Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 615 of 1013.
- CVE-2026-46155 smb/client: fix out-of-bounds read in smb2_compound_op()
- CVE-2026-46154 sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
- CVE-2026-46153 8021q: delete cleared egress QoS mappings
- CVE-2026-46152 wifi: mac80211: drop stray 'static' from fast-RX rx_result
- CVE-2026-46151 usb: usblp: fix heap leak in IEEE 1284 device ID via short response
- CVE-2026-46150 fanotify: fix false positive on permission events
- CVE-2026-4615 SourceCodester Online Catering Reservation search.php sql injection
- CVE-2026-46149 scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
- CVE-2026-46148 spi: microchip-core-qspi: control built-in cs manually
- CVE-2026-46147 KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()
- CVE-2026-46146 ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
- CVE-2026-46145 RDMA/mana: Validate rx_hash_key_len
- CVE-2026-46144 RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
- CVE-2026-46143 ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
- CVE-2026-46142 net: libwx: fix VF illegal register access
- CVE-2026-46141 powerpc/xive: fix kmemleak caused by incorrect chip_data lookup
- CVE-2026-46140 Bluetooth: btmtk: validate WMT event SKB length before struct access
- CVE-2026-4614 itsourcecode sanitize or validate this input Parameter subjects.php sql injection
- CVE-2026-46139 smb: client: use kzalloc to zero-initialize security descriptor buffer
- CVE-2026-46138 Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
- CVE-2026-46137 mptcp: pm: ADD_ADDR rtx: fix potential data-race
- CVE-2026-46136 wifi: mt76: mt7921: fix a potential clc buffer length underflow
- CVE-2026-46135 nvmet-tcp: fix race between ICReq handling and queue teardown
- CVE-2026-46134 platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration
- CVE-2026-46133 RDMA/rxe: Reject unknown opcodes before ICRC processing
- CVE-2026-46132 net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
- CVE-2026-46131 KVM: x86: check for nEPT/nNPT in slow flush hypercalls
- CVE-2026-46130 dm-verity-fec: fix reading parity bytes split across blocks (take 3)
- CVE-2026-4613 SourceCodester E-Commerce Site products.php sql injection
- CVE-2026-46129 btrfs: fix double free in create_space_info() error path
- CVE-2026-46128 ipmi: Check event message buffer response for bad data
- CVE-2026-46127 RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
- CVE-2026-46126 RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
- CVE-2026-46125 wifi: mac80211: remove station if connection prep fails
- CVE-2026-46124 isofs: validate block number from NFS file handle in isofs_export_iget
- CVE-2026-46123 Bluetooth: virtio_bt: clamp rx length before skb_put
- CVE-2026-46122 wifi: b43: enforce bounds check on firmware key index in b43_rx()
- CVE-2026-46121 mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
- CVE-2026-46120 ip6_gre: Use cached t->net in ip6erspan_changelink().
- CVE-2026-4612 itsourcecode Free Hotel Reservation System Parameter index.php sql injection
- CVE-2026-46119 libceph: Fix slab-out-of-bounds access in auth message processing
- CVE-2026-46118 pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
- CVE-2026-46117 RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
- CVE-2026-46116 xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
- CVE-2026-46115 block: add pgmap check to biovec_phys_mergeable
- CVE-2026-46114 RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
- CVE-2026-46113 KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
- CVE-2026-46112 RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
- CVE-2026-46111 Bluetooth: hci_conn: fix potential UAF in create_big_sync
- CVE-2026-46110 net: stmmac: Prevent NULL deref when RX memory exhausted
- CVE-2026-4611 TOTOLINK X6000R shttpd setLanCfg privilege escalation
- CVE-2026-46109 usb: ulpi: fix memory leak on ulpi_register() error paths
- CVE-2026-46108 ipmi:si: Return state to normal if message allocation fails
- CVE-2026-46107 dm-thin: fix metadata refcount underflow
- CVE-2026-46106 eventfs: Hold eventfs_mutex and SRCU when remount walks events
- CVE-2026-46105 scsi: mpt3sas: Limit NVMe request size to 2 MiB
- CVE-2026-46104 selinux: use sk blob accessor in socket permission helpers
- CVE-2026-46103 can: ucan: fix devres lifetime
- CVE-2026-46102 net: strparser: fix skb_head leak in strp_abort_strp()
- CVE-2026-46101 netfilter: reject zero shift in nft_bitwise
- CVE-2026-46100 fs: afs: revert mmap_prepare() change
- CVE-2026-4610 ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
- CVE-2026-46099 net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
- CVE-2026-46098 net: caif: clear client service pointer on teardown
- CVE-2026-46097 Input: edt-ft5x06 - fix use-after-free in debugfs teardown
- CVE-2026-46096 tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()
- CVE-2026-46095 md/md-llbitmap: raise barrier before state machine transition
- CVE-2026-46094 ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
- CVE-2026-46093 mm/vmalloc: take vmap_purge_lock in shrinker
- CVE-2026-46092 wifi: rtw88: check for PCI upstream bridge existence
- CVE-2026-46091 media: rc: igorplugusb: heed coherency rules
- CVE-2026-46090 ALSA: aloop: Fix peer runtime UAF during format-change stop
- CVE-2026-4609 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining
- CVE-2026-46089 zram: do not forget to endio for partial discard requests
- CVE-2026-46088 ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
- CVE-2026-46087 mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start()
- CVE-2026-46086 net: bridge: use a stable FDB dst snapshot in RCU readers
- CVE-2026-46085 rxrpc: Fix rxkad crypto unalignment handling
- CVE-2026-46084 RDMA/mana_ib: Disable RX steering on RSS QP destroy
- CVE-2026-46083 spi: fix resource leaks on device setup failure
- CVE-2026-46082 KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
- CVE-2026-46081 crypto: acomp - fix wrong pointer stored by acomp_save_req()
- CVE-2026-46080 ocfs2: split transactions in dio completion to avoid credit exhaustion
- CVE-2026-4608 ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
- CVE-2026-46079 rbd: fix null-ptr-deref when device_add_disk() fails
- CVE-2026-46078 erofs: fix the out-of-bounds nameoff handling for trailing dirents
- CVE-2026-46077 crypto: atmel-tdes - fix DMA sync direction
- CVE-2026-46076 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
- CVE-2026-46075 crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
- CVE-2026-46074 spi: ch341: fix memory leaks on probe failures
- CVE-2026-46073 hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
- CVE-2026-46072 ntfs3: add buffer boundary checks to run_unpack()
- CVE-2026-46071 KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
- CVE-2026-46070 md/raid5: validate payload size before accessing journal metadata
- CVE-2026-4607 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification
- CVE-2026-46069 wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
- CVE-2026-46068 crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
- CVE-2026-46067 mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp
- CVE-2026-46066 ceph: fix num_ops off-by-one when crypto allocation fails
- CVE-2026-46065 fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info