# Vulnerabilities published in 2026


- [CVE-2026-4312](https://insights.sbomify.com/CVE-2026-4312/): DrangSoft｜GCB/FCB Audit Software - Missing Authentication (critical 9.3)
- [CVE-2026-43119](https://insights.sbomify.com/CVE-2026-43119/): Bluetooth: hci_sync: annotate data-races around hdev->req_status (medium 5.5)
- [CVE-2026-43118](https://insights.sbomify.com/CVE-2026-43118/): btrfs: fix zero size inode with non-zero size after log replay (medium 5.5)
- [CVE-2026-43117](https://insights.sbomify.com/CVE-2026-43117/): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (critical 9.1)
- [CVE-2026-43116](https://insights.sbomify.com/CVE-2026-43116/): netfilter: ctnetlink: ensure safe access to master conntrack (high 7.8)
- [CVE-2026-43115](https://insights.sbomify.com/CVE-2026-43115/): srcu: Use irq_work to start GP in tiny SRCU (medium 5.5)
- [CVE-2026-43114](https://insights.sbomify.com/CVE-2026-43114/): netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (critical 9.4)
- [CVE-2026-43113](https://insights.sbomify.com/CVE-2026-43113/): wifi: wl1251: validate packet IDs before indexing tx_frames (high 8.8)
- [CVE-2026-43112](https://insights.sbomify.com/CVE-2026-43112/): fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (high 8.8)
- [CVE-2026-43111](https://insights.sbomify.com/CVE-2026-43111/): HID: roccat: fix use-after-free in roccat_report_event (high 7.8)
- [CVE-2026-43110](https://insights.sbomify.com/CVE-2026-43110/): wifi: brcmfmac: validate bsscfg indices in IF events (high 8.8)
- [CVE-2026-43109](https://insights.sbomify.com/CVE-2026-43109/): x86: shadow stacks: proper error handling for mmap lock (medium 5.5)
- [CVE-2026-43108](https://insights.sbomify.com/CVE-2026-43108/): soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei (medium 5.5)
- [CVE-2026-43107](https://insights.sbomify.com/CVE-2026-43107/): xfrm: account XFRMA_IF_ID in aevent size calculation (medium 5.5)
- [CVE-2026-43106](https://insights.sbomify.com/CVE-2026-43106/): cachefiles: fix incorrect dentry refcount in cachefiles_cull() (high 7.8)
- [CVE-2026-43105](https://insights.sbomify.com/CVE-2026-43105/): drm/vc4: Fix memory leak of BO array in hang state (medium 5.5)
- [CVE-2026-43104](https://insights.sbomify.com/CVE-2026-43104/): drm/vc4: Fix a memory leak in hang state error path (medium 5.5)
- [CVE-2026-43103](https://insights.sbomify.com/CVE-2026-43103/): net: lapbether: handle NETDEV_PRE_TYPE_CHANGE (medium 5.5)
- [CVE-2026-43102](https://insights.sbomify.com/CVE-2026-43102/): net: airoha: Fix memory leak in airoha_qdma_rx_process() (medium 5.5)
- [CVE-2026-43101](https://insights.sbomify.com/CVE-2026-43101/): ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (high 7.5)
- [CVE-2026-43100](https://insights.sbomify.com/CVE-2026-43100/): bridge: guard local VLAN-0 FDB helpers against NULL vlan group (medium 5.5)
- [CVE-2026-43099](https://insights.sbomify.com/CVE-2026-43099/): ipv4: icmp: fix null-ptr-deref in icmp_build_probe() (high 7.5)
- [CVE-2026-43098](https://insights.sbomify.com/CVE-2026-43098/): nfc: s3fwrn5: allocate rx skb before consuming bytes (medium 5.5)
- [CVE-2026-43097](https://insights.sbomify.com/CVE-2026-43097/): PCI: hv: Fix double ida_free in hv_pci_probe error path (high 7.8)
- [CVE-2026-43096](https://insights.sbomify.com/CVE-2026-43096/): mshv: Fix infinite fault loop on permission-denied GPA intercepts (medium 5.5)
- [CVE-2026-43095](https://insights.sbomify.com/CVE-2026-43095/): ASoC: SDCA: Fix errors in IRQ cleanup (medium 5.5)
- [CVE-2026-43094](https://insights.sbomify.com/CVE-2026-43094/): ixgbevf: add missing negotiate_features op to Hyper-V ops table (medium 5.5)
- [CVE-2026-43093](https://insights.sbomify.com/CVE-2026-43093/): xsk: tighten UMEM headroom validation to account for tailroom and min frame (high 7.8)
- [CVE-2026-43092](https://insights.sbomify.com/CVE-2026-43092/): xsk: validate MTU against usable frame size on bind (medium 5.5)
- [CVE-2026-43091](https://insights.sbomify.com/CVE-2026-43091/): xfrm: Wait for RCU readers during policy netns exit (high 7.8)
- [CVE-2026-43090](https://insights.sbomify.com/CVE-2026-43090/): xfrm: fix refcount leak in xfrm_migrate_policy_find (medium 5.5)
- [CVE-2026-4309](https://insights.sbomify.com/CVE-2026-4309/): Missing authorization in Aterm GB1200PE (medium 6.3)
- [CVE-2026-43089](https://insights.sbomify.com/CVE-2026-43089/): xfrm_user: fix info leak in build_mapping() (medium 5.5)
- [CVE-2026-43088](https://insights.sbomify.com/CVE-2026-43088/): net: af_key: zero aligned sockaddr tail in PF_KEY exports (medium 5.5)
- [CVE-2026-43087](https://insights.sbomify.com/CVE-2026-43087/): pinctrl: mcp23s08: Disable all pin interrupts during probe (medium 5.5)
- [CVE-2026-43086](https://insights.sbomify.com/CVE-2026-43086/): ipvs: fix NULL deref in ip_vs_add_service error path (medium 5.5)
- [CVE-2026-43085](https://insights.sbomify.com/CVE-2026-43085/): netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (medium 5.5)
- [CVE-2026-43084](https://insights.sbomify.com/CVE-2026-43084/): netfilter: nfnetlink_queue: make hash table per queue (high 7.8)
- [CVE-2026-43083](https://insights.sbomify.com/CVE-2026-43083/): net: ioam6: fix OOB and missing lock (critical 9.1)
- [CVE-2026-43082](https://insights.sbomify.com/CVE-2026-43082/): net: txgbe: leave space for null terminators on property_entry (medium 5.5)
- [CVE-2026-43081](https://insights.sbomify.com/CVE-2026-43081/): net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (medium 5.5)
- [CVE-2026-43080](https://insights.sbomify.com/CVE-2026-43080/): l2tp: Drop large packets with UDP encap (medium 5.5)
- [CVE-2026-4308](https://insights.sbomify.com/CVE-2026-4308/): frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery (medium 5.3)
- [CVE-2026-43079](https://insights.sbomify.com/CVE-2026-43079/): perf/x86/intel/uncore: Skip discovery table for offline dies (medium 5.5)
- [CVE-2026-43078](https://insights.sbomify.com/CVE-2026-43078/): crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (high 7.8)
- [CVE-2026-43077](https://insights.sbomify.com/CVE-2026-43077/): crypto: algif_aead - Fix minimum RX size check for decryption (medium 5.5)
- [CVE-2026-43076](https://insights.sbomify.com/CVE-2026-43076/): ocfs2: validate inline data i_size during inode read (high 7.8)
- [CVE-2026-43075](https://insights.sbomify.com/CVE-2026-43075/): ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (high 7.8)
- [CVE-2026-43074](https://insights.sbomify.com/CVE-2026-43074/): eventpoll: defer struct eventpoll free to RCU grace period (high 7.8)
- [CVE-2026-43073](https://insights.sbomify.com/CVE-2026-43073/): x86-64: rename misleadingly named '__copy_user_nocache()' function (medium 5.5)
- [CVE-2026-43072](https://insights.sbomify.com/CVE-2026-43072/): drm/vc4: platform_get_irq_byname() returns an int (medium 5.5)
- [CVE-2026-43071](https://insights.sbomify.com/CVE-2026-43071/): dcache: Limit the minimal number of bucket to two (critical 9.1)
- [CVE-2026-43070](https://insights.sbomify.com/CVE-2026-43070/): bpf: Reset register ID for BPF_END value tracking (high 7.8)
- [CVE-2026-4307](https://insights.sbomify.com/CVE-2026-4307/): frdel/agent0ai agent-zero files.py get_abs_path path traversal (medium 5.3)
- [CVE-2026-43069](https://insights.sbomify.com/CVE-2026-43069/): Bluetooth: hci_ll: Fix firmware leak on error path (medium 5.5)
- [CVE-2026-43068](https://insights.sbomify.com/CVE-2026-43068/): ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (medium 5.5)
- [CVE-2026-43067](https://insights.sbomify.com/CVE-2026-43067/): ext4: handle wraparound when searching for blocks for indirect mapped blocks (critical 9.8)
- [CVE-2026-43066](https://insights.sbomify.com/CVE-2026-43066/): ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (medium 5.5)
- [CVE-2026-43065](https://insights.sbomify.com/CVE-2026-43065/): ext4: always drain queued discard work in ext4_mb_release() (medium 5.5)
- [CVE-2026-43064](https://insights.sbomify.com/CVE-2026-43064/): dmaengine: idxd: Fix not releasing workqueue on .release() (medium 5.5)
- [CVE-2026-43063](https://insights.sbomify.com/CVE-2026-43063/): xfs: don't irele after failing to iget in xfs_attri_recover_work (high 7.8)
- [CVE-2026-43062](https://insights.sbomify.com/CVE-2026-43062/): Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() (high 7.1)
- [CVE-2026-43061](https://insights.sbomify.com/CVE-2026-43061/): serial: 8250: Fix TX deadlock when using DMA (medium 5.5)
- [CVE-2026-43060](https://insights.sbomify.com/CVE-2026-43060/): netfilter: nft_ct: drop pending enqueued packets on removal (high 7.8)
- [CVE-2026-4306](https://insights.sbomify.com/CVE-2026-4306/): WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter (high 7.5)
- [CVE-2026-43059](https://insights.sbomify.com/CVE-2026-43059/): Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (high 7.8)
- [CVE-2026-43058](https://insights.sbomify.com/CVE-2026-43058/): media: vidtv: fix pass-by-value structs causing MSAN warnings (medium 5.5)
- [CVE-2026-43057](https://insights.sbomify.com/CVE-2026-43057/): net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (high 7.5)
- [CVE-2026-43056](https://insights.sbomify.com/CVE-2026-43056/): net: mana: fix use-after-free in add_adev() error path (high 7.8)
- [CVE-2026-43055](https://insights.sbomify.com/CVE-2026-43055/): scsi: target: file: Use kzalloc_flex for aio_cmd (high 7.5)
- [CVE-2026-43054](https://insights.sbomify.com/CVE-2026-43054/): scsi: target: tcm_loop: Drain commands in target_reset handler (medium 5.5)
- [CVE-2026-43053](https://insights.sbomify.com/CVE-2026-43053/): xfs: close crash window in attr dabtree inactivation (medium 4.7)
- [CVE-2026-43052](https://insights.sbomify.com/CVE-2026-43052/): wifi: mac80211: check tdls flag in ieee80211_tdls_oper (high 7.1)
- [CVE-2026-43051](https://insights.sbomify.com/CVE-2026-43051/): HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (high 8.1)
- [CVE-2026-43050](https://insights.sbomify.com/CVE-2026-43050/): atm: lec: fix use-after-free in sock_def_readable() (high 7.0)
- [CVE-2026-4305](https://insights.sbomify.com/CVE-2026-4305/): Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter (medium 6.1)
- [CVE-2026-43049](https://insights.sbomify.com/CVE-2026-43049/): HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (high 7.8)
- [CVE-2026-43048](https://insights.sbomify.com/CVE-2026-43048/): HID: core: Mitigate potential OOB by removing bogus memset() (high 8.8)
- [CVE-2026-43047](https://insights.sbomify.com/CVE-2026-43047/): HID: multitouch: Check to ensure report responses match the request (high 7.8)
- [CVE-2026-43046](https://insights.sbomify.com/CVE-2026-43046/): btrfs: reject root items with drop_progress and zero drop_level (medium 5.5)
- [CVE-2026-43045](https://insights.sbomify.com/CVE-2026-43045/): mshv: Fix error handling in mshv_region_pin (medium 5.5)
- [CVE-2026-43044](https://insights.sbomify.com/CVE-2026-43044/): crypto: caam - fix DMA corruption on long hmac keys (high 7.8)
- [CVE-2026-43043](https://insights.sbomify.com/CVE-2026-43043/): crypto: af-alg - fix NULL pointer dereference in scatterwalk (medium 5.5)
- [CVE-2026-43042](https://insights.sbomify.com/CVE-2026-43042/): mpls: add seqcount to protect the platform_label{,s} pair (high 7.1)
- [CVE-2026-43041](https://insights.sbomify.com/CVE-2026-43041/): net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak (medium 5.5)
- [CVE-2026-43040](https://insights.sbomify.com/CVE-2026-43040/): net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (high 7.1)
- [CVE-2026-4304](https://insights.sbomify.com/CVE-2026-4304/): WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter (high 7.5)
- [CVE-2026-43039](https://insights.sbomify.com/CVE-2026-43039/): net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch (critical 9.8)
- [CVE-2026-43038](https://insights.sbomify.com/CVE-2026-43038/): ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (critical 9.8)
- [CVE-2026-43037](https://insights.sbomify.com/CVE-2026-43037/): ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (critical 9.8)
- [CVE-2026-43036](https://insights.sbomify.com/CVE-2026-43036/): net: use skb_header_pointer() for TCPv4 GSO frag_off check (medium 5.5)
- [CVE-2026-43035](https://insights.sbomify.com/CVE-2026-43035/): net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (medium 5.5)
- [CVE-2026-43034](https://insights.sbomify.com/CVE-2026-43034/): bnxt_en: set backing store type from query type (medium 5.5)
- [CVE-2026-43033](https://insights.sbomify.com/CVE-2026-43033/): crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (high 7.8)
- [CVE-2026-43032](https://insights.sbomify.com/CVE-2026-43032/): NFC: pn533: bound the UART receive buffer (medium 5.5)
- [CVE-2026-43031](https://insights.sbomify.com/CVE-2026-43031/): net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets (high 7.5)
- [CVE-2026-43030](https://insights.sbomify.com/CVE-2026-43030/): bpf: Fix regsafe() for pointers to packet (high 7.8)
- [CVE-2026-4303](https://insights.sbomify.com/CVE-2026-4303/): Cross-site scripting in WP Visitor Statistics (Real Time Traffic) (medium 6.4)
- [CVE-2026-43029](https://insights.sbomify.com/CVE-2026-43029/): mptcp: fix soft lockup in mptcp_recvmsg() (high 7.5)
- [CVE-2026-43028](https://insights.sbomify.com/CVE-2026-43028/): netfilter: x_tables: ensure names are nul-terminated (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/644/