Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 726 of 1013.
- CVE-2026-31807 SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS
- CVE-2026-31806 FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions
- CVE-2026-31805 Discourse has a poll authorization bypass via post_id array parameter
- CVE-2026-31804 Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server
- CVE-2026-31803 Combodo iTop: Reflected XSS in tag admin
- CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath
- CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)
- CVE-2026-31800 Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
- CVE-2026-3180 Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
- CVE-2026-31799 Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters
- CVE-2026-31798 JumpServer Improper Certificate Validation in Custom SMS API Client
- CVE-2026-31797 iccDEV has a heap out-of-bounds read in CTiffImg::ReadLine()
- CVE-2026-31796 iccDEV has a heap-based buffer overflow in icCurvesFromXml()
- CVE-2026-31795 iccDEV has a stack buffer overflow write in CIccXform3DLut::Apply()
- CVE-2026-31794 iccDEV has a SEGV in CIccCLUT::Interp3d()
- CVE-2026-31793 iccDEV has a SEGV in CIccCalculatorFunc::ApplySequence()
- CVE-2026-31792 iccDEV has a null pointer dereference in CIccTagXmlStruct::ParseTag()
- CVE-2026-31790 Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
- CVE-2026-3179 A path traversal vulnerability was found in the FTP Backup on the ADM.
- CVE-2026-31789 Heap Buffer Overflow in Hexadecimal Conversion
- CVE-2026-31788 xen/privcmd: restrict usage in unprivileged domU
- CVE-2026-31787 xen/privcmd: fix double free via VMA splitting
- CVE-2026-31786 Buffer overflow in drivers/xen/sys-hypervisor.c
- CVE-2026-31785 drm/xe/xe_pagefault: Disallow writes to read-only VMAs
- CVE-2026-31784 drm/xe/pxp: Clear restart flag in pxp_start after jumping back
- CVE-2026-31783 spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback
- CVE-2026-31782 perf/x86: Fix potential bad container_of in intel_pmu_hw_config
- CVE-2026-31781 drm/ioc32: stop speculation on the drm_compat_ioctl path
- CVE-2026-31780 wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
- CVE-2026-3178 Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'
- CVE-2026-31779 wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
- CVE-2026-31778 ALSA: caiaq: fix stack out-of-bounds read in init_card
- CVE-2026-31777 ALSA: ctxfi: Check the error for index mapping
- CVE-2026-31776 ALSA: ctxfi: Fix missing SPDIFI1 index handling
- CVE-2026-31775 ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization
- CVE-2026-31774 io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
- CVE-2026-31773 Bluetooth: SMP: derive legacy responder STK authentication from MITM state
- CVE-2026-31772 Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
- CVE-2026-31771 Bluetooth: hci_event: move wake reason storage into validated event handlers
- CVE-2026-31770 hwmon: (occ) Fix division by zero in occ_show_power_1()
- CVE-2026-3177 Security feature bypass in Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
- CVE-2026-31769 gpib: fix use-after-free in IO ioctl handlers
- CVE-2026-31768 iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
- CVE-2026-31767 drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode
- CVE-2026-31766 drm/amdgpu: validate doorbell_offset in user queue creation
- CVE-2026-31765 drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
- CVE-2026-31764 iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
- CVE-2026-31763 iio: gyro: mpu3050: Fix incorrect free_irq() variable
- CVE-2026-31762 iio: gyro: mpu3050: Fix irq resource leak
- CVE-2026-31761 iio: gyro: mpu3050: Move iio_device_register() to correct location
- CVE-2026-31760 gpib: lpvo_usb: fix memory leak on disconnect
- CVE-2026-3176 Missing Authorization in GitLab
- CVE-2026-31759 usb: ulpi: fix double free in ulpi_register_interface() error path
- CVE-2026-31758 usb: usbtmc: Flush anchored URBs in usbtmc_release
- CVE-2026-31757 usb: misc: usbio: Fix URB memory leak on submit failure
- CVE-2026-31756 usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
- CVE-2026-31755 usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
- CVE-2026-31754 usb: cdns3: gadget: fix state inconsistency on gadget init failure
- CVE-2026-31753 auxdisplay: line-display: fix NULL dereference in linedisp_release
- CVE-2026-31752 bridge: br_nd_send: validate ND option lengths
- CVE-2026-31751 comedi: dt2815: add hardware detection to prevent crash
- CVE-2026-31750 comedi: runflags cannot determine whether to reclaim chanlist
- CVE-2026-31749 comedi: ni_atmio16d: Fix invalid clean-up after failed attach
- CVE-2026-31748 comedi: me_daq: Fix potential overrun of firmware buffer
- CVE-2026-31747 comedi: me4000: Fix potential overrun of firmware buffer
- CVE-2026-31746 s390/zcrypt: Fix memory leak with CCA cards used as accelerator
- CVE-2026-31745 reset: gpio: fix double free in reset_add_gpio_aux_device() error path
- CVE-2026-31744 PM: EM: Fix NULL pointer dereference when perf domain ID is not found
- CVE-2026-31743 nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
- CVE-2026-31742 vt: discard stale unicode buffer on alt screen exit after resize
- CVE-2026-31741 counter: rz-mtu3-cnt: prevent counter from being toggled multiple times
- CVE-2026-31740 counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
- CVE-2026-3174 Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update
- CVE-2026-31739 crypto: tegra - Add missing CRYPTO_ALG_ASYNC
- CVE-2026-31738 vxlan: validate ND option lengths in vxlan_na_create
- CVE-2026-31737 net: ftgmac100: fix ring allocation unwind on open failure
- CVE-2026-31736 net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
- CVE-2026-31735 iommupt: Fix short gather if the unmap goes into a large mapping
- CVE-2026-31734 sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU
- CVE-2026-31733 sched_ext: Fix stale direct dispatch state in ddsp_dsq_id
- CVE-2026-31732 gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
- CVE-2026-31731 thermal: core: Address thermal zone removal races with resume
- CVE-2026-31730 misc: fastrpc: possible double-free of cctx->remote_heap
- CVE-2026-3173 Missing authorization in Meta Field Block – Display custom fields in the Block Editor without coding
- CVE-2026-31729 usb: typec: ucsi: validate connector number in ucsi_notify_common()
- CVE-2026-31728 usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
- CVE-2026-31727 usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
- CVE-2026-31726 usb: gadget: uvc: fix NULL pointer dereference during unbind race
- CVE-2026-31725 usb: gadget: f_ecm: Fix net_device lifecycle with device_move
- CVE-2026-31724 usb: gadget: f_eem: Fix net_device lifecycle with device_move
- CVE-2026-31723 usb: gadget: f_subset: Fix net_device lifecycle with device_move
- CVE-2026-31722 usb: gadget: f_rndis: Fix net_device lifecycle with device_move
- CVE-2026-31721 usb: gadget: f_hid: move list and spinlock inits from bind to alloc
- CVE-2026-31720 usb: gadget: f_uac1_legacy: validate control request size
- CVE-2026-3172 pgvector buffer overflow in parallel HNSW index build
- CVE-2026-31719 crypto: krb5enc - fix async decrypt skipping hash verification
- CVE-2026-31718 ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
- CVE-2026-31717 ksmbd: validate owner of durable handle on reconnect
- CVE-2026-31716 fs/ntfs3: validate rec->used in journal-replay file record check
- CVE-2026-31715 f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()