Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 644 of 1013.
- CVE-2026-4312 DrangSoft｜GCB/FCB Audit Software - Missing Authentication
- CVE-2026-43119 Bluetooth: hci_sync: annotate data-races around hdev->req_status
- CVE-2026-43118 btrfs: fix zero size inode with non-zero size after log replay
- CVE-2026-43117 btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
- CVE-2026-43116 netfilter: ctnetlink: ensure safe access to master conntrack
- CVE-2026-43115 srcu: Use irq_work to start GP in tiny SRCU
- CVE-2026-43114 netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
- CVE-2026-43113 wifi: wl1251: validate packet IDs before indexing tx_frames
- CVE-2026-43112 fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
- CVE-2026-43111 HID: roccat: fix use-after-free in roccat_report_event
- CVE-2026-43110 wifi: brcmfmac: validate bsscfg indices in IF events
- CVE-2026-43109 x86: shadow stacks: proper error handling for mmap lock
- CVE-2026-43108 soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
- CVE-2026-43107 xfrm: account XFRMA_IF_ID in aevent size calculation
- CVE-2026-43106 cachefiles: fix incorrect dentry refcount in cachefiles_cull()
- CVE-2026-43105 drm/vc4: Fix memory leak of BO array in hang state
- CVE-2026-43104 drm/vc4: Fix a memory leak in hang state error path
- CVE-2026-43103 net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
- CVE-2026-43102 net: airoha: Fix memory leak in airoha_qdma_rx_process()
- CVE-2026-43101 ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
- CVE-2026-43100 bridge: guard local VLAN-0 FDB helpers against NULL vlan group
- CVE-2026-43099 ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
- CVE-2026-43098 nfc: s3fwrn5: allocate rx skb before consuming bytes
- CVE-2026-43097 PCI: hv: Fix double ida_free in hv_pci_probe error path
- CVE-2026-43096 mshv: Fix infinite fault loop on permission-denied GPA intercepts
- CVE-2026-43095 ASoC: SDCA: Fix errors in IRQ cleanup
- CVE-2026-43094 ixgbevf: add missing negotiate_features op to Hyper-V ops table
- CVE-2026-43093 xsk: tighten UMEM headroom validation to account for tailroom and min frame
- CVE-2026-43092 xsk: validate MTU against usable frame size on bind
- CVE-2026-43091 xfrm: Wait for RCU readers during policy netns exit
- CVE-2026-43090 xfrm: fix refcount leak in xfrm_migrate_policy_find
- CVE-2026-4309 Missing authorization in Aterm GB1200PE
- CVE-2026-43089 xfrm_user: fix info leak in build_mapping()
- CVE-2026-43088 net: af_key: zero aligned sockaddr tail in PF_KEY exports
- CVE-2026-43087 pinctrl: mcp23s08: Disable all pin interrupts during probe
- CVE-2026-43086 ipvs: fix NULL deref in ip_vs_add_service error path
- CVE-2026-43085 netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
- CVE-2026-43084 netfilter: nfnetlink_queue: make hash table per queue
- CVE-2026-43083 net: ioam6: fix OOB and missing lock
- CVE-2026-43082 net: txgbe: leave space for null terminators on property_entry
- CVE-2026-43081 net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
- CVE-2026-43080 l2tp: Drop large packets with UDP encap
- CVE-2026-4308 frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery
- CVE-2026-43079 perf/x86/intel/uncore: Skip discovery table for offline dies
- CVE-2026-43078 crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
- CVE-2026-43077 crypto: algif_aead - Fix minimum RX size check for decryption
- CVE-2026-43076 ocfs2: validate inline data i_size during inode read
- CVE-2026-43075 ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
- CVE-2026-43074 eventpoll: defer struct eventpoll free to RCU grace period
- CVE-2026-43073 x86-64: rename misleadingly named '__copy_user_nocache()' function
- CVE-2026-43072 drm/vc4: platform_get_irq_byname() returns an int
- CVE-2026-43071 dcache: Limit the minimal number of bucket to two
- CVE-2026-43070 bpf: Reset register ID for BPF_END value tracking
- CVE-2026-4307 frdel/agent0ai agent-zero files.py get_abs_path path traversal
- CVE-2026-43069 Bluetooth: hci_ll: Fix firmware leak on error path
- CVE-2026-43068 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
- CVE-2026-43067 ext4: handle wraparound when searching for blocks for indirect mapped blocks
- CVE-2026-43066 ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
- CVE-2026-43065 ext4: always drain queued discard work in ext4_mb_release()
- CVE-2026-43064 dmaengine: idxd: Fix not releasing workqueue on .release()
- CVE-2026-43063 xfs: don't irele after failing to iget in xfs_attri_recover_work
- CVE-2026-43062 Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
- CVE-2026-43061 serial: 8250: Fix TX deadlock when using DMA
- CVE-2026-43060 netfilter: nft_ct: drop pending enqueued packets on removal
- CVE-2026-4306 WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter
- CVE-2026-43059 Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
- CVE-2026-43058 media: vidtv: fix pass-by-value structs causing MSAN warnings
- CVE-2026-43057 net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
- CVE-2026-43056 net: mana: fix use-after-free in add_adev() error path
- CVE-2026-43055 scsi: target: file: Use kzalloc_flex for aio_cmd
- CVE-2026-43054 scsi: target: tcm_loop: Drain commands in target_reset handler
- CVE-2026-43053 xfs: close crash window in attr dabtree inactivation
- CVE-2026-43052 wifi: mac80211: check tdls flag in ieee80211_tdls_oper
- CVE-2026-43051 HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
- CVE-2026-43050 atm: lec: fix use-after-free in sock_def_readable()
- CVE-2026-4305 Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter
- CVE-2026-43049 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
- CVE-2026-43048 HID: core: Mitigate potential OOB by removing bogus memset()
- CVE-2026-43047 HID: multitouch: Check to ensure report responses match the request
- CVE-2026-43046 btrfs: reject root items with drop_progress and zero drop_level
- CVE-2026-43045 mshv: Fix error handling in mshv_region_pin
- CVE-2026-43044 crypto: caam - fix DMA corruption on long hmac keys
- CVE-2026-43043 crypto: af-alg - fix NULL pointer dereference in scatterwalk
- CVE-2026-43042 mpls: add seqcount to protect the platform_label{,s} pair
- CVE-2026-43041 net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
- CVE-2026-43040 net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
- CVE-2026-4304 WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter
- CVE-2026-43039 net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
- CVE-2026-43038 ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
- CVE-2026-43037 ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
- CVE-2026-43036 net: use skb_header_pointer() for TCPv4 GSO frag_off check
- CVE-2026-43035 net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
- CVE-2026-43034 bnxt_en: set backing store type from query type
- CVE-2026-43033 crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
- CVE-2026-43032 NFC: pn533: bound the UART receive buffer
- CVE-2026-43031 net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
- CVE-2026-43030 bpf: Fix regsafe() for pointers to packet
- CVE-2026-4303 Cross-site scripting in WP Visitor Statistics (Real Time Traffic)
- CVE-2026-43029 mptcp: fix soft lockup in mptcp_recvmsg()
- CVE-2026-43028 netfilter: x_tables: ensure names are nul-terminated