# Vulnerabilities published in 2026


- [CVE-2026-31807](https://insights.sbomify.com/CVE-2026-31807/): SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS (medium 6.4)
- [CVE-2026-31806](https://insights.sbomify.com/CVE-2026-31806/): FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions (critical 9.3)
- [CVE-2026-31805](https://insights.sbomify.com/CVE-2026-31805/): Discourse has a poll authorization bypass via post_id array parameter (medium 5.3)
- [CVE-2026-31804](https://insights.sbomify.com/CVE-2026-31804/): Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server (medium 4.0)
- [CVE-2026-31803](https://insights.sbomify.com/CVE-2026-31803/): Combodo iTop: Reflected XSS in tag admin (high 8.0)
- [CVE-2026-31802](https://insights.sbomify.com/CVE-2026-31802/): node-tar Symlink Path Traversal via Drive-Relative Linkpath (high 8.2)
- [CVE-2026-31801](https://insights.sbomify.com/CVE-2026-31801/): zot create-only policy allows overwrite attempts of existing latest tag (update permission not required) (high 7.7)
- [CVE-2026-31800](https://insights.sbomify.com/CVE-2026-31800/): Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes (high 8.8)
- [CVE-2026-3180](https://insights.sbomify.com/CVE-2026-3180/): Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-31799](https://insights.sbomify.com/CVE-2026-31799/): Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters (medium 4.9)
- [CVE-2026-31798](https://insights.sbomify.com/CVE-2026-31798/): JumpServer Improper Certificate Validation in Custom SMS API Client (medium 5.0)
- [CVE-2026-31797](https://insights.sbomify.com/CVE-2026-31797/): iccDEV has a heap out-of-bounds read in CTiffImg::ReadLine() (medium 6.1)
- [CVE-2026-31796](https://insights.sbomify.com/CVE-2026-31796/): iccDEV has a heap-based buffer overflow in icCurvesFromXml() (high 7.8)
- [CVE-2026-31795](https://insights.sbomify.com/CVE-2026-31795/): iccDEV has a stack buffer overflow write in CIccXform3DLut::Apply() (high 7.8)
- [CVE-2026-31794](https://insights.sbomify.com/CVE-2026-31794/): iccDEV has a SEGV in CIccCLUT::Interp3d() (medium 5.5)
- [CVE-2026-31793](https://insights.sbomify.com/CVE-2026-31793/): iccDEV has a SEGV in CIccCalculatorFunc::ApplySequence() (medium 5.5)
- [CVE-2026-31792](https://insights.sbomify.com/CVE-2026-31792/): iccDEV has a null pointer dereference in CIccTagXmlStruct::ParseTag() (high 7.8)
- [CVE-2026-31790](https://insights.sbomify.com/CVE-2026-31790/): Incorrect Failure Handling in RSA KEM RSASVE Encapsulation (high 7.5)
- [CVE-2026-3179](https://insights.sbomify.com/CVE-2026-3179/): A path traversal vulnerability was found in the FTP Backup on the ADM. (critical 9.2)
- [CVE-2026-31789](https://insights.sbomify.com/CVE-2026-31789/): Heap Buffer Overflow in Hexadecimal Conversion (medium 5.8)
- [CVE-2026-31788](https://insights.sbomify.com/CVE-2026-31788/): xen/privcmd: restrict usage in unprivileged domU (high 8.2)
- [CVE-2026-31787](https://insights.sbomify.com/CVE-2026-31787/): xen/privcmd: fix double free via VMA splitting (high 7.8)
- [CVE-2026-31786](https://insights.sbomify.com/CVE-2026-31786/): Buffer overflow in drivers/xen/sys-hypervisor.c (high 7.8)
- [CVE-2026-31785](https://insights.sbomify.com/CVE-2026-31785/): drm/xe/xe_pagefault: Disallow writes to read-only VMAs (medium 5.5)
- [CVE-2026-31784](https://insights.sbomify.com/CVE-2026-31784/): drm/xe/pxp: Clear restart flag in pxp_start after jumping back (medium 5.5)
- [CVE-2026-31783](https://insights.sbomify.com/CVE-2026-31783/): spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback (medium 5.5)
- [CVE-2026-31782](https://insights.sbomify.com/CVE-2026-31782/): perf/x86: Fix potential bad container_of in intel_pmu_hw_config (high 7.8)
- [CVE-2026-31781](https://insights.sbomify.com/CVE-2026-31781/): drm/ioc32: stop speculation on the drm_compat_ioctl path (medium 5.5)
- [CVE-2026-31780](https://insights.sbomify.com/CVE-2026-31780/): wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation (high 7.8)
- [CVE-2026-3178](https://insights.sbomify.com/CVE-2026-3178/): Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name' (high 7.2)
- [CVE-2026-31779](https://insights.sbomify.com/CVE-2026-31779/): wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() (high 8.1)
- [CVE-2026-31778](https://insights.sbomify.com/CVE-2026-31778/): ALSA: caiaq: fix stack out-of-bounds read in init_card (high 7.1)
- [CVE-2026-31777](https://insights.sbomify.com/CVE-2026-31777/): ALSA: ctxfi: Check the error for index mapping (medium 5.5)
- [CVE-2026-31776](https://insights.sbomify.com/CVE-2026-31776/): ALSA: ctxfi: Fix missing SPDIFI1 index handling (high 7.8)
- [CVE-2026-31775](https://insights.sbomify.com/CVE-2026-31775/): ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization (medium 5.5)
- [CVE-2026-31774](https://insights.sbomify.com/CVE-2026-31774/): io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (high 7.1)
- [CVE-2026-31773](https://insights.sbomify.com/CVE-2026-31773/): Bluetooth: SMP: derive legacy responder STK authentication from MITM state (high 8.8)
- [CVE-2026-31772](https://insights.sbomify.com/CVE-2026-31772/): Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (high 7.8)
- [CVE-2026-31771](https://insights.sbomify.com/CVE-2026-31771/): Bluetooth: hci_event: move wake reason storage into validated event handlers (high 8.1)
- [CVE-2026-31770](https://insights.sbomify.com/CVE-2026-31770/): hwmon: (occ) Fix division by zero in occ_show_power_1() (medium 5.5)
- [CVE-2026-3177](https://insights.sbomify.com/CVE-2026-3177/): Security feature bypass in Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More (medium 5.3)
- [CVE-2026-31769](https://insights.sbomify.com/CVE-2026-31769/): gpib: fix use-after-free in IO ioctl handlers (high 7.8)
- [CVE-2026-31768](https://insights.sbomify.com/CVE-2026-31768/): iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() (high 7.8)
- [CVE-2026-31767](https://insights.sbomify.com/CVE-2026-31767/): drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (medium 5.5)
- [CVE-2026-31766](https://insights.sbomify.com/CVE-2026-31766/): drm/amdgpu: validate doorbell_offset in user queue creation (high 7.1)
- [CVE-2026-31765](https://insights.sbomify.com/CVE-2026-31765/): drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB (medium 5.5)
- [CVE-2026-31764](https://insights.sbomify.com/CVE-2026-31764/): iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only (high 7.8)
- [CVE-2026-31763](https://insights.sbomify.com/CVE-2026-31763/): iio: gyro: mpu3050: Fix incorrect free_irq() variable (medium 5.5)
- [CVE-2026-31762](https://insights.sbomify.com/CVE-2026-31762/): iio: gyro: mpu3050: Fix irq resource leak (medium 5.5)
- [CVE-2026-31761](https://insights.sbomify.com/CVE-2026-31761/): iio: gyro: mpu3050: Move iio_device_register() to correct location (high 7.8)
- [CVE-2026-31760](https://insights.sbomify.com/CVE-2026-31760/): gpib: lpvo_usb: fix memory leak on disconnect (medium 5.5)
- [CVE-2026-3176](https://insights.sbomify.com/CVE-2026-3176/): Missing Authorization in GitLab (low 3.1)
- [CVE-2026-31759](https://insights.sbomify.com/CVE-2026-31759/): usb: ulpi: fix double free in ulpi_register_interface() error path (high 7.8)
- [CVE-2026-31758](https://insights.sbomify.com/CVE-2026-31758/): usb: usbtmc: Flush anchored URBs in usbtmc_release (high 7.8)
- [CVE-2026-31757](https://insights.sbomify.com/CVE-2026-31757/): usb: misc: usbio: Fix URB memory leak on submit failure (medium 5.5)
- [CVE-2026-31756](https://insights.sbomify.com/CVE-2026-31756/): usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() (medium 5.5)
- [CVE-2026-31755](https://insights.sbomify.com/CVE-2026-31755/): usb: cdns3: gadget: fix NULL pointer dereference in ep_queue (medium 5.5)
- [CVE-2026-31754](https://insights.sbomify.com/CVE-2026-31754/): usb: cdns3: gadget: fix state inconsistency on gadget init failure (medium 5.5)
- [CVE-2026-31753](https://insights.sbomify.com/CVE-2026-31753/): auxdisplay: line-display: fix NULL dereference in linedisp_release (medium 5.5)
- [CVE-2026-31752](https://insights.sbomify.com/CVE-2026-31752/): bridge: br_nd_send: validate ND option lengths (medium 5.5)
- [CVE-2026-31751](https://insights.sbomify.com/CVE-2026-31751/): comedi: dt2815: add hardware detection to prevent crash (medium 4.7)
- [CVE-2026-31750](https://insights.sbomify.com/CVE-2026-31750/): comedi: runflags cannot determine whether to reclaim chanlist (medium 5.5)
- [CVE-2026-31749](https://insights.sbomify.com/CVE-2026-31749/): comedi: ni_atmio16d: Fix invalid clean-up after failed attach (medium 5.5)
- [CVE-2026-31748](https://insights.sbomify.com/CVE-2026-31748/): comedi: me_daq: Fix potential overrun of firmware buffer (high 7.8)
- [CVE-2026-31747](https://insights.sbomify.com/CVE-2026-31747/): comedi: me4000: Fix potential overrun of firmware buffer (high 7.8)
- [CVE-2026-31746](https://insights.sbomify.com/CVE-2026-31746/): s390/zcrypt: Fix memory leak with CCA cards used as accelerator (medium 5.5)
- [CVE-2026-31745](https://insights.sbomify.com/CVE-2026-31745/): reset: gpio: fix double free in reset_add_gpio_aux_device() error path (high 7.8)
- [CVE-2026-31744](https://insights.sbomify.com/CVE-2026-31744/): PM: EM: Fix NULL pointer dereference when perf domain ID is not found (medium 5.5)
- [CVE-2026-31743](https://insights.sbomify.com/CVE-2026-31743/): nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (high 7.8)
- [CVE-2026-31742](https://insights.sbomify.com/CVE-2026-31742/): vt: discard stale unicode buffer on alt screen exit after resize (high 7.8)
- [CVE-2026-31741](https://insights.sbomify.com/CVE-2026-31741/): counter: rz-mtu3-cnt: prevent counter from being toggled multiple times (medium 5.5)
- [CVE-2026-31740](https://insights.sbomify.com/CVE-2026-31740/): counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member (medium 5.5)
- [CVE-2026-3174](https://insights.sbomify.com/CVE-2026-3174/): Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update (high 7.5)
- [CVE-2026-31739](https://insights.sbomify.com/CVE-2026-31739/): crypto: tegra - Add missing CRYPTO_ALG_ASYNC (high 8.8)
- [CVE-2026-31738](https://insights.sbomify.com/CVE-2026-31738/): vxlan: validate ND option lengths in vxlan_na_create (medium 5.5)
- [CVE-2026-31737](https://insights.sbomify.com/CVE-2026-31737/): net: ftgmac100: fix ring allocation unwind on open failure (medium 5.5)
- [CVE-2026-31736](https://insights.sbomify.com/CVE-2026-31736/): net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (medium 5.5)
- [CVE-2026-31735](https://insights.sbomify.com/CVE-2026-31735/): iommupt: Fix short gather if the unmap goes into a large mapping (high 8.8)
- [CVE-2026-31734](https://insights.sbomify.com/CVE-2026-31734/): sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU (medium 5.5)
- [CVE-2026-31733](https://insights.sbomify.com/CVE-2026-31733/): sched_ext: Fix stale direct dispatch state in ddsp_dsq_id (medium 5.5)
- [CVE-2026-31732](https://insights.sbomify.com/CVE-2026-31732/): gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() (medium 5.5)
- [CVE-2026-31731](https://insights.sbomify.com/CVE-2026-31731/): thermal: core: Address thermal zone removal races with resume (high 7.8)
- [CVE-2026-31730](https://insights.sbomify.com/CVE-2026-31730/): misc: fastrpc: possible double-free of cctx->remote_heap (high 7.8)
- [CVE-2026-3173](https://insights.sbomify.com/CVE-2026-3173/): Missing authorization in Meta Field Block – Display custom fields in the Block Editor without coding (medium 6.5)
- [CVE-2026-31729](https://insights.sbomify.com/CVE-2026-31729/): usb: typec: ucsi: validate connector number in ucsi_notify_common() (high 7.8)
- [CVE-2026-31728](https://insights.sbomify.com/CVE-2026-31728/): usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop (medium 4.7)
- [CVE-2026-31727](https://insights.sbomify.com/CVE-2026-31727/): usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (medium 5.5)
- [CVE-2026-31726](https://insights.sbomify.com/CVE-2026-31726/): usb: gadget: uvc: fix NULL pointer dereference during unbind race (medium 5.5)
- [CVE-2026-31725](https://insights.sbomify.com/CVE-2026-31725/): usb: gadget: f_ecm: Fix net_device lifecycle with device_move (medium 5.5)
- [CVE-2026-31724](https://insights.sbomify.com/CVE-2026-31724/): usb: gadget: f_eem: Fix net_device lifecycle with device_move (medium 5.5)
- [CVE-2026-31723](https://insights.sbomify.com/CVE-2026-31723/): usb: gadget: f_subset: Fix net_device lifecycle with device_move (medium 5.5)
- [CVE-2026-31722](https://insights.sbomify.com/CVE-2026-31722/): usb: gadget: f_rndis: Fix net_device lifecycle with device_move (medium 5.5)
- [CVE-2026-31721](https://insights.sbomify.com/CVE-2026-31721/): usb: gadget: f_hid: move list and spinlock inits from bind to alloc (medium 5.5)
- [CVE-2026-31720](https://insights.sbomify.com/CVE-2026-31720/): usb: gadget: f_uac1_legacy: validate control request size (high 7.8)
- [CVE-2026-3172](https://insights.sbomify.com/CVE-2026-3172/): pgvector buffer overflow in parallel HNSW index build (high 8.1)
- [CVE-2026-31719](https://insights.sbomify.com/CVE-2026-31719/): crypto: krb5enc - fix async decrypt skipping hash verification (high 7.5)
- [CVE-2026-31718](https://insights.sbomify.com/CVE-2026-31718/): ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger (critical 9.8)
- [CVE-2026-31717](https://insights.sbomify.com/CVE-2026-31717/): ksmbd: validate owner of durable handle on reconnect (high 8.8)
- [CVE-2026-31716](https://insights.sbomify.com/CVE-2026-31716/): fs/ntfs3: validate rec->used in journal-replay file record check (high 7.8)
- [CVE-2026-31715](https://insights.sbomify.com/CVE-2026-31715/): f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/726/