# Vulnerabilities published in 2026


- [CVE-2026-45880](https://insights.sbomify.com/CVE-2026-45880/): PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (medium 5.5)
- [CVE-2026-4588](https://insights.sbomify.com/CVE-2026-4588/): kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key (medium 6.3)
- [CVE-2026-45879](https://insights.sbomify.com/CVE-2026-45879/): power: supply: bq25980: Fix use-after-free in power_supply_changed() (high 7.8)
- [CVE-2026-45878](https://insights.sbomify.com/CVE-2026-45878/): drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (high 7.8)
- [CVE-2026-45877](https://insights.sbomify.com/CVE-2026-45877/): HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (medium 5.5)
- [CVE-2026-45876](https://insights.sbomify.com/CVE-2026-45876/): arm64/gcs: Fix error handling in arch_set_shadow_stack_status() (medium 5.5)
- [CVE-2026-45875](https://insights.sbomify.com/CVE-2026-45875/): mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (medium 5.5)
- [CVE-2026-45874](https://insights.sbomify.com/CVE-2026-45874/): phy: freescale: imx8qm-hsio: fix NULL pointer dereference (medium 5.5)
- [CVE-2026-45873](https://insights.sbomify.com/CVE-2026-45873/): netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (medium 5.5)
- [CVE-2026-45872](https://insights.sbomify.com/CVE-2026-45872/): scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (medium 5.5)
- [CVE-2026-45871](https://insights.sbomify.com/CVE-2026-45871/): tpm: st33zp24: Fix missing cleanup on get_burstcount() error (medium 5.5)
- [CVE-2026-45870](https://insights.sbomify.com/CVE-2026-45870/): SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (medium 5.5)
- [CVE-2026-4587](https://insights.sbomify.com/CVE-2026-4587/): HybridAuth SSL Curl.php certificate validation (medium 6.3)
- [CVE-2026-45869](https://insights.sbomify.com/CVE-2026-45869/): power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (medium 5.5)
- [CVE-2026-45868](https://insights.sbomify.com/CVE-2026-45868/): pinctrl: single: fix refcount leak in pcs_add_gpio_func() (medium 5.5)
- [CVE-2026-45867](https://insights.sbomify.com/CVE-2026-45867/): power: supply: act8945a: Fix use-after-free in power_supply_changed() (high 7.8)
- [CVE-2026-45866](https://insights.sbomify.com/CVE-2026-45866/): serial: caif: fix use-after-free in caif_serial ldisc_close() (high 7.8)
- [CVE-2026-45865](https://insights.sbomify.com/CVE-2026-45865/): mctp i2c: initialise event handler read bytes (medium 5.5)
- [CVE-2026-45864](https://insights.sbomify.com/CVE-2026-45864/): fs/ntfs3: prevent infinite loops caused by the next valid being the same (medium 5.5)
- [CVE-2026-45863](https://insights.sbomify.com/CVE-2026-45863/): i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (medium 5.5)
- [CVE-2026-45862](https://insights.sbomify.com/CVE-2026-45862/): iommu/vt-d: Flush cache for PASID table before using it (high 7.8)
- [CVE-2026-45861](https://insights.sbomify.com/CVE-2026-45861/): gfs2: Fix slab-use-after-free in qd_put (high 7.8)
- [CVE-2026-45860](https://insights.sbomify.com/CVE-2026-45860/): netfilter: nf_conncount: increase the connection clean up limit to 64 (high 7.5)
- [CVE-2026-4586](https://insights.sbomify.com/CVE-2026-4586/): CodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted upload (medium 5.3)
- [CVE-2026-45859](https://insights.sbomify.com/CVE-2026-45859/): netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (high 7.5)
- [CVE-2026-45858](https://insights.sbomify.com/CVE-2026-45858/): ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (medium 5.5)
- [CVE-2026-45857](https://insights.sbomify.com/CVE-2026-45857/): scsi: csiostor: Fix dereference of null pointer rn (medium 5.5)
- [CVE-2026-45856](https://insights.sbomify.com/CVE-2026-45856/): RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (high 7.1)
- [CVE-2026-45855](https://insights.sbomify.com/CVE-2026-45855/): ata: libata-scsi: avoid Non-NCQ command starvation (medium 5.5)
- [CVE-2026-45854](https://insights.sbomify.com/CVE-2026-45854/): crypto: inside-secure/eip93 - unregister only available algorithm (medium 5.5)
- [CVE-2026-45853](https://insights.sbomify.com/CVE-2026-45853/): drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (high 7.8)
- [CVE-2026-45852](https://insights.sbomify.com/CVE-2026-45852/): RDMA/rxe: Fix double free in rxe_srq_from_init (high 7.8)
- [CVE-2026-45851](https://insights.sbomify.com/CVE-2026-45851/): efi: Fix reservation of unaccepted memory table (high 7.1)
- [CVE-2026-45850](https://insights.sbomify.com/CVE-2026-45850/): ipvs: skip ipv6 extension headers for csum checks (medium 5.5)
- [CVE-2026-4585](https://insights.sbomify.com/CVE-2026-4585/): Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection (critical 9.3)
- [CVE-2026-45849](https://insights.sbomify.com/CVE-2026-45849/): net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (medium 5.5)
- [CVE-2026-45848](https://insights.sbomify.com/CVE-2026-45848/): apparmor: fix NULL sock in aa_sock_file_perm (medium 5.5)
- [CVE-2026-45847](https://insights.sbomify.com/CVE-2026-45847/): net: remove WARN_ON_ONCE when accessing forward path array (medium 5.5)
- [CVE-2026-45846](https://insights.sbomify.com/CVE-2026-45846/): bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (medium 5.5)
- [CVE-2026-45845](https://insights.sbomify.com/CVE-2026-45845/): net/sched: taprio: fix NULL pointer dereference in class dump (medium 5.5)
- [CVE-2026-45844](https://insights.sbomify.com/CVE-2026-45844/): netfilter: arp_tables: fix IEEE1394 ARP payload parsing (medium 5.5)
- [CVE-2026-45843](https://insights.sbomify.com/CVE-2026-45843/): slip: bound decode() reads against the compressed packet length (high 8.2)
- [CVE-2026-45842](https://insights.sbomify.com/CVE-2026-45842/): slip: reject VJ receive packets on instances with no rstate array (medium 5.5)
- [CVE-2026-45841](https://insights.sbomify.com/CVE-2026-45841/): netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (medium 5.5)
- [CVE-2026-45840](https://insights.sbomify.com/CVE-2026-45840/): openvswitch: cap upcall PID array size and pre-size vport replies (medium 5.5)
- [CVE-2026-4584](https://insights.sbomify.com/CVE-2026-4584/): Shenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission (low 2.3)
- [CVE-2026-45839](https://insights.sbomify.com/CVE-2026-45839/): bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (high 7.8)
- [CVE-2026-45838](https://insights.sbomify.com/CVE-2026-45838/): bpf: fix end-of-list detection in cgroup_storage_get_next_key() (medium 5.5)
- [CVE-2026-45837](https://insights.sbomify.com/CVE-2026-45837/): bpf: Fix use-after-free in arena_vm_close on fork (high 7.8)
- [CVE-2026-45836](https://insights.sbomify.com/CVE-2026-45836/): Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (medium 5.5)
- [CVE-2026-45835](https://insights.sbomify.com/CVE-2026-45835/): Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (medium 5.5)
- [CVE-2026-45834](https://insights.sbomify.com/CVE-2026-45834/): Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (medium 5.5)
- [CVE-2026-45833](https://insights.sbomify.com/CVE-2026-45833/): ChromaDB has a code injection vulnerability (critical 9.4)
- [CVE-2026-45832](https://insights.sbomify.com/CVE-2026-45832/): Missing authorization in ChromaDB (high 8.8)
- [CVE-2026-45831](https://insights.sbomify.com/CVE-2026-45831/): ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to (high 8.8)
- [CVE-2026-45830](https://insights.sbomify.com/CVE-2026-45830/): ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection (high 8.8)
- [CVE-2026-4583](https://insights.sbomify.com/CVE-2026-4583/): Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay (low 2.3)
- [CVE-2026-45829](https://insights.sbomify.com/CVE-2026-45829/): ChromaDB Python project has a pre-authentication code injection vulnerability (critical 10.0)
- [CVE-2026-45822](https://insights.sbomify.com/CVE-2026-45822/): decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input (medium 6.6)
- [CVE-2026-45820](https://insights.sbomify.com/CVE-2026-45820/): fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives (medium 6.6)
- [CVE-2026-4582](https://insights.sbomify.com/CVE-2026-4582/): Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication (low 2.3)
- [CVE-2026-45819](https://insights.sbomify.com/CVE-2026-45819/): baseline-browser-mapping process termination on invalid input causes denial of service (medium 6.6)
- [CVE-2026-45816](https://insights.sbomify.com/CVE-2026-45816/): Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request (high 7.5)
- [CVE-2026-45815](https://insights.sbomify.com/CVE-2026-45815/): Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler (high 7.5)
- [CVE-2026-45813](https://insights.sbomify.com/CVE-2026-45813/): Apache NimBLE: Incorrect data validation in BASS add/modify source operation (high 8.8)
- [CVE-2026-45812](https://insights.sbomify.com/CVE-2026-45812/): Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler (medium 6.5)
- [CVE-2026-45811](https://insights.sbomify.com/CVE-2026-45811/): Apache NimBLE: Buffer overflow in socket HCI transport (high 7.5)
- [CVE-2026-45810](https://insights.sbomify.com/CVE-2026-45810/): Nextcloud: Propfind requests for file comments allowed to load comments for other files (medium 6.8)
- [CVE-2026-4581](https://insights.sbomify.com/CVE-2026-4581/): code-projects Simple Laundry System Parameters checklogin.php sql injection (medium 6.9)
- [CVE-2026-45809](https://insights.sbomify.com/CVE-2026-45809/): OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI (high 8.7)
- [CVE-2026-45808](https://insights.sbomify.com/CVE-2026-45808/): OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL (high 7.1)
- [CVE-2026-45807](https://insights.sbomify.com/CVE-2026-45807/): Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read (high 7.7)
- [CVE-2026-45806](https://insights.sbomify.com/CVE-2026-45806/): Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url (high 7.7)
- [CVE-2026-45805](https://insights.sbomify.com/CVE-2026-45805/): Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE (high 8.8)
- [CVE-2026-45804](https://insights.sbomify.com/CVE-2026-45804/): Diffusers: TOCTOU Trust Remote Code Bypass (high 7.5)
- [CVE-2026-45803](https://insights.sbomify.com/CVE-2026-45803/): gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection (low 3.5)
- [CVE-2026-45802](https://insights.sbomify.com/CVE-2026-45802/): FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service (medium 6.0)
- [CVE-2026-45801](https://insights.sbomify.com/CVE-2026-45801/): GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) (medium 5.3)
- [CVE-2026-45800](https://insights.sbomify.com/CVE-2026-45800/): Vvveb: Authenticated SQL injection in /user/orders via order_by and direction (high 8.7)
- [CVE-2026-4580](https://insights.sbomify.com/CVE-2026-4580/): code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection (medium 6.9)
- [CVE-2026-45799](https://insights.sbomify.com/CVE-2026-45799/): Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service (high 7.5)
- [CVE-2026-45798](https://insights.sbomify.com/CVE-2026-45798/): Memory corruption in wazuh (high 7.5)
- [CVE-2026-45797](https://insights.sbomify.com/CVE-2026-45797/): HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload (medium 6.4)
- [CVE-2026-45796](https://insights.sbomify.com/CVE-2026-45796/): Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint (medium 6.5)
- [CVE-2026-45795](https://insights.sbomify.com/CVE-2026-45795/): Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server (medium 5.3)
- [CVE-2026-45794](https://insights.sbomify.com/CVE-2026-45794/): OpenAM Unsafe Java Deserialization via SNS (high 7.7)
- [CVE-2026-45793](https://insights.sbomify.com/CVE-2026-45793/): Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (high 7.5)
- [CVE-2026-45792](https://insights.sbomify.com/CVE-2026-45792/): RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM (medium 6.9)
- [CVE-2026-45791](https://insights.sbomify.com/CVE-2026-45791/): Dokploy: Password Change Does Not Revoke Active Sessions (medium 5.9)
- [CVE-2026-45790](https://insights.sbomify.com/CVE-2026-45790/): Dokploy: Invitation Role Escalation Allows Organization Takeover (high 8.0)
- [CVE-2026-4579](https://insights.sbomify.com/CVE-2026-4579/): code-projects Simple Laundry System Parameters viewdetail.php sql injection (medium 6.9)
- [CVE-2026-45788](https://insights.sbomify.com/CVE-2026-45788/): Discourse: Secure uploads exposed by hotlinked image copying (medium 6.3)
- [CVE-2026-45787](https://insights.sbomify.com/CVE-2026-45787/): electerm's encrypt method not safe enough (medium 6.0)
- [CVE-2026-45785](https://insights.sbomify.com/CVE-2026-45785/): OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle (medium 6.2)
- [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/): rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers (medium 5.1)
- [CVE-2026-45783](https://insights.sbomify.com/CVE-2026-45783/): libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes (high 7.5)
- [CVE-2026-45782](https://insights.sbomify.com/CVE-2026-45782/): Cloud Hypervisor: Use-after-free in virtio-block Async I/O Completion (high 8.9)
- [CVE-2026-45781](https://insights.sbomify.com/CVE-2026-45781/): MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims (low 3.5)
- [CVE-2026-45780](https://insights.sbomify.com/CVE-2026-45780/): Discourse: Private event sample invitees are serialized to non-invited event viewers (medium 5.3)
- [CVE-2026-4578](https://insights.sbomify.com/CVE-2026-4578/): code-projects Exam Form Submission update_s3.php cross site scripting (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/618/