Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 618 of 1013.
- CVE-2026-45880 PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
- CVE-2026-4588 kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key
- CVE-2026-45879 power: supply: bq25980: Fix use-after-free in power_supply_changed()
- CVE-2026-45878 drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
- CVE-2026-45877 HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
- CVE-2026-45876 arm64/gcs: Fix error handling in arch_set_shadow_stack_status()
- CVE-2026-45875 mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure
- CVE-2026-45874 phy: freescale: imx8qm-hsio: fix NULL pointer dereference
- CVE-2026-45873 netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
- CVE-2026-45872 scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
- CVE-2026-45871 tpm: st33zp24: Fix missing cleanup on get_burstcount() error
- CVE-2026-45870 SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
- CVE-2026-4587 HybridAuth SSL Curl.php certificate validation
- CVE-2026-45869 power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()
- CVE-2026-45868 pinctrl: single: fix refcount leak in pcs_add_gpio_func()
- CVE-2026-45867 power: supply: act8945a: Fix use-after-free in power_supply_changed()
- CVE-2026-45866 serial: caif: fix use-after-free in caif_serial ldisc_close()
- CVE-2026-45865 mctp i2c: initialise event handler read bytes
- CVE-2026-45864 fs/ntfs3: prevent infinite loops caused by the next valid being the same
- CVE-2026-45863 i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()
- CVE-2026-45862 iommu/vt-d: Flush cache for PASID table before using it
- CVE-2026-45861 gfs2: Fix slab-use-after-free in qd_put
- CVE-2026-45860 netfilter: nf_conncount: increase the connection clean up limit to 64
- CVE-2026-4586 CodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted upload
- CVE-2026-45859 netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
- CVE-2026-45858 ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
- CVE-2026-45857 scsi: csiostor: Fix dereference of null pointer rn
- CVE-2026-45856 RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
- CVE-2026-45855 ata: libata-scsi: avoid Non-NCQ command starvation
- CVE-2026-45854 crypto: inside-secure/eip93 - unregister only available algorithm
- CVE-2026-45853 drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
- CVE-2026-45852 RDMA/rxe: Fix double free in rxe_srq_from_init
- CVE-2026-45851 efi: Fix reservation of unaccepted memory table
- CVE-2026-45850 ipvs: skip ipv6 extension headers for csum checks
- CVE-2026-4585 Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection
- CVE-2026-45849 net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
- CVE-2026-45848 apparmor: fix NULL sock in aa_sock_file_perm
- CVE-2026-45847 net: remove WARN_ON_ONCE when accessing forward path array
- CVE-2026-45846 bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
- CVE-2026-45845 net/sched: taprio: fix NULL pointer dereference in class dump
- CVE-2026-45844 netfilter: arp_tables: fix IEEE1394 ARP payload parsing
- CVE-2026-45843 slip: bound decode() reads against the compressed packet length
- CVE-2026-45842 slip: reject VJ receive packets on instances with no rstate array
- CVE-2026-45841 netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
- CVE-2026-45840 openvswitch: cap upcall PID array size and pre-size vport replies
- CVE-2026-4584 Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission
- CVE-2026-45839 bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
- CVE-2026-45838 bpf: fix end-of-list detection in cgroup_storage_get_next_key()
- CVE-2026-45837 bpf: Fix use-after-free in arena_vm_close on fork
- CVE-2026-45836 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
- CVE-2026-45835 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
- CVE-2026-45834 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
- CVE-2026-45833 ChromaDB has a code injection vulnerability
- CVE-2026-45832 Missing authorization in ChromaDB
- CVE-2026-45831 ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to
- CVE-2026-45830 ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
- CVE-2026-4583 Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay
- CVE-2026-45829 ChromaDB Python project has a pre-authentication code injection vulnerability
- CVE-2026-45822 decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
- CVE-2026-45820 fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
- CVE-2026-4582 Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication
- CVE-2026-45819 baseline-browser-mapping process termination on invalid input causes denial of service
- CVE-2026-45816 Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request
- CVE-2026-45815 Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler
- CVE-2026-45813 Apache NimBLE: Incorrect data validation in BASS add/modify source operation
- CVE-2026-45812 Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
- CVE-2026-45811 Apache NimBLE: Buffer overflow in socket HCI transport
- CVE-2026-45810 Nextcloud: Propfind requests for file comments allowed to load comments for other files
- CVE-2026-4581 code-projects Simple Laundry System Parameters checklogin.php sql injection
- CVE-2026-45809 OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI
- CVE-2026-45808 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
- CVE-2026-45807 Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read
- CVE-2026-45806 Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url
- CVE-2026-45805 Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
- CVE-2026-45804 Diffusers: TOCTOU Trust Remote Code Bypass
- CVE-2026-45803 gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
- CVE-2026-45802 FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
- CVE-2026-45801 GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)
- CVE-2026-45800 Vvveb: Authenticated SQL injection in /user/orders via order_by and direction
- CVE-2026-4580 code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection
- CVE-2026-45799 Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
- CVE-2026-45798 Memory corruption in wazuh
- CVE-2026-45797 HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload
- CVE-2026-45796 Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint
- CVE-2026-45795 Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server
- CVE-2026-45794 OpenAM Unsafe Java Deserialization via SNS
- CVE-2026-45793 Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
- CVE-2026-45792 RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM
- CVE-2026-45791 Dokploy: Password Change Does Not Revoke Active Sessions
- CVE-2026-45790 Dokploy: Invitation Role Escalation Allows Organization Takeover
- CVE-2026-4579 code-projects Simple Laundry System Parameters viewdetail.php sql injection
- CVE-2026-45788 Discourse: Secure uploads exposed by hotlinked image copying
- CVE-2026-45787 electerm's encrypt method not safe enough
- CVE-2026-45785 OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle
- CVE-2026-45784 rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
- CVE-2026-45783 libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
- CVE-2026-45782 Cloud Hypervisor: Use-after-free in virtio-block Async I/O Completion
- CVE-2026-45781 MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims
- CVE-2026-45780 Discourse: Private event sample invitees are serialized to non-invited event viewers
- CVE-2026-4578 code-projects Exam Form Submission update_s3.php cross site scripting