# Vulnerabilities published in 2026


- [CVE-2026-4625](https://insights.sbomify.com/CVE-2026-4625/): SourceCodester Online Admission System programmes.php sql injection (medium 6.9)
- [CVE-2026-46249](https://insights.sbomify.com/CVE-2026-46249/): octeontx2-af: Fix PF driver crash with kexec kernel booting (medium 5.5)
- [CVE-2026-46248](https://insights.sbomify.com/CVE-2026-46248/): wifi: ath12k: clear stale link mapping of ahvif->links_map (medium 5.5)
- [CVE-2026-46247](https://insights.sbomify.com/CVE-2026-46247/): clk: qcom: gfx3d: add parent to parent request map (medium 5.5)
- [CVE-2026-46246](https://insights.sbomify.com/CVE-2026-46246/): power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (high 7.8)
- [CVE-2026-46245](https://insights.sbomify.com/CVE-2026-46245/): drm/amd/display: Fix dc_link NULL handling in HPD init (medium 5.5)
- [CVE-2026-46244](https://insights.sbomify.com/CVE-2026-46244/): netfilter: nft_inner: Fix IPv6 inner_thoff desync (critical 9.1)
- [CVE-2026-46243](https://insights.sbomify.com/CVE-2026-46243/): smb: client: reject userspace cifs.spnego descriptions (high 7.1)
- [CVE-2026-46242](https://insights.sbomify.com/CVE-2026-46242/): eventpoll: fix ep_remove struct eventpoll / struct file UAF (high 7.8)
- [CVE-2026-46241](https://insights.sbomify.com/CVE-2026-46241/): spi: mpc52xx: fix use-after-free on registration failure (high 7.8)
- [CVE-2026-46240](https://insights.sbomify.com/CVE-2026-46240/): media: iris: Fix use-after-free in iris_release_internal_buffers() (high 7.8)
- [CVE-2026-4624](https://insights.sbomify.com/CVE-2026-4624/): SourceCodester Online Library Management System Parameter home.php sql injection (medium 6.9)
- [CVE-2026-46239](https://insights.sbomify.com/CVE-2026-46239/): media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl (medium 5.5)
- [CVE-2026-46238](https://insights.sbomify.com/CVE-2026-46238/): batman-adv: stop caching unowned originator pointers in BAT IV (high 8.8)
- [CVE-2026-46236](https://insights.sbomify.com/CVE-2026-46236/): media: rc: xbox_remote: heed DMA restrictions (medium 5.5)
- [CVE-2026-46235](https://insights.sbomify.com/CVE-2026-46235/): media: saa7164: add ioremap return checks and cleanups (medium 5.5)
- [CVE-2026-46234](https://insights.sbomify.com/CVE-2026-46234/): vsock: fix buffer size clamping order (high 7.8)
- [CVE-2026-46233](https://insights.sbomify.com/CVE-2026-46233/): batman-adv: bla: only purge non-released claims (medium 5.5)
- [CVE-2026-46232](https://insights.sbomify.com/CVE-2026-46232/): HID: playstation: Clamp num_touch_reports (high 8.1)
- [CVE-2026-46231](https://insights.sbomify.com/CVE-2026-46231/): batman-adv: bla: put backbone reference on failed claim hash insert (medium 5.5)
- [CVE-2026-46230](https://insights.sbomify.com/CVE-2026-46230/): drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (high 7.1)
- [CVE-2026-4623](https://insights.sbomify.com/CVE-2026-4623/): DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery (medium 6.9)
- [CVE-2026-46229](https://insights.sbomify.com/CVE-2026-46229/): drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (medium 5.5)
- [CVE-2026-46228](https://insights.sbomify.com/CVE-2026-46228/): spi: ch341: fix devres lifetime (medium 5.5)
- [CVE-2026-46227](https://insights.sbomify.com/CVE-2026-46227/): sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (high 7.8)
- [CVE-2026-46226](https://insights.sbomify.com/CVE-2026-46226/): spi: fsl: fix controller deregistration (medium 5.5)
- [CVE-2026-46225](https://insights.sbomify.com/CVE-2026-46225/): spi: rspi: fix controller deregistration (medium 5.5)
- [CVE-2026-46224](https://insights.sbomify.com/CVE-2026-46224/): drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (medium 5.5)
- [CVE-2026-46223](https://insights.sbomify.com/CVE-2026-46223/): cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated (medium 5.5)
- [CVE-2026-46222](https://insights.sbomify.com/CVE-2026-46222/): media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads (medium 5.5)
- [CVE-2026-46221](https://insights.sbomify.com/CVE-2026-46221/): EDAC/versalnet: Fix device name memory leak (medium 5.5)
- [CVE-2026-46220](https://insights.sbomify.com/CVE-2026-46220/): drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (medium 5.5)
- [CVE-2026-4622](https://insights.sbomify.com/CVE-2026-4622/): Command injection in Aterm GB1200PE (high 7.1)
- [CVE-2026-46219](https://insights.sbomify.com/CVE-2026-46219/): spi: mpc52xx: fix use-after-free on unbind (high 7.8)
- [CVE-2026-46218](https://insights.sbomify.com/CVE-2026-46218/): drm/amdgpu: Add bounds checking to ib_{get,set}_value (high 7.1)
- [CVE-2026-46216](https://insights.sbomify.com/CVE-2026-46216/): drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() (medium 5.5)
- [CVE-2026-46215](https://insights.sbomify.com/CVE-2026-46215/): drm: Set old handle to NULL before prime swap in change_handle (high 7.8)
- [CVE-2026-46214](https://insights.sbomify.com/CVE-2026-46214/): vsock/virtio: fix accept queue count leak on transport mismatch (medium 5.5)
- [CVE-2026-46213](https://insights.sbomify.com/CVE-2026-46213/): HID: appletb-kbd: fix UAF in inactivity-timer cleanup path (high 7.8)
- [CVE-2026-46212](https://insights.sbomify.com/CVE-2026-46212/): batman-adv: bla: prevent use-after-free when deleting claims (high 8.8)
- [CVE-2026-46211](https://insights.sbomify.com/CVE-2026-46211/): drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (medium 5.5)
- [CVE-2026-46210](https://insights.sbomify.com/CVE-2026-46210/): media: iris: fix use-after-free of fmt_src during MBPF check (high 7.8)
- [CVE-2026-4621](https://insights.sbomify.com/CVE-2026-4621/): Security feature bypass in Aterm GB1200PE (medium 6.3)
- [CVE-2026-46209](https://insights.sbomify.com/CVE-2026-46209/): drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (high 7.8)
- [CVE-2026-46208](https://insights.sbomify.com/CVE-2026-46208/): batman-adv: stop tp_meter sessions during mesh teardown (high 7.8)
- [CVE-2026-46207](https://insights.sbomify.com/CVE-2026-46207/): vsock/virtio: fix empty payload in tap skb for non-linear buffers (medium 5.5)
- [CVE-2026-46206](https://insights.sbomify.com/CVE-2026-46206/): batman-adv: reject new tp_meter sessions during teardown (high 7.8)
- [CVE-2026-46205](https://insights.sbomify.com/CVE-2026-46205/): staging: media: atomisp: Disallow all private IOCTLs (high 7.8)
- [CVE-2026-46204](https://insights.sbomify.com/CVE-2026-46204/): drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (high 7.1)
- [CVE-2026-46203](https://insights.sbomify.com/CVE-2026-46203/): spi: cadence-quadspi: fix unclocked access on unbind (high 7.1)
- [CVE-2026-46202](https://insights.sbomify.com/CVE-2026-46202/): HID: appletb-kbd: run inactivity autodim from workqueues (medium 5.5)
- [CVE-2026-46201](https://insights.sbomify.com/CVE-2026-46201/): drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (high 7.8)
- [CVE-2026-46200](https://insights.sbomify.com/CVE-2026-46200/): spi: mpc52xx: fix controller deregistration (medium 5.5)
- [CVE-2026-4620](https://insights.sbomify.com/CVE-2026-4620/): Command injection in Aterm WX1500HP (high 7.1)
- [CVE-2026-46199](https://insights.sbomify.com/CVE-2026-46199/): drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (high 7.1)
- [CVE-2026-46198](https://insights.sbomify.com/CVE-2026-46198/): batman-adv: fix integer overflow on buff_pos (high 8.8)
- [CVE-2026-46197](https://insights.sbomify.com/CVE-2026-46197/): drm/amdkfd: validate SVM ioctl nattr against buffer size (high 7.8)
- [CVE-2026-46196](https://insights.sbomify.com/CVE-2026-46196/): tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (medium 5.5)
- [CVE-2026-46195](https://insights.sbomify.com/CVE-2026-46195/): smb: client: validate dacloffset before building DACL pointers (critical 9.8)
- [CVE-2026-46193](https://insights.sbomify.com/CVE-2026-46193/): xfrm: ah: account for ESN high bits in async callbacks (medium 5.5)
- [CVE-2026-46192](https://insights.sbomify.com/CVE-2026-46192/): spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations (medium 5.5)
- [CVE-2026-46191](https://insights.sbomify.com/CVE-2026-46191/): fbcon: Avoid OOB font access if console rotation fails (high 7.1)
- [CVE-2026-46190](https://insights.sbomify.com/CVE-2026-46190/): mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (high 7.1)
- [CVE-2026-4619](https://insights.sbomify.com/CVE-2026-4619/): Path traversal in Aterm WX3600HP (medium 6.0)
- [CVE-2026-46189](https://insights.sbomify.com/CVE-2026-46189/): RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (high 7.8)
- [CVE-2026-46188](https://insights.sbomify.com/CVE-2026-46188/): octeon_ep_vf: add NULL check for napi_build_skb() (medium 5.5)
- [CVE-2026-46187](https://insights.sbomify.com/CVE-2026-46187/): wifi: rsi: fix kthread lifetime race between self-exit and external-stop (medium 4.7)
- [CVE-2026-46186](https://insights.sbomify.com/CVE-2026-46186/): Bluetooth: virtio_bt: validate rx pkt_type header length (medium 5.5)
- [CVE-2026-46185](https://insights.sbomify.com/CVE-2026-46185/): smb/client: fix out-of-bounds read in symlink_data() (critical 9.1)
- [CVE-2026-46184](https://insights.sbomify.com/CVE-2026-46184/): sound: ua101: fix division by zero at probe (medium 5.5)
- [CVE-2026-46183](https://insights.sbomify.com/CVE-2026-46183/): mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock (high 7.8)
- [CVE-2026-46182](https://insights.sbomify.com/CVE-2026-46182/): pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace (medium 5.5)
- [CVE-2026-46181](https://insights.sbomify.com/CVE-2026-46181/): RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (high 7.8)
- [CVE-2026-46180](https://insights.sbomify.com/CVE-2026-46180/): wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (high 7.8)
- [CVE-2026-46179](https://insights.sbomify.com/CVE-2026-46179/): ASoC: SOF: Don't allow pointer operations on unconfigured streams (medium 5.5)
- [CVE-2026-46178](https://insights.sbomify.com/CVE-2026-46178/): RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (high 7.8)
- [CVE-2026-46177](https://insights.sbomify.com/CVE-2026-46177/): ipmi: Add limits to event and receive message requests (high 7.5)
- [CVE-2026-46176](https://insights.sbomify.com/CVE-2026-46176/): RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (high 7.8)
- [CVE-2026-46175](https://insights.sbomify.com/CVE-2026-46175/): f2fs: fix fsck inconsistency caused by FGGC of node block (high 7.1)
- [CVE-2026-46174](https://insights.sbomify.com/CVE-2026-46174/): x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (high 8.8)
- [CVE-2026-46173](https://insights.sbomify.com/CVE-2026-46173/): exit: prevent preemption of oopsing TASK_DEAD task (high 7.8)
- [CVE-2026-46172](https://insights.sbomify.com/CVE-2026-46172/): ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (medium 5.5)
- [CVE-2026-46171](https://insights.sbomify.com/CVE-2026-46171/): riscv: kvm: fix vector context allocation leak (medium 5.5)
- [CVE-2026-46170](https://insights.sbomify.com/CVE-2026-46170/): mptcp: pm: ADD_ADDR rtx: free sk if last (medium 5.5)
- [CVE-2026-4617](https://insights.sbomify.com/CVE-2026-4617/): Missing authorization in Patients Waiting Area Queue Management System (medium 6.9)
- [CVE-2026-46169](https://insights.sbomify.com/CVE-2026-46169/): hfsplus: fix uninit-value by validating catalog record size (medium 5.5)
- [CVE-2026-46168](https://insights.sbomify.com/CVE-2026-46168/): mptcp: fix scheduling with atomic in timestamp sockopt (medium 5.5)
- [CVE-2026-46167](https://insights.sbomify.com/CVE-2026-46167/): usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (medium 5.5)
- [CVE-2026-46166](https://insights.sbomify.com/CVE-2026-46166/): wifi: mac80211: use safe list iteration in radar detect work (high 8.8)
- [CVE-2026-46165](https://insights.sbomify.com/CVE-2026-46165/): openvswitch: vport: fix self-deadlock on release of tunnel ports (medium 5.5)
- [CVE-2026-46164](https://insights.sbomify.com/CVE-2026-46164/): btrfs: fix double free in create_space_info_sub_group() error path (high 7.0)
- [CVE-2026-46163](https://insights.sbomify.com/CVE-2026-46163/): wifi: b43legacy: enforce bounds check on firmware key index in RX path (high 7.8)
- [CVE-2026-46162](https://insights.sbomify.com/CVE-2026-46162/): ice: fix double free in ice_sf_eth_activate() error path (high 7.8)
- [CVE-2026-46161](https://insights.sbomify.com/CVE-2026-46161/): md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (medium 5.5)
- [CVE-2026-46160](https://insights.sbomify.com/CVE-2026-46160/): btrfs: fix missing last_unlink_trans update when removing a directory (medium 5.5)
- [CVE-2026-4616](https://insights.sbomify.com/CVE-2026-4616/): bolo-blog Article Title article cross site scripting (medium 4.8)
- [CVE-2026-46159](https://insights.sbomify.com/CVE-2026-46159/): btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (medium 4.7)
- [CVE-2026-46158](https://insights.sbomify.com/CVE-2026-46158/): mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (medium 5.5)
- [CVE-2026-46157](https://insights.sbomify.com/CVE-2026-46157/): ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (high 7.8)
- [CVE-2026-46156](https://insights.sbomify.com/CVE-2026-46156/): LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/614/