CVEs published May 1, 2026
256 CVEs were published on May 1, 2026: 19 critical, 90 high.
- Published
- 256
- Critical
- 19
- High
- 90
- Medium
- 60
- Low
- 1
- Unrated
- 86
- Now in CISA KEV
- 0
- Fix available
- 109
Most affected products
- Linux
- 145
- Open5GS
- 7
- mtrudel bandit
- 5
- Prosody
- 4
- Apache Software Foundation Apache Neethi · org.apache.neeth…
- 3
- Imagination Technologies Graphics DDK
- 3
- Apache Software Foundation Apache MINA · org.apache.mina:mi…
- 2
- mix/mix
- 2
- nextlevelbuilder ui-ux-pro-max-skill
- 2
- Oracle Linux
- 2
Critical 19
- CVE-2026-43039net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatchLinux
- CVE-2026-43038ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()Linux
- CVE-2026-43037ip6_tunnel: clear skb2->cb[] in ip4ip6_err()Linux
- CVE-2026-43011net/x25: Fix potential double free of skbLinux
- CVE-2026-31718ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavengerLinux
- CVE-2026-31705ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignmentLinux
- CVE-2026-42778Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)Apache Software Foundation Apache MINA · org.apache.mina:mi…
- CVE-2026-42779Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)Apache Software Foundation Apache MINA · org.apache.mina:mi…
- CVE-2026-7567Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeoverelemntor Temporary Login
- CVE-2026-42996JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed bJS8Call · JS8Call-improved
- CVE-2026-7546Totolink NR1800X lighttpd find_host_ip stack-based overflowTotolink NR1800X
- CVE-2026-7538Totolink A8000RU CGI cstecgi.cgi vulnerability os command injectionTotolink A8000RU
- CVE-2026-37531AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367
- CVE-2026-37534Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transp
- CVE-2026-37539Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function
- CVE-2026-37541Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.
- CVE-2026-42472Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17.
- CVE-2026-42473Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17.
- CVE-2026-42484A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or
High 90
- CVE-2026-39804WebSocket permessage-deflate inflate has no output-size cap in banditmtrudel bandit
- CVE-2026-42786WebSocket fragmented message reassembly unbounded in banditmtrudel bandit
- CVE-2026-22166GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachableImagination Technologies Graphics DDK
- CVE-2026-22165GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBsImagination Technologies Graphics DDK
- CVE-2026-22167GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memoryImagination Technologies Graphics DDK
- CVE-2026-43057net: correctly handle tunneled traffic on IPV6_CSUM GSO fallbackLinux
- CVE-2026-43056net: mana: fix use-after-free in add_adev() error pathLinux
- CVE-2026-43055scsi: target: file: Use kzalloc_flex for aio_cmdLinux
- CVE-2026-43051HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irqLinux
- CVE-2026-43048HID: core: Mitigate potential OOB by removing bogus memset()Linux
- CVE-2026-43047HID: multitouch: Check to ensure report responses match the requestLinux
- CVE-2026-43044crypto: caam - fix DMA corruption on long hmac keysLinux
- CVE-2026-43042mpls: add seqcount to protect the platform_label{,s} pairLinux
- CVE-2026-43033crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryptionLinux
- CVE-2026-43031net: xilinx: axienet: Fix BQL accounting for multi-BD TX packetsLinux
- CVE-2026-43030bpf: Fix regsafe() for pointers to packetLinux
- CVE-2026-43029mptcp: fix soft lockup in mptcp_recvmsg()Linux
- CVE-2026-43028netfilter: x_tables: ensure names are nul-terminatedLinux
- CVE-2026-43025netfilter: ctnetlink: ignore explicit helper on new expectationsLinux
- CVE-2026-43023Bluetooth: SCO: fix race conditions in sco_sock_connect()Linux
- CVE-2026-43019Bluetooth: hci_conn: fix potential UAF in set_cig_params_syncLinux
- CVE-2026-43018Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evtLinux
- CVE-2026-43016bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().Linux
- CVE-2026-43009bpf: Fix incorrect pruning due to atomic fetch precision trackingLinux
- CVE-2026-43006io_uring/rsrc: reject zero-length fixed buffer importLinux
- CVE-2026-31782perf/x86: Fix potential bad container_of in intel_pmu_hw_configLinux
- CVE-2026-31780wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculationLinux
- CVE-2026-31779wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()Linux
- CVE-2026-31774io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()Linux
- CVE-2026-31773Bluetooth: SMP: derive legacy responder STK authentication from MITM stateLinux
- CVE-2026-31772Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_syncLinux
- CVE-2026-31771Bluetooth: hci_event: move wake reason storage into validated event handlersLinux
- CVE-2026-31769gpib: fix use-after-free in IO ioctl handlersLinux
- CVE-2026-31768iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()Linux
- CVE-2026-31766drm/amdgpu: validate doorbell_offset in user queue creationLinux
- CVE-2026-31761iio: gyro: mpu3050: Move iio_device_register() to correct locationLinux
- CVE-2026-31758usb: usbtmc: Flush anchored URBs in usbtmc_releaseLinux
- CVE-2026-31743nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpyLinux
- CVE-2026-31742vt: discard stale unicode buffer on alt screen exit after resizeLinux
- CVE-2026-31739crypto: tegra - Add missing CRYPTO_ALG_ASYNCLinux
- CVE-2026-31735iommupt: Fix short gather if the unmap goes into a large mappingLinux
- CVE-2026-31731thermal: core: Address thermal zone removal races with resumeLinux
- CVE-2026-31730misc: fastrpc: possible double-free of cctx->remote_heapLinux
- CVE-2026-31719crypto: krb5enc - fix async decrypt skipping hash verificationLinux
- CVE-2026-31717ksmbd: validate owner of durable handle on reconnectLinux
- CVE-2026-31716fs/ntfs3: validate rec->used in journal-replay file record checkLinux
- CVE-2026-31712ksmbd: require minimum ACE size in smb_check_perm_dacl()Linux
- CVE-2026-31711smb: server: fix active_num_conn leak on transport allocation failureLinux
- CVE-2026-31709smb: client: validate the whole DACL before rewriting it in cifsaclLinux
- CVE-2026-31708smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO pathLinux
- CVE-2026-31707ksmbd: validate response sizes in ipc_validate_msg()Linux
- CVE-2026-31706ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()Linux
- CVE-2026-31703writeback: Fix use after free in inode_switch_wbs_work_fn()Linux
- CVE-2026-31700net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()Linux
- CVE-2026-31699crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failedLinux
- CVE-2026-31698crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failedLinux
- CVE-2026-31697crypto: ccp: Don't attempt to copy ID to userspace if PSP command failedLinux
- CVE-2026-31695wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-freeLinux
- CVE-2026-31694fuse: reject oversized dirents in page cacheLinux
- CVE-2026-3772WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editorbenjaminprojas WP Editor
- CVE-2026-42402Apache Neethi: Policy Normalization Unbounded Resource Allocation DoSApache Software Foundation Apache Neethi · org.apache.neeth…
- CVE-2026-42403Apache Neethi: Circular Policy Reference Infinite LoopApache Software Foundation Apache Neethi · org.apache.neeth…
- CVE-2026-7584Arbitrary Code Execution via Unsafe Deserialization in LabOne QZurich Instruments LabOne Q
- CVE-2026-42994Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code.Bitwarden CLI
- CVE-2026-7548Totolink NR1800X cstecgi.cgi sub_41A68C command injectionTotolink NR1800X
- CVE-2025-52347An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Bu
- CVE-2025-63547An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU leng
- CVE-2025-63548An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a packet specially crafted to be
- CVE-2026-30363flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function.
- CVE-2026-37457An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stabl
- CVE-2026-37525AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command.
- CVE-2026-37526AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose
- CVE-2026-37530AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library.
- CVE-2026-37532AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library.
- CVE-2026-37535openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame r
- CVE-2026-37536miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request.
- CVE-2026-37537collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bo
- CVE-2026-37538Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or oth
- CVE-2026-37540OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing.
- CVE-2026-37552Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17.
- CVE-2026-37554An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service.
- CVE-2026-42467An issue was discovered in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Binary_Data_Tr
- CVE-2026-42468Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.
- CVE-2026-42469Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.
- CVE-2026-42471Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17.
- CVE-2026-42482A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in src/rp_cpu.c in hashcat v7.1.2 allows an attacker to cau
- CVE-2026-42483A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execu
- CVE-2026-42485AGL agl-service-can-low-level contains a stack buffer overflow in the uds-c library.
- CVE-2026-43001An issue was discovered in OpenStack Keystone before 29.0.2.OpenStack Keystone · keystone
- CVE-2026-43003An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0.OpenStack ironic-python-agent · ironic-python-agent
Medium, low and unrated 147
- CVE-2026-7599Dayoooun hwpx-mcp MCP index.ts export_to_html path traversalDayoooun hwpx-mcp
- CVE-2026-7598libssh2 userauth.c userauth_password integer overflowlibssh2
- CVE-2026-7597mem0ai mem0 faiss.py pickle.dump deserializationmem0ai mem0 · mem0ai
- CVE-2026-7596nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingnextlevelbuilder ui-ux-pro-max-skill
- CVE-2026-7595nextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py _format_plugins code injectionnextlevelbuilder ui-ux-pro-max-skill
- CVE-2026-39805CL.CL HTTP request smuggling via duplicate Content-Length in banditmtrudel bandit
- CVE-2026-39807Client-supplied URI scheme trusted without transport verification in banditmtrudel bandit
- CVE-2026-42788HTTP/2 frame size limit checked after body is buffered in banditmtrudel bandit
- CVE-2026-7594Flux159 mcp-game-asset-gen MCP index.ts image_to_3d_async path traversalFlux159 mcp-game-asset-gen
- CVE-2026-7593Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injectionSunwood-ai-labs command-executor-mcp-server
- CVE-2026-7592itsourcecode Courier Management System edit_staff.php sql injectionitsourcecode Courier Management System
- CVE-2026-7591TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injectionTimBroddin astro-mcp-server
- CVE-2026-7590eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injectioneyal-gor p_69_branch_monkey_mcp
- CVE-2026-7589ghantakiran splunk-mcp-integration CSV Export csv_export.py create_csv_export path traversalghantakiran splunk-mcp-integration
- CVE-2026-35233An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field.Oracle Linux
- CVE-2026-21996An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to an integer Divide-by-Zero in Oracle Linux
- CVE-2026-7588ggerve coding-standards-mcp server.py get_best_practices path traversalggerve coding-standards-mcp
- CVE-2026-7587Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of serviceOpen5GS
- CVE-2026-23866Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for AndroidFacebook WhatsApp for Android · Facebook WhatsApp for iOS
- CVE-2026-23863An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents wFacebook WhatsApp Desktop for Windows
- CVE-2026-7586Open5GS AMF nudm-handler.c ogs_id_get_value denial of serviceOpen5GS
- CVE-2026-7585Open5GS AMF nudm-handler.c amf_nudm_sdm_handle_provisioned denial of serviceOpen5GS
- CVE-2026-43507An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5.Prosody
- CVE-2026-43506An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5.Prosody
- CVE-2026-7583Open5GS BSF context.c bsf_sess_find_by_ipv6prefix denial of serviceOpen5GS
- CVE-2026-43505An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled.Prosody
- CVE-2026-43504An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled.Prosody
- CVE-2026-43054scsi: target: tcm_loop: Drain commands in target_reset handlerLinux
- CVE-2026-43053xfs: close crash window in attr dabtree inactivationLinux
- CVE-2026-43052wifi: mac80211: check tdls flag in ieee80211_tdls_operLinux
- CVE-2026-43050atm: lec: fix use-after-free in sock_def_readable()Linux
- CVE-2026-43049HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failureLinux · :linux_kernel:
- CVE-2026-43046btrfs: reject root items with drop_progress and zero drop_levelLinux
- CVE-2026-43045mshv: Fix error handling in mshv_region_pinLinux
- CVE-2026-43043crypto: af-alg - fix NULL pointer dereference in scatterwalkLinux
- CVE-2026-43041net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leakLinux
- CVE-2026-43040net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leakLinux
- CVE-2026-43036net: use skb_header_pointer() for TCPv4 GSO frag_off checkLinux
- CVE-2026-43035net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leakLinux
- CVE-2026-43034bnxt_en: set backing store type from query typeLinux
- CVE-2026-43032NFC: pn533: bound the UART receive bufferLinux
- CVE-2026-43027netfilter: nf_conntrack_helper: pass helper to expect cleanupLinux
- CVE-2026-43026netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absentLinux
- CVE-2026-43024netfilter: nf_tables: reject immediate NF_QUEUE verdictLinux
- CVE-2026-43022Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if existsLinux
- CVE-2026-43021Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once failsLinux
- CVE-2026-43020Bluetooth: MGMT: validate LTK enc_size on loadLinux
- CVE-2026-43017Bluetooth: MGMT: validate mesh send advertising payload lengthLinux
- CVE-2026-43015net: macb: fix clk handling on PCI glue driver removalLinux
- CVE-2026-43014net: macb: properly unregister fixed rate clocksLinux
- CVE-2026-43013net/mlx5: lag: Check for LAG device before creating debugfsLinux
- CVE-2026-43012net/mlx5: Fix switchdev mode rollback in case of failureLinux
- CVE-2026-43010bpf: Reject sleepable kprobe_multi programs at attach timeLinux
- CVE-2026-43008gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio()Linux
- CVE-2026-43007accel/qaic: Handle DBC deactivation if the owner went awayLinux
- CVE-2026-43005hwmon: (tps53679) Fix array access with zero-length block readLinux
- CVE-2026-43004spi: stm32-ospi: Fix resource leak in remove() callbackLinux
- CVE-2026-31785drm/xe/xe_pagefault: Disallow writes to read-only VMAsLinux
- CVE-2026-31784drm/xe/pxp: Clear restart flag in pxp_start after jumping backLinux
- CVE-2026-31783spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callbackLinux
- CVE-2026-31781drm/ioc32: stop speculation on the drm_compat_ioctl pathLinux
- CVE-2026-31778ALSA: caiaq: fix stack out-of-bounds read in init_cardLinux
- CVE-2026-31777ALSA: ctxfi: Check the error for index mappingLinux
- CVE-2026-31776ALSA: ctxfi: Fix missing SPDIFI1 index handlingLinux
- CVE-2026-31775ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initializationLinux
- CVE-2026-31770hwmon: (occ) Fix division by zero in occ_show_power_1()Linux
- CVE-2026-31767drm/i915/dsi: Don't do DSC horizontal timing adjustments in command modeLinux
- CVE-2026-31765drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KBLinux
- CVE-2026-31764iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer onlyLinux
- CVE-2026-31763iio: gyro: mpu3050: Fix incorrect free_irq() variableLinux
- CVE-2026-31762iio: gyro: mpu3050: Fix irq resource leakLinux
- CVE-2026-31760gpib: lpvo_usb: fix memory leak on disconnectLinux
- CVE-2026-31759usb: ulpi: fix double free in ulpi_register_interface() error pathLinux
- CVE-2026-31757usb: misc: usbio: Fix URB memory leak on submit failureLinux
- CVE-2026-31756usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()Linux
- CVE-2026-31755usb: cdns3: gadget: fix NULL pointer dereference in ep_queueLinux
- CVE-2026-31754usb: cdns3: gadget: fix state inconsistency on gadget init failureLinux
- CVE-2026-31753auxdisplay: line-display: fix NULL dereference in linedisp_releaseLinux
- CVE-2026-31752bridge: br_nd_send: validate ND option lengthsLinux
- CVE-2026-31751comedi: dt2815: add hardware detection to prevent crashLinux
- CVE-2026-31750comedi: runflags cannot determine whether to reclaim chanlistLinux
- CVE-2026-31749comedi: ni_atmio16d: Fix invalid clean-up after failed attachLinux
- CVE-2026-31748comedi: me_daq: Fix potential overrun of firmware bufferLinux
- CVE-2026-31747comedi: me4000: Fix potential overrun of firmware bufferLinux
- CVE-2026-31746s390/zcrypt: Fix memory leak with CCA cards used as acceleratorLinux
- CVE-2026-31745reset: gpio: fix double free in reset_add_gpio_aux_device() error pathLinux
- CVE-2026-31744PM: EM: Fix NULL pointer dereference when perf domain ID is not foundLinux
- CVE-2026-31741counter: rz-mtu3-cnt: prevent counter from being toggled multiple timesLinux
- CVE-2026-31740counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev memberLinux
- CVE-2026-31738vxlan: validate ND option lengths in vxlan_na_createLinux
- CVE-2026-31737net: ftgmac100: fix ring allocation unwind on open failureLinux
- CVE-2026-31736net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabledLinux
- CVE-2026-31734sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCULinux
- CVE-2026-31733sched_ext: Fix stale direct dispatch state in ddsp_dsq_idLinux
- CVE-2026-31732gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()Linux
- CVE-2026-31729usb: typec: ucsi: validate connector number in ucsi_notify_common()Linux
- CVE-2026-31728usb: gadget: u_ether: Fix race between gether_disconnect and eth_stopLinux
- CVE-2026-31727usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfoLinux
- CVE-2026-31726usb: gadget: uvc: fix NULL pointer dereference during unbind raceLinux
- CVE-2026-31725usb: gadget: f_ecm: Fix net_device lifecycle with device_moveLinux
- CVE-2026-31724usb: gadget: f_eem: Fix net_device lifecycle with device_moveLinux
- CVE-2026-31723usb: gadget: f_subset: Fix net_device lifecycle with device_moveLinux
- CVE-2026-31722usb: gadget: f_rndis: Fix net_device lifecycle with device_moveLinux
- CVE-2026-31721usb: gadget: f_hid: move list and spinlock inits from bind to allocLinux
- CVE-2026-31720usb: gadget: f_uac1_legacy: validate control request sizeLinux
- CVE-2026-31715f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()Linux
- CVE-2026-31714f2fs: fix to avoid memory leak in f2fs_rename()Linux
- CVE-2026-31713fuse: abort on fatal signal during sync initLinux
- CVE-2026-31710smb: client: fix dir separator in SMB1 UNIX mountsLinux
- CVE-2026-31704ksmbd: use check_add_overflow() to prevent u16 DACL size overflowLinux
- CVE-2026-31702f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()Linux
- CVE-2026-31701ALSA: caiaq: take a reference on the USB device in create_card()Linux
- CVE-2026-31696rxrpc: Fix missing validation of ticket length in non-XDR key preparsingLinux
- CVE-2026-7582AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds writeAcademySoftwareFoundation OpenImageIO
- CVE-2026-3143Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback CancellationTotal Upkeep – WordPress Backup Plugin plus Restore & Migra…
- CVE-2026-7581alexta69 MeTube CORS Policy main.py on_prepare cross-domain policyalexta69 MeTube
- CVE-2026-7580Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process_mrld code injectionExiftool
- CVE-2026-7579AstrBotDevs AstrBot Dashboard auth.py hard-coded credentialsAstrBotDevs AstrBot · astrbot
- CVE-2026-3140Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivationdavidvongries Ultimate Dashboard – Custom WordPress Dashboa…
- CVE-2026-7578MacCMS Pro Plugin Installation add.html install unrestricted uploadMacCMS Pro
- CVE-2026-42404Apache Neethi: Unrestricted HTTP Redirect Following in Policy ReferencesApache Software Foundation Apache Neethi · org.apache.neeth…
- CVE-2026-40201@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file.diplodoc-platform @diplodoc/search-extension · @diplodoc/se…
- CVE-2026-7555itsourcecode Electronic Judging System login.php sql injectionitsourcecode Electronic Judging System
- CVE-2024-13362Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parametersebet Go Fetch Jobs · 5starplugins Dynamic Copyright Y… +129
- CVE-2026-6127Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST APIelemntor Elementor Website Builder – more than just a page…
- CVE-2026-7554D-Link M60 httpd password recoveryD-Link M60
- CVE-2026-7553code-projects Gym Management System edit_exercises.php sql injectioncode-projects Gym Management System
- CVE-2026-7550SourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7549SourceCodester Pharmacy Sales and Inventory System ajax.php delete_customer sql injectionSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-7545SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injectionSourceCodester Advanced School Management System
- CVE-2026-7536Open5GS BSF pcfBindings bsf_sess_add_by_ip_address denial of serviceOpen5GS
- CVE-2026-7535Open5GS transfer-update denial of serviceOpen5GS
- CVE-2026-7519Fujian Apex LiveBOS Endpoint UploadImage.do path traversalFujian Apex LiveBOS
- CVE-2026-7518Open5GS AMF SBI Endpoint sdmsubscription-notify amf_namf_callback_handle_sdm_data_change_notify denial of serviceOpen5GS
- CVE-2025-69606Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90.
- CVE-2026-26461A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execut
- CVE-2026-37503Cross-Site Scripting (XSS) in V2Board thru 1.7.4.
- CVE-2026-37504Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4.
- CVE-2026-37505SQL Injection via ORDER BY clause in V2Board thru 1.7.4.
- CVE-2026-42474SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php.mix/mix
- CVE-2026-42475SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `on` array to the joinOn function in BuildHelper.php.mix/mix
- CVE-2026-42476Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_R
- CVE-2026-42477A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allo
- CVE-2026-42478An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attac
- CVE-2026-42479An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allow
- CVE-2026-42480A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 a
- CVE-2026-42481Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be triggered by craft