Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 727 of 1013.
- CVE-2026-31714 f2fs: fix to avoid memory leak in f2fs_rename()
- CVE-2026-31713 fuse: abort on fatal signal during sync init
- CVE-2026-31712 ksmbd: require minimum ACE size in smb_check_perm_dacl()
- CVE-2026-31711 smb: server: fix active_num_conn leak on transport allocation failure
- CVE-2026-31710 smb: client: fix dir separator in SMB1 UNIX mounts
- CVE-2026-3171 SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System queue.php cross site scripting
- CVE-2026-31709 smb: client: validate the whole DACL before rewriting it in cifsacl
- CVE-2026-31708 smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
- CVE-2026-31707 ksmbd: validate response sizes in ipc_validate_msg()
- CVE-2026-31706 ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
- CVE-2026-31705 ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
- CVE-2026-31704 ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
- CVE-2026-31703 writeback: Fix use after free in inode_switch_wbs_work_fn()
- CVE-2026-31702 f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
- CVE-2026-31701 ALSA: caiaq: take a reference on the USB device in create_card()
- CVE-2026-31700 net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
- CVE-2026-3170 SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scripting
- CVE-2026-31699 crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
- CVE-2026-31698 crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
- CVE-2026-31697 crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
- CVE-2026-31696 rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
- CVE-2026-31695 wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
- CVE-2026-31694 fuse: reject oversized dirents in page cache
- CVE-2026-31693 cifs: some missing initializations on replay
- CVE-2026-31692 rtnetlink: add missing netlink_ns_capable() check for peer netns
- CVE-2026-31691 igb: remove napi_synchronize() in igb_down()
- CVE-2026-31690 firmware: thead: Fix buffer overflow and use standard endian macros
- CVE-2026-3169 Tenda F453 httpd SafeEmailFilter fromSafeEmailFilter buffer overflow
- CVE-2026-31689 EDAC/mc: Fix error path ordering in edac_mc_alloc()
- CVE-2026-31687 gpio: omap: do not register driver in probe()
- CVE-2026-31686 mm/kasan: fix double free for kasan pXds
- CVE-2026-31685 netfilter: ip6t_eui64: reject invalid MAC header for all packets
- CVE-2026-31684 net: sched: act_csum: validate nested VLAN headers
- CVE-2026-31683 batman-adv: avoid OGM aggregation when skb tailroom is insufficient
- CVE-2026-31682 bridge: br_nd_send: linearize skb before parsing ND options
- CVE-2026-31681 netfilter: xt_multiport: validate range encoding in checkentry
- CVE-2026-31680 net: ipv6: flowlabel: defer exclusive option free until RCU teardown
- CVE-2026-3168 Tenda F453 httpd NatStaticSetting fromNatStaticSetting buffer overflow
- CVE-2026-31679 openvswitch: validate MPLS set/set_masked payload length
- CVE-2026-31678 openvswitch: defer tunnel netdev_put to RCU release
- CVE-2026-31677 crypto: af_alg - limit RX SG extraction by receive buffer budget
- CVE-2026-31676 rxrpc: only handle RESPONSE during service challenge
- CVE-2026-31675 net/sched: sch_netem: fix out-of-bounds access in packet corruption
- CVE-2026-31674 netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
- CVE-2026-31673 af_unix: read UNIX_DIAG_VFS data under unix_state_lock
- CVE-2026-31672 wifi: rt2x00usb: fix devres lifetime
- CVE-2026-31671 xfrm_user: fix info leak in build_report()
- CVE-2026-31670 net: rfkill: prevent unlimited numbers of rfkill events from being created
- CVE-2026-3167 Tenda F453 httpd webtypelibrary formWebTypeLibrary buffer overflow
- CVE-2026-31669 mptcp: fix slab-use-after-free in __inet_lookup_established
- CVE-2026-31668 seg6: separate dst_cache for input and output paths in seg6 lwtunnel
- CVE-2026-31667 Input: uinput - fix circular locking dependency with ff-core
- CVE-2026-31666 btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()
- CVE-2026-31665 netfilter: nft_ct: fix use-after-free in timeout object destroy
- CVE-2026-31664 xfrm: clear trailing padding in build_polexpire()
- CVE-2026-31663 xfrm: hold dev ref until after transport_finish NF_HOOK
- CVE-2026-31662 tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
- CVE-2026-31661 wifi: brcmsmac: Fix dma_free_coherent() size
- CVE-2026-31660 nfc: pn533: allocate rx skb before consuming bytes
- CVE-2026-3166 Tenda F453 httpd RouteStatic fromRouteStatic buffer overflow
- CVE-2026-31659 batman-adv: reject oversized global TT response buffers
- CVE-2026-31658 net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
- CVE-2026-31657 batman-adv: hold claim backbone gateways by reference
- CVE-2026-31656 drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
- CVE-2026-31655 pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
- CVE-2026-31654 mm/vma: fix memory leak in __mmap_region()
- CVE-2026-31653 mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails
- CVE-2026-31652 mm/damon/stat: deallocate damon_call() failure leaking damon_ctx
- CVE-2026-31651 mmc: vub300: fix NULL-deref on disconnect
- CVE-2026-31650 mmc: vub300: fix use-after-free on disconnect
- CVE-2026-3165 Tenda F453 httpd AdvSetWrlsafeset fromSetWifiGusetBasic buffer overflow
- CVE-2026-31649 net: stmmac: fix integer underflow in chain mode
- CVE-2026-31648 mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
- CVE-2026-31647 idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
- CVE-2026-31646 net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
- CVE-2026-31645 net: lan966x: fix page pool leak in error paths
- CVE-2026-31644 net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
- CVE-2026-31643 rxrpc: Fix key parsing memleak
- CVE-2026-31642 rxrpc: Fix call removal to use RCU safe deletion
- CVE-2026-31641 rxrpc: Fix RxGK token loading to check bounds
- CVE-2026-31640 rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial
- CVE-2026-3164 itsourcecode News Portal Project contactus.php sql injection
- CVE-2026-31639 rxrpc: Fix key reference count leak from call->key
- CVE-2026-31638 rxrpc: Only put the call ref if one was acquired
- CVE-2026-31637 rxrpc: reject undecryptable rxkad response tickets
- CVE-2026-31636 rxrpc: fix RESPONSE authenticator parser OOB read
- CVE-2026-31635 rxrpc: fix oversized RESPONSE authenticator length check
- CVE-2026-31634 rxrpc: fix reference count leak in rxrpc_server_keyring()
- CVE-2026-31633 rxrpc: Fix integer overflow in rxgk_verify_response()
- CVE-2026-31632 rxrpc: Fix leak of rxgk context in rxgk_verify_response()
- CVE-2026-31631 rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()
- CVE-2026-31630 rxrpc: proc: size address buffers for %pISpc output
- CVE-2026-3163 SourceCodester Website Link Extractor URL file_get_contents server-side request forgery
- CVE-2026-31629 nfc: llcp: add missing return after LLCP_CLOSED checks
- CVE-2026-31628 x86/CPU: Fix FPDSS on Zen1
- CVE-2026-31627 i2c: s3c24xx: check the size of the SMBUS message before using it
- CVE-2026-31626 staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
- CVE-2026-31625 HID: alps: fix NULL pointer dereference in alps_raw_event()
- CVE-2026-31624 HID: core: clamp report_size in s32ton() to avoid undefined shift
- CVE-2026-31623 net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()