Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 793 of 1013.
- CVE-2026-23081 net: phy: intel-xway: fix OF node refcount leakage
- CVE-2026-23080 can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
- CVE-2026-23079 gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()
- CVE-2026-23078 ALSA: scarlett2: Fix buffer overflow in config retrieval
- CVE-2026-23077 mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge
- CVE-2026-23076 ALSA: ctxfi: Fix potential OOB access in audio mixer handling
- CVE-2026-23075 can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
- CVE-2026-23074 net/sched: Enforce that teql can only be used as root qdisc
- CVE-2026-23073 wifi: rsi: Fix memory corruption due to not set vif driver data size
- CVE-2026-23072 l2tp: Fix memleak in l2tp_udp_encap_recv().
- CVE-2026-23071 regmap: Fix race condition in hwspinlock irqsave routine
- CVE-2026-23070 Octeontx2-af: Add proper checks for fwdata
- CVE-2026-23069 vsock/virtio: fix potential underflow in virtio_transport_get_credit()
- CVE-2026-23068 spi: spi-sprd-adi: Fix double free in probe error path
- CVE-2026-23067 iommu/io-pgtable-arm: fix size_t signedness bug in unmap path
- CVE-2026-23066 rxrpc: Fix recvmsg() unconditional requeue
- CVE-2026-23065 platform/x86/amd: Fix memory leak in wbrf_record()
- CVE-2026-23064 net/sched: act_ife: avoid possible NULL deref
- CVE-2026-23063 uacce: ensure safe queue release with state management
- CVE-2026-23062 platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
- CVE-2026-23061 can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
- CVE-2026-23060 crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
- CVE-2026-2306 Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation
- CVE-2026-23059 scsi: qla2xxx: Sanitize payload size to prevent member overflow
- CVE-2026-23058 can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
- CVE-2026-23057 vsock/virtio: Coalesce only linear skb
- CVE-2026-23056 uacce: implement mremap in uacce_vm_ops to return -EPERM
- CVE-2026-23055 i2c: riic: Move suspend handling to NOIRQ phase
- CVE-2026-23054 net: hv_netvsc: reject RSS hash key programming without RX indirection table
- CVE-2026-23053 NFS: Fix a deadlock involving nfs_release_folio()
- CVE-2026-23052 ftrace: Do not over-allocate ftrace memory
- CVE-2026-23051 drm/amdgpu: fix drm panic null pointer when driver not support atomic
- CVE-2026-23050 pNFS: Fix a deadlock when returning a delegation during open()
- CVE-2026-2305 AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
- CVE-2026-23049 drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
- CVE-2026-23048 udp: call skb_orphan() before skb_attempt_defer_free()
- CVE-2026-23047 libceph: make calc_target() set t->paused, not just clear it
- CVE-2026-23046 virtio_net: fix device mismatch in devm_kzalloc/devm_kfree
- CVE-2026-23045 net/ena: fix missing lock when update devlink params
- CVE-2026-23044 PM: hibernate: Fix crash when freeing invalid crypto compressor
- CVE-2026-23043 btrfs: fix NULL pointer dereference in do_abort_log_replay()
- CVE-2026-23042 idpf: fix aux device unplugging when rdma is not supported by vport
- CVE-2026-23041 bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup
- CVE-2026-23040 wifi: mac80211_hwsim: fix typo in frequency notification
- CVE-2026-23039 drm/gud: fix NULL fb and crtc dereferences on USB disconnect
- CVE-2026-23038 pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
- CVE-2026-23037 can: etas_es58x: allow partial RX URB allocation to succeed
- CVE-2026-23036 btrfs: release path before iget_failed() in btrfs_read_locked_inode()
- CVE-2026-23035 net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
- CVE-2026-23034 drm/amdgpu/userq: Fix fence reference leak on queue teardown v2
- CVE-2026-23033 dmaengine: omap-dma: fix dma_pool resource leak in error paths
- CVE-2026-23032 null_blk: fix kmemleak by releasing references to fault configfs items
- CVE-2026-23031 can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
- CVE-2026-23030 phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
- CVE-2026-2303 Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak
- CVE-2026-23029 LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()
- CVE-2026-23028 LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()
- CVE-2026-23027 LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()
- CVE-2026-23026 dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
- CVE-2026-23025 mm/page_alloc: prevent pcp corruption with SMP=n
- CVE-2026-23024 idpf: fix memory leak of flow steer list on rmmod
- CVE-2026-23023 idpf: fix memory leak in idpf_vport_rel()
- CVE-2026-23022 idpf: fix memory leak in idpf_vc_core_deinit()
- CVE-2026-23021 net: usb: pegasus: fix memory leak in update_eth_regs_async()
- CVE-2026-23020 net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
- CVE-2026-2302 Unsafe Reflection in Mongoid::Criteria.from_hash
- CVE-2026-23019 net: marvell: prestera: fix NULL dereference on devlink_alloc() failure
- CVE-2026-23018 btrfs: release path before initializing extent tree in btrfs_read_locked_inode()
- CVE-2026-23017 idpf: fix error handling in the init_task on load
- CVE-2026-23016 inet: frags: drop fraglist conntrack references
- CVE-2026-23015 gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths
- CVE-2026-23014 perf: Ensure swevent hrtimer is properly destroyed
- CVE-2026-23013 net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
- CVE-2026-23012 mm/damon/core: remove call_control in inactive contexts
- CVE-2026-23011 ipv4: ip_gre: make ipgre_header() robust
- CVE-2026-23010 ipv6: Fix use-after-free in inet6_addr_del().
- CVE-2026-2301 Missing authorization in Post Duplicator
- CVE-2026-23009 xhci: sideband: don't dereference freed ring when removing sideband endpoint
- CVE-2026-23008 drm/vmwgfx: Fix KMS with 3D on HW version 10
- CVE-2026-23007 block: zero non-PI portion of auto integrity buffer
- CVE-2026-23006 ASoC: tlv320adcx140: fix null pointer
- CVE-2026-23005 x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
- CVE-2026-23004 dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
- CVE-2026-23003 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
- CVE-2026-23002 lib/buildid: use __kernel_read() for sleepable context
- CVE-2026-23001 macvlan: fix possible UAF in macvlan_forward_source()
- CVE-2026-23000 net/mlx5e: Fix crash on profile change rollback failure
- CVE-2026-2300 BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block
- CVE-2026-22999 net/sched: sch_qfq: do not free existing class in qfq_change_class()
- CVE-2026-22998 nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
- CVE-2026-22997 net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
- CVE-2026-22996 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
- CVE-2026-22995 ublk: fix use-after-free in ublk_partition_scan_work
- CVE-2026-22994 bpf: Fix reference count leak in bpf_prog_test_run_xdp()
- CVE-2026-22993 idpf: Fix RSS LUT NULL ptr issue after soft reset
- CVE-2026-22992 libceph: return the handler error from mon_handle_auth_done()
- CVE-2026-22991 libceph: make free_choose_arg_map() resilient to partial allocation
- CVE-2026-22990 libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
- CVE-2026-2299 Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
- CVE-2026-22989 nfsd: check that server is running in unlock_filesystem