Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 728 of 1013.
- CVE-2026-31622 NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
- CVE-2026-31621 bnge: return after auxiliary_device_uninit() in error path
- CVE-2026-31620 ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0
- CVE-2026-31619 ALSA: fireworks: bound device-supplied status before string array lookup
- CVE-2026-31618 fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
- CVE-2026-31617 usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
- CVE-2026-31616 usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
- CVE-2026-31615 usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
- CVE-2026-31614 smb: client: fix off-by-8 bounds check in check_wsl_eas()
- CVE-2026-31613 smb: client: fix OOB reads parsing symlink error response
- CVE-2026-31612 ksmbd: validate EaNameLength in smb2_get_ea()
- CVE-2026-31611 ksmbd: require 3 sub-authorities before reading sub_auth[2]
- CVE-2026-31610 ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
- CVE-2026-3161 IBM Cloud Pak System Risky Cryptographic Algorithm
- CVE-2026-31609 smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
- CVE-2026-31608 smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()
- CVE-2026-31607 usbip: validate number_of_packets in usbip_pack_ret_submit()
- CVE-2026-31606 usb: gadget: f_hid: don't call cdev_init while cdev in use
- CVE-2026-31605 fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
- CVE-2026-31604 wifi: rtw88: fix device leak on probe failure
- CVE-2026-31603 staging: sm750fb: fix division by zero in ps_to_hz()
- CVE-2026-31602 ALSA: ctxfi: Limit PTP to a single page
- CVE-2026-31601 vfio/xe: Reorganize the init to decouple migration from reset
- CVE-2026-31600 arm64: mm: Handle invalid large leaf mappings correctly
- CVE-2026-3160 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
- CVE-2026-31599 media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
- CVE-2026-31598 ocfs2: fix possible deadlock between unlink and dio_end_io_write
- CVE-2026-31597 ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
- CVE-2026-31596 ocfs2: handle invalid dinode in ocfs2_group_extend
- CVE-2026-31595 PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
- CVE-2026-31594 PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
- CVE-2026-31593 KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU
- CVE-2026-31592 KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
- CVE-2026-31591 KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish
- CVE-2026-31590 KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
- CVE-2026-31589 mm: call ->free_folio() directly in folio_unmap_invalidate()
- CVE-2026-31588 KVM: x86: Use scratch field in MMIO fragment to hold small write values
- CVE-2026-31587 ASoC: qcom: q6apm: move component registration to unmanaged version
- CVE-2026-31586 mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
- CVE-2026-31585 media: vidtv: fix nfeeds state corruption on start_streaming failure
- CVE-2026-31584 media: mediatek: vcodec: fix use-after-free in encoder release path
- CVE-2026-31583 media: em28xx: fix use-after-free in em28xx_v4l2_open()
- CVE-2026-31582 hwmon: (powerz) Fix use-after-free on USB disconnect
- CVE-2026-31581 ALSA: 6fire: fix use-after-free on disconnect
- CVE-2026-31580 bcache: fix cached_dev.sb_bio use-after-free and crash
- CVE-2026-3158 Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure
- CVE-2026-31579 wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
- CVE-2026-31578 media: as102: fix to not free memory after the device is registered in as102_usb_probe()
- CVE-2026-31577 nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
- CVE-2026-31576 media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
- CVE-2026-31575 mm/userfaultfd: fix hugetlb fault mutex hash calculation
- CVE-2026-31574 clockevents: Add missing resets of the next_event_forced flag
- CVE-2026-31573 media: verisilicon: Fix kernel panic due to __initconst misuse
- CVE-2026-31572 i2c: designware: amdisp: Fix resume-probe race condition issue
- CVE-2026-31571 drm/i915: Unlink NV12 planes earlier
- CVE-2026-31570 can: gw: fix OOB heap access in cgw_csum_crc8_rel()
- CVE-2026-3157 Information disclosure in Sterling B2B Integrator
- CVE-2026-31569 LoongArch: KVM: Handle the case that EIOINTC's coremap is empty
- CVE-2026-31568 s390/mm: Add missing secure storage access fixups for donated memory
- CVE-2026-31567 PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()
- CVE-2026-31566 drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
- CVE-2026-31565 RDMA/irdma: Fix deadlock during netdev reset with active connections
- CVE-2026-31564 LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access()
- CVE-2026-31563 net: macb: Use dev_consume_skb_any() to free TX SKBs
- CVE-2026-31562 drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register
- CVE-2026-31561 x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
- CVE-2026-31560 spi: spi-dw-dma: fix print error log when wait finish transaction
- CVE-2026-31559 LoongArch: Fix missing NULL checks for kstrdup()
- CVE-2026-31558 LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
- CVE-2026-31557 nvmet: move async event work off nvmet-wq
- CVE-2026-31556 xfs: scrub: unlock dquot before early return in quota scrub
- CVE-2026-31555 futex: Clear stale exiting pointer in futex_lock_pi() retry path
- CVE-2026-31554 futex: Require sys_futex_requeue() to have identical flags
- CVE-2026-31553 KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
- CVE-2026-31552 wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
- CVE-2026-31551 wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
- CVE-2026-31550 pmdomain: bcm: bcm2835-power: Increase ASB control timeout
- CVE-2026-3155 Missing authorization in OneSignal – Web Push Notifications
- CVE-2026-31549 i2c: cp2615: fix serial string NULL-deref at probe
- CVE-2026-31548 wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
- CVE-2026-31547 drm/xe: Fix missing runtime PM reference in ccs_mode_store
- CVE-2026-31546 net: bonding: fix NULL deref in bond_debug_rlb_hash_show
- CVE-2026-31545 NFC: nxp-nci: allow GPIOs to sleep
- CVE-2026-31544 firmware: arm_scmi: Fix NULL dereference on notify error path
- CVE-2026-31543 crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying
- CVE-2026-31542 x86/platform/uv: Handle deconfigured sockets
- CVE-2026-31541 tracing: Fix trace_marker copy link list updates
- CVE-2026-31540 drm/i915/gt: Check set_default_submission() before deferencing
- CVE-2026-31539 smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available
- CVE-2026-31538 smb: server: make use of smbdirect_socket.recv_io.credits.available
- CVE-2026-31537 smb: server: make use of smbdirect_socket.send_io.bcredits
- CVE-2026-31536 smb: server: let send_done handle a completion without IB_SEND_SIGNALED
- CVE-2026-31535 smb: client: make use of smbdirect_socket.recv_io.credits.available
- CVE-2026-31533 net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
- CVE-2026-31532 can: raw: fix ro->uniq use-after-free in raw_rcv()
- CVE-2026-31531 ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
- CVE-2026-31530 cxl/port: Fix use after free of parent_port in cxl_detach_ep()
- CVE-2026-3153 itsourcecode Document Management System register.php sql injection
- CVE-2026-31529 cxl/region: Fix leakage in __construct_region()
- CVE-2026-31528 perf: Make sure to use pmu_ctx->pmu for groups