Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 641 of 1013.
- CVE-2026-43394 nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
- CVE-2026-43393 btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()
- CVE-2026-43392 sched_ext: Fix starvation of scx_enable() under fair-class saturation
- CVE-2026-43391 nsfs: tighten permission checks for handle opening
- CVE-2026-43390 nstree: tighten permission checks for listing
- CVE-2026-4339 SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server
- CVE-2026-43389 mm: memfd_luo: always dirty all folios
- CVE-2026-43388 mm/damon/core: clear walk_control on inactive context in damos_walk()
- CVE-2026-43387 staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
- CVE-2026-43386 staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
- CVE-2026-43385 net: Fix rcu_tasks stall in threaded busypoll
- CVE-2026-43384 net/tcp-ao: Fix MAC comparison to be constant-time
- CVE-2026-43383 net/tcp-md5: Fix MAC comparison to be constant-time
- CVE-2026-43382 batman-adv: Avoid double-rtnl_lock ELP metric worker
- CVE-2026-43381 nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
- CVE-2026-43380 hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
- CVE-2026-4338 ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure
- CVE-2026-43379 ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
- CVE-2026-43378 smb: server: fix use-after-free in smb2_open()
- CVE-2026-43377 ksmbd: Don't log keys in SMB3 signing and encryption key generation
- CVE-2026-43376 ksmbd: fix use-after-free by using call_rcu() for oplock_info
- CVE-2026-43375 net: mctp: fix device leak on probe failure
- CVE-2026-43374 net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
- CVE-2026-43373 net: ncsi: fix skb leak in error paths
- CVE-2026-43372 net: dsa: microchip: Fix error path in PTP IRQ setup
- CVE-2026-43371 net: macb: Shuffle the tx ring before enabling tx
- CVE-2026-43370 drm/amdgpu: Fix use-after-free race in VM acquire
- CVE-2026-4337 Unrestricted Upload of File in PuMuKIT application
- CVE-2026-43369 drm/amd: Fix NULL pointer dereference in device cleanup
- CVE-2026-43368 drm/i915: Fix potential overflow of shmem scatterlist length
- CVE-2026-43367 drm/amd: Fix a few more NULL pointer dereference in device cleanup
- CVE-2026-43366 io_uring/kbuf: check if target buffer list is still legacy on recycle
- CVE-2026-43365 xfs: fix undersized l_iclog_roundoff values
- CVE-2026-43364 ublk: fix NULL pointer dereference in ublk_ctrl_set_size()
- CVE-2026-43363 x86/apic: Disable x2apic on resume if the kernel expects so
- CVE-2026-43362 smb: client: fix in-place encryption corruption in SMB2_write()
- CVE-2026-43361 btrfs: fix transaction abort when snapshotting received subvolumes
- CVE-2026-43360 btrfs: fix transaction abort on file creation due to name hash collision
- CVE-2026-4336 Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content
- CVE-2026-43359 btrfs: fix transaction abort on set received ioctl due to item overflow
- CVE-2026-43358 btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer()
- CVE-2026-43357 iio: gyro: mpu3050-core: fix pm_runtime error handling
- CVE-2026-43356 iio: imu: adis: Fix NULL pointer dereference in adis_init
- CVE-2026-43355 iio: light: bh1780: fix PM runtime leak on error path
- CVE-2026-43354 iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
- CVE-2026-43353 i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
- CVE-2026-43352 i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
- CVE-2026-43351 KVM: arm64: Eagerly init vgic dist/redist on vgic creation
- CVE-2026-43350 smb: client: require a full NFS mode SID before reading mode bits
- CVE-2026-4335 ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
- CVE-2026-43349 f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
- CVE-2026-43348 mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER
- CVE-2026-43347 arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
- CVE-2026-43346 ice: ptp: don't WARN when controlling PF is unavailable
- CVE-2026-43345 net: ipa: fix event ring index not programmed for IPA v5.0+
- CVE-2026-43344 perf/x86/intel/uncore: Fix die ID init and look up bugs
- CVE-2026-43343 usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
- CVE-2026-43342 usb: gadget: f_rndis: Protect RNDIS options with mutex
- CVE-2026-43341 net/ipv6: ioam6: prevent schema length wraparound in trace fill
- CVE-2026-43340 comedi: Reinit dev->spinlock between attachments to low-level drivers
- CVE-2026-4334 Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting
- CVE-2026-43339 ipv6: prevent possible UaF in addrconf_permanent_addr()
- CVE-2026-43338 btrfs: reserve enough transaction items for qgroup ioctls
- CVE-2026-43337 drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
- CVE-2026-43336 lib/crypto: chacha: Zeroize permuted_state before it leaves scope
- CVE-2026-43335 interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()
- CVE-2026-43334 Bluetooth: SMP: force responder MITM requirements before building the pairing response
- CVE-2026-43333 bpf: reject direct access to nullable PTR_TO_BUF pointers
- CVE-2026-43332 thermal: core: Fix thermal zone device registration error path
- CVE-2026-43331 x86/kexec: Disable KCOV instrumentation after load_segments()
- CVE-2026-43330 crypto: caam - fix overflow on long hmac keys
- CVE-2026-4333 LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
- CVE-2026-43329 netfilter: flowtable: strictly check for maximum number of actions
- CVE-2026-43328 cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
- CVE-2026-43327 USB: dummy-hcd: Fix locking/synchronization error
- CVE-2026-43326 sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback
- CVE-2026-43325 wifi: iwlwifi: mvm: don't send a 6E related command when not supported
- CVE-2026-43324 USB: dummy-hcd: Fix interrupt synchronization error
- CVE-2026-43323 sched/fair: Fix zero_vruntime tracking fix
- CVE-2026-43322 Bluetooth: hci_sync: Fix UAF in le_read_features_complete
- CVE-2026-43321 bpf: Properly mark live registers for indirect jumps
- CVE-2026-43320 drm/amd/display: Fix dsc eDP issue
- CVE-2026-4332 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-43319 spi: spidev: fix lock inversion between spi_lock and buf_lock
- CVE-2026-43318 drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
- CVE-2026-43317 most: core: fix leak on early registration failure
- CVE-2026-43316 media: solo6x10: Check for out of bounds chip_id
- CVE-2026-43315 KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
- CVE-2026-43314 dm: remove fake timeout to avoid leak request
- CVE-2026-43313 ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
- CVE-2026-43312 media: i2c: ov5647: Initialize subdev before controls
- CVE-2026-43311 soc/tegra: pmc: Fix unsafe generic_handle_irq() call
- CVE-2026-43310 media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
- CVE-2026-4331 Missing authorization in Blog2Social: Social Media Auto Post & Scheduler
- CVE-2026-43309 md raid: fix hang when stopping arrays with metadata through dm-raid
- CVE-2026-43308 btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
- CVE-2026-43307 iio: accel: adxl380: Avoid reading more entries than present in FIFO
- CVE-2026-43306 bpf: crypto: Use the correct destructor kfunc type
- CVE-2026-43305 drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path
- CVE-2026-43304 libceph: define and enforce CEPH_MAX_KEY_LEN