# Vulnerabilities published in 2026


- [CVE-2026-31436](https://insights.sbomify.com/CVE-2026-31436/): dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (critical 9.8)
- [CVE-2026-31435](https://insights.sbomify.com/CVE-2026-31435/): netfs: Fix read abandonment during retry (high 8.8)
- [CVE-2026-31434](https://insights.sbomify.com/CVE-2026-31434/): btrfs: fix leak of kobject name for sub-group space_info (medium 5.5)
- [CVE-2026-31433](https://insights.sbomify.com/CVE-2026-31433/): ksmbd: fix potencial OOB in get_file_all_info() for compound requests (high 8.8)
- [CVE-2026-31432](https://insights.sbomify.com/CVE-2026-31432/): ksmbd: fix OOB write in QUERY_INFO for compound requests (high 8.8)
- [CVE-2026-31431](https://insights.sbomify.com/CVE-2026-31431/): Linux Kernel Incorrect Resource Transfer Between Spheres (high 7.8, exploited in the wild)
- [CVE-2026-31430](https://insights.sbomify.com/CVE-2026-31430/): X.509: Fix out-of-bounds access when parsing extensions (high 7.1)
- [CVE-2026-3143](https://insights.sbomify.com/CVE-2026-3143/): Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation (medium 5.3)
- [CVE-2026-31429](https://insights.sbomify.com/CVE-2026-31429/): net: skb: fix cross-cache free of KFENCE-allocated skb head (medium 5.5)
- [CVE-2026-31428](https://insights.sbomify.com/CVE-2026-31428/): netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (medium 5.5)
- [CVE-2026-31427](https://insights.sbomify.com/CVE-2026-31427/): netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (medium 5.5)
- [CVE-2026-31426](https://insights.sbomify.com/CVE-2026-31426/): ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (high 7.0)
- [CVE-2026-31425](https://insights.sbomify.com/CVE-2026-31425/): rds: ib: reject FRMR registration before IB connection is established (medium 5.5)
- [CVE-2026-31424](https://insights.sbomify.com/CVE-2026-31424/): netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (medium 5.5)
- [CVE-2026-31423](https://insights.sbomify.com/CVE-2026-31423/): net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (medium 5.5)
- [CVE-2026-31422](https://insights.sbomify.com/CVE-2026-31422/): net/sched: cls_flow: fix NULL pointer dereference on shared blocks (medium 5.5)
- [CVE-2026-31421](https://insights.sbomify.com/CVE-2026-31421/): net/sched: cls_fw: fix NULL pointer dereference on shared blocks (medium 5.5)
- [CVE-2026-31420](https://insights.sbomify.com/CVE-2026-31420/): bridge: mrp: reject zero test interval to avoid OOM panic (medium 5.5)
- [CVE-2026-3142](https://insights.sbomify.com/CVE-2026-3142/): Cross-site scripting in Pinterest Site Verification plugin using Meta Tag (medium 6.4)
- [CVE-2026-31419](https://insights.sbomify.com/CVE-2026-31419/): net: bonding: fix use-after-free in bond_xmit_broadcast() (high 7.8)
- [CVE-2026-31418](https://insights.sbomify.com/CVE-2026-31418/): netfilter: ipset: drop logically empty buckets in mtype_del (medium 5.5)
- [CVE-2026-31417](https://insights.sbomify.com/CVE-2026-31417/): net/x25: Fix overflow when accumulating packets (high 7.5)
- [CVE-2026-31416](https://insights.sbomify.com/CVE-2026-31416/): netfilter: nfnetlink_log: account for netlink header size (medium 5.5)
- [CVE-2026-31415](https://insights.sbomify.com/CVE-2026-31415/): ipv6: avoid overflows in ip6_datagram_send_ctl() (medium 5.5)
- [CVE-2026-31414](https://insights.sbomify.com/CVE-2026-31414/): netfilter: nf_conntrack_expect: use expect->helper (critical 9.8)
- [CVE-2026-31413](https://insights.sbomify.com/CVE-2026-31413/): bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (high 7.8)
- [CVE-2026-31412](https://insights.sbomify.com/CVE-2026-31412/): usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() (medium 5.5)
- [CVE-2026-31411](https://insights.sbomify.com/CVE-2026-31411/): net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (medium 5.5)
- [CVE-2026-31410](https://insights.sbomify.com/CVE-2026-31410/): ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION (medium 5.5)
- [CVE-2026-3141](https://insights.sbomify.com/CVE-2026-3141/): FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter (critical 9.1)
- [CVE-2026-31409](https://insights.sbomify.com/CVE-2026-31409/): ksmbd: unset conn->binding on failed binding request (high 8.8)
- [CVE-2026-31408](https://insights.sbomify.com/CVE-2026-31408/): Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (high 8.8)
- [CVE-2026-31407](https://insights.sbomify.com/CVE-2026-31407/): netfilter: conntrack: add missing netlink policy validations (high 7.1)
- [CVE-2026-31406](https://insights.sbomify.com/CVE-2026-31406/): xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (high 7.8)
- [CVE-2026-31405](https://insights.sbomify.com/CVE-2026-31405/): media: dvb-net: fix OOB access in ULE extension header tables (critical 9.8)
- [CVE-2026-31403](https://insights.sbomify.com/CVE-2026-31403/): NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (high 7.8)
- [CVE-2026-31402](https://insights.sbomify.com/CVE-2026-31402/): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (critical 9.8)
- [CVE-2026-31401](https://insights.sbomify.com/CVE-2026-31401/): HID: bpf: prevent buffer overflow in hid_hw_request (high 7.8)
- [CVE-2026-31400](https://insights.sbomify.com/CVE-2026-31400/): sunrpc: fix cache_request leak in cache_release (medium 5.5)
- [CVE-2026-3140](https://insights.sbomify.com/CVE-2026-3140/): Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation (medium 4.3)
- [CVE-2026-31399](https://insights.sbomify.com/CVE-2026-31399/): nvdimm/bus: Fix potential use after free in asynchronous initialization (high 7.8)
- [CVE-2026-31398](https://insights.sbomify.com/CVE-2026-31398/): mm/rmap: fix incorrect pte restoration for lazyfree folios (high 7.8)
- [CVE-2026-31397](https://insights.sbomify.com/CVE-2026-31397/): mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd() (high 7.8)
- [CVE-2026-31396](https://insights.sbomify.com/CVE-2026-31396/): net: macb: fix use-after-free access to PTP clock (high 7.8)
- [CVE-2026-31395](https://insights.sbomify.com/CVE-2026-31395/): bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (high 7.1)
- [CVE-2026-31394](https://insights.sbomify.com/CVE-2026-31394/): mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations (medium 5.5)
- [CVE-2026-31393](https://insights.sbomify.com/CVE-2026-31393/): Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (high 8.1)
- [CVE-2026-31392](https://insights.sbomify.com/CVE-2026-31392/): smb: client: fix krb5 mount with username option (high 8.1)
- [CVE-2026-31391](https://insights.sbomify.com/CVE-2026-31391/): crypto: atmel-sha204a - Fix OOM ->tfm_count leak (medium 5.5)
- [CVE-2026-31390](https://insights.sbomify.com/CVE-2026-31390/): drm/xe: Fix memory leak in xe_vm_madvise_ioctl (medium 5.5)
- [CVE-2026-3139](https://insights.sbomify.com/CVE-2026-3139/): Missing authorization in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (medium 4.3)
- [CVE-2026-31389](https://insights.sbomify.com/CVE-2026-31389/): spi: fix use-after-free on controller registration failure (high 7.8)
- [CVE-2026-31388](https://insights.sbomify.com/CVE-2026-31388/): Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature (medium 5.3)
- [CVE-2026-31387](https://insights.sbomify.com/CVE-2026-31387/): Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation (medium 5.3)
- [CVE-2026-31386](https://insights.sbomify.com/CVE-2026-31386/): Command injection in LSWS Enterprise (high 8.6)
- [CVE-2026-31382](https://insights.sbomify.com/CVE-2026-31382/): Gainsight Assist reflected XSS/HTML injection (medium 6.1)
- [CVE-2026-31381](https://insights.sbomify.com/CVE-2026-31381/): Gainsight Assist plugin information disclosure (medium 5.3)
- [CVE-2026-31380](https://insights.sbomify.com/CVE-2026-31380/): Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass (medium 6.5)
- [CVE-2026-3138](https://insights.sbomify.com/CVE-2026-3138/): Missing authorization in Product Filter for WooCommerce by WBW (medium 6.5)
- [CVE-2026-31379](https://insights.sbomify.com/CVE-2026-31379/): Path traversal in Apache OFBiz (medium 6.1)
- [CVE-2026-31378](https://insights.sbomify.com/CVE-2026-31378/): Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution (medium 6.5)
- [CVE-2026-31377](https://insights.sbomify.com/CVE-2026-31377/): Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service (high 7.5)
- [CVE-2026-31370](https://insights.sbomify.com/CVE-2026-31370/): Information Leak Vulnerability in Honor E (medium 6.3)
- [CVE-2026-3137](https://insights.sbomify.com/CVE-2026-3137/): CodeAstro Food Ordering System food_ordering.exe stack-based overflow (medium 4.8)
- [CVE-2026-31369](https://insights.sbomify.com/CVE-2026-31369/): Privilege Bypass in PcManager (low 3.2)
- [CVE-2026-31368](https://insights.sbomify.com/CVE-2026-31368/): Privilege Bypass in AiAssistant (high 7.8)
- [CVE-2026-3136](https://insights.sbomify.com/CVE-2026-3136/): Google Cloud Build Comment Control Bypass (high 8.6)
- [CVE-2026-31354](https://insights.sbomify.com/CVE-2026-31354/): Feehi CMS has authenticated stored cross-site scripting (XSS) vulnerabilities via the Permissions module (medium 5.4)
- [CVE-2026-31353](https://insights.sbomify.com/CVE-2026-31353/): Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Category module (medium 5.4)
- [CVE-2026-31352](https://insights.sbomify.com/CVE-2026-31352/): Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Role Management module (medium 5.4)
- [CVE-2026-31351](https://insights.sbomify.com/CVE-2026-31351/): Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module (medium 4.8)
- [CVE-2026-31350](https://insights.sbomify.com/CVE-2026-31350/): Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Page Sign parameter (medium 5.4)
- [CVE-2026-3135](https://insights.sbomify.com/CVE-2026-3135/): itsourcecode News Portal Project add-category.php sql injection (medium 6.9)
- [CVE-2026-3134](https://insights.sbomify.com/CVE-2026-3134/): itsourcecode News Portal Project edit-category.php sql injection (medium 6.9)
- [CVE-2026-3133](https://insights.sbomify.com/CVE-2026-3133/): itsourcecode Document Management System Login loging.php sql injection (medium 6.9)
- [CVE-2026-3132](https://insights.sbomify.com/CVE-2026-3132/): Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview (high 8.8)
- [CVE-2026-31317](https://insights.sbomify.com/CVE-2026-31317/): Craftql vulnerable to Server-Side Request Forgery (high 7.5)
- [CVE-2026-31313](https://insights.sbomify.com/CVE-2026-31313/): Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module (medium 5.4)
- [CVE-2026-3131](https://insights.sbomify.com/CVE-2026-3131/): Missing authorization in Server (medium 6.5)
- [CVE-2026-31309](https://insights.sbomify.com/CVE-2026-31309/): Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated at (critical 9.8)
- [CVE-2026-3130](https://insights.sbomify.com/CVE-2026-3130/): Business logic in Server (critical 9.8)
- [CVE-2026-3129](https://insights.sbomify.com/CVE-2026-3129/): LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes (medium 6.4)
- [CVE-2026-31283](https://insights.sbomify.com/CVE-2026-31283/): In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. (critical 9.8)
- [CVE-2026-31282](https://insights.sbomify.com/CVE-2026-31282/): Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. (critical 9.8)
- [CVE-2026-31281](https://insights.sbomify.com/CVE-2026-31281/): Totara LMS v19.1.5 and before is vulnerable to HTML Injection. (high 8.0)
- [CVE-2026-31280](https://insights.sbomify.com/CVE-2026-31280/): An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to cause a Denial of Service (medium 6.5)
- [CVE-2026-31278](https://insights.sbomify.com/CVE-2026-31278/): Information disclosure in BioStar 2 (high 7.7)
- [CVE-2026-31272](https://insights.sbomify.com/CVE-2026-31272/): Missing authorization in mrcms:mrcms (critical 9.8)
- [CVE-2026-31271](https://insights.sbomify.com/CVE-2026-31271/): megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. (critical 9.8)
- [CVE-2026-31267](https://insights.sbomify.com/CVE-2026-31267/): Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023 is vulnerable to Buffer Overflow in the administrative web interface. (medium 5.7)
- [CVE-2026-31266](https://insights.sbomify.com/CVE-2026-31266/): Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate). (high 7.3)
- [CVE-2026-31262](https://insights.sbomify.com/CVE-2026-31262/): Cross-site scripting in altenar:sportsbook (medium 6.1)
- [CVE-2026-31256](https://insights.sbomify.com/CVE-2026-31256/): Null dereference in mercurycom:mipc252w firmware (high 7.5)
- [CVE-2026-31255](https://insights.sbomify.com/CVE-2026-31255/): Command injection in tenda:ac18 firmware (medium 5.4)
- [CVE-2026-31254](https://insights.sbomify.com/CVE-2026-31254/): The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-9 (high 7.3)
- [CVE-2026-31253](https://insights.sbomify.com/CVE-2026-31253/): flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism (high 7.3)
- [CVE-2026-31252](https://insights.sbomify.com/CVE-2026-31252/): CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in (medium 5.7)
- [CVE-2026-31251](https://insights.sbomify.com/CVE-2026-31251/): CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in (high 7.3)
- [CVE-2026-31250](https://insights.sbomify.com/CVE-2026-31250/): CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in (high 7.3)
- [CVE-2026-3125](https://insights.sbomify.com/CVE-2026-3125/): SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/730/