.5)
- [CVE-2026-46301](https://insights.sbomify.com/CVE-2026-46301/): spi: topcliff-pch: fix use-after-free on unbind (high 7.8)
- [CVE-2026-46300](https://insights.sbomify.com/CVE-2026-46300/): Linux Kernel Missing Initialization of a Variable (high 7.8, exploited in the wild)
- [CVE-2026-4630](https://insights.sbomify.com/CVE-2026-4630/): Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference (medium 6.8)
- [CVE-2026-46299](https://insights.sbomify.com/CVE-2026-46299/): hfsplus: fix held lock freed on hfsplus_fill_super() (high 7.0)
- [CVE-2026-46298](https://insights.sbomify.com/CVE-2026-46298/): pseries/papr-hvpipe: Fix race with interrupt handler (medium 4.7)
- [CVE-2026-46297](https://insights.sbomify.com/CVE-2026-46297/): net: libwx: use request_irq for VF misc interrupt (medium 5.5)
- [CVE-2026-46296](https://insights.sbomify.com/CVE-2026-46296/): spi: s3c64xx: fix NULL-deref on driver unbind (medium 5.5)
- [CVE-2026-46295](https://insights.sbomify.com/CVE-2026-46295/): KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty (medium 5.5)
- [CVE-2026-46294](https://insights.sbomify.com/CVE-2026-46294/): dm: fix a buffer overflow in ioctl processing (high 7.8)
- [CVE-2026-46293](https://insights.sbomify.com/CVE-2026-46293/): clk: microchip: mpfs-ccc: fix out of bounds access during output registration (high 7.1)
- [CVE-2026-46292](https://insights.sbomify.com/CVE-2026-46292/): pmdomain: core: Fix detach procedure for virtual devices in genpd (medium 5.5)
- [CVE-2026-46291](https://insights.sbomify.com/CVE-2026-46291/): crypto: caam - guard HMAC key hex dumps in hash_digest_key (medium 5.5)
- [CVE-2026-46290](https://insights.sbomify.com/CVE-2026-46290/): x86/efi: Fix graceful fault handling after FPU softirq changes (medium 5.5)
- [CVE-2026-4629](https://insights.sbomify.com/CVE-2026-4629/): Keycloak: keycloak: privilege escalation through hardcoded role mapper injection (medium 6.5)
- [CVE-2026-46289](https://insights.sbomify.com/CVE-2026-46289/): lib/scatterlist: fix length calculations in extract_kvec_to_sg (critical 9.8)
- [CVE-2026-46288](https://insights.sbomify.com/CVE-2026-46288/): of: unittest: fix use-after-free in of_unittest_changeset() (high 8.4)
- [CVE-2026-46287](https://insights.sbomify.com/CVE-2026-46287/): net: txgbe: fix RTNL assertion warning when remove module (medium 5.5)
- [CVE-2026-46286](https://insights.sbomify.com/CVE-2026-46286/): leds: qcom-lpg: Check for array overflow when selecting the high resolution (medium 5.5)
- [CVE-2026-46285](https://insights.sbomify.com/CVE-2026-46285/): mtd: docg3: fix use-after-free in docg3_release() (high 7.8)
- [CVE-2026-46284](https://insights.sbomify.com/CVE-2026-46284/): mm/hugetlb: fix early boot crash on parameters without '=' separator (medium 5.5)
- [CVE-2026-46283](https://insights.sbomify.com/CVE-2026-46283/): tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (medium 5.5)
- [CVE-2026-46282](https://insights.sbomify.com/CVE-2026-46282/): iio: frequency: admv1013: fix NULL pointer dereference on str (medium 5.5)
- [CVE-2026-46281](https://insights.sbomify.com/CVE-2026-46281/): vmalloc: fix buffer overflow in vrealloc_node_align() (high 7.8)
- [CVE-2026-46280](https://insights.sbomify.com/CVE-2026-46280/): lib: test_hmm: evict device pages on file close to avoid use-after-free (high 7.8)
- [CVE-2026-4628](https://insights.sbomify.com/CVE-2026-4628/): Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control (medium 4.3)
- [CVE-2026-46279](https://insights.sbomify.com/CVE-2026-46279/): mm/alloc_tag: clear codetag for pages allocated before page_ext initialization (high 7.8)
- [CVE-2026-46278](https://insights.sbomify.com/CVE-2026-46278/): drm/imagination: Fix segfault when updating ftrace mask (medium 5.5)
- [CVE-2026-46277](https://insights.sbomify.com/CVE-2026-46277/): mm/zone_device: do not touch device folio after calling ->folio_free() (high 7.8)
- [CVE-2026-46276](https://insights.sbomify.com/CVE-2026-46276/): drm/amdgpu: fix zero-size GDS range init on RDNA4 (medium 5.5)
- [CVE-2026-46275](https://insights.sbomify.com/CVE-2026-46275/): Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (high 7.8)
- [CVE-2026-46274](https://insights.sbomify.com/CVE-2026-46274/): io-wq: check that the predecessor is hashed in io_wq_remove_pending() (high 7.8)
- [CVE-2026-46273](https://insights.sbomify.com/CVE-2026-46273/): ibmveth: Disable GSO for packets with small MSS (high 8.6)
- [CVE-2026-46272](https://insights.sbomify.com/CVE-2026-46272/): coresight: tmc-etr: Fix race condition between sysfs and perf mode (medium 4.7)
- [CVE-2026-46271](https://insights.sbomify.com/CVE-2026-46271/): wifi: ath12k: do WoW offloads only on primary link (high 7.8)
- [CVE-2026-46270](https://insights.sbomify.com/CVE-2026-46270/): power: supply: rt9455: Fix use-after-free in power_supply_changed() (high 8.4)
- [CVE-2026-4627](https://insights.sbomify.com/CVE-2026-4627/): D-Link DIR-825/DIR-825R NTP Service libdeuteron_modules.so handler_update_system_time os command injection (high 8.6)
- [CVE-2026-46269](https://insights.sbomify.com/CVE-2026-46269/): pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree (medium 5.5)
- [CVE-2026-46268](https://insights.sbomify.com/CVE-2026-46268/): PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition (medium 5.5)
- [CVE-2026-46267](https://insights.sbomify.com/CVE-2026-46267/): nfc: hci: shdlc: Stop timers and work before freeing context (high 7.8)
- [CVE-2026-46266](https://insights.sbomify.com/CVE-2026-46266/): inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (critical 9.1)
- [CVE-2026-46265](https://insights.sbomify.com/CVE-2026-46265/): RDMA/hns: Fix WQ_MEM_RECLAIM warning (high 7.5)
- [CVE-2026-46264](https://insights.sbomify.com/CVE-2026-46264/): drm/xe/pf: Fix sysfs initialization (high 8.8)
- [CVE-2026-46263](https://insights.sbomify.com/CVE-2026-46263/): drm/amd/display: Fix out-of-bounds stream encoder index v3 (high 7.8)
- [CVE-2026-46262](https://insights.sbomify.com/CVE-2026-46262/): ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (medium 5.5)
- [CVE-2026-46261](https://insights.sbomify.com/CVE-2026-46261/): spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (medium 5.5)
- [CVE-2026-46260](https://insights.sbomify.com/CVE-2026-46260/): ipv6: Fix out-of-bound access in fib6_add_rt2node(). (high 7.8)
- [CVE-2026-4626](https://insights.sbomify.com/CVE-2026-4626/): projectworlds Lawyer Management System lawyer_booking.php cross site scripting (medium 5.1)
- [CVE-2026-46259](https://insights.sbomify.com/CVE-2026-46259/): procfs: fix missing RCU protection when reading real_parent in do_task_stat() (high 7.8)
- [CVE-2026-46258](https://insights.sbomify.com/CVE-2026-46258/): gpio: cdev: Avoid NULL dereference in linehandle_create() (medium 5.5)
- [CVE-2026-46257](https://insights.sbomify.com/CVE-2026-46257/): Null dereference in Linux (medium 5.5)
- [CVE-2026-46256](https://insights.sbomify.com/CVE-2026-46256/): NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages (medium 5.5)
- [CVE-2026-46255](https://insights.sbomify.com/CVE-2026-46255/): dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (medium 5.5)
- [CVE-2026-46254](https://insights.sbomify.com/CVE-2026-46254/): AppArmor: Allow apparmor to handle unaligned dfa tables (medium 5.5)
- [CVE-2026-46253](https://insights.sbomify.com/CVE-2026-46253/): pstore/ram: fix buffer overflow in persistent_ram_save_old() (high 7.8)
- [CVE-2026-46252](https://insights.sbomify.com/CVE-2026-46252/): regulator: core: fix locking in regulator_resolve_supply() error path (medium 5.5)
- [CVE-2026-46251](https://insights.sbomify.com/CVE-2026-46251/): btrfs: fix block_group_tree dirty_list corruption (high 8.4)
- [CVE-2026-46250](https://insights.sbomify.com/CVE-2026-46250/): MIPS: Work around LLVM bug when gp is used as global register variable (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/613/