CVEs published July 19, 2026
464 CVEs were published on July 19, 2026: 58 critical, 205 high.
- Published
- 464
- Critical
- 58
- High
- 205
- Medium
- 27
- Low
- 4
- Unrated
- 170
- Now in CISA KEV
- 0
- Fix available
- 230
Most affected products
- Linux
- 429
- SourceCodester Class and Exam Timetabling System
- 4
- geex-arts django-jet
- 3
- zevorn rt-claw
- 3
- 1Panel-dev CordysCRM
- 2
- django-tastypie
- 2
- meshtastic firmware
- 2
- allegro
- 1
- awesto django-shop
- 1
- ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- 1
Critical 58
- CVE-2026-44359Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflowmeshtastic firmware
- CVE-2026-64162idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()Linux
- CVE-2026-64160netfs: Fix potential for tearing in ->remote_i_size and ->zero_pointLinux
- CVE-2026-64150netfilter: nft_inner: release local_lock before re-enabling softirqsLinux
- CVE-2026-64142ksmbd: close durable scavenger races against m_fp_list lookupsLinux
- CVE-2026-64136smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()Linux
- CVE-2026-64132ipv6: ioam: refresh hdr pointer before ioam6_event()Linux
- CVE-2026-64125net: bcmgenet: keep RBUF EEE/PM disabledLinux
- CVE-2026-64122net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recoverLinux
- CVE-2026-64113ixgbevf: fix use-after-free in VEPA multicast source pruningLinux
- CVE-2026-64106KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bitsLinux
- CVE-2026-64102RDMA/siw: Reject MPA FPDU length underflow before signed receive mathLinux
- CVE-2026-64091batman-adv: tt: fix TOCTOU race for reported vlansLinux
- CVE-2026-64089batman-adv: tt: fix negative last_changeset_lenLinux
- CVE-2026-64080firmware: arm_ffa: Snapshot notifier callbacks under lockLinux
- CVE-2026-64069netfs: Fix cancellation of a DIO and single read subrequestsLinux
- CVE-2026-64068netfs: Fix missing locking around retry adding new subreqsLinux
- CVE-2026-64067netfs: Fix missing barriers when accessing stream->subrequests locklesslyLinux
- CVE-2026-64066netfs: Fix netfs_read_to_pagecache() to pause on subreq failureLinux
- CVE-2026-64061netfs: Fix early put of sink folio in netfs_read_gaps()Linux
- CVE-2026-64056net: ethernet: cortina: Make RX SKB per-portLinux
- CVE-2026-64055net: ethernet: cortina: Carry over frag counterLinux
- CVE-2026-64047net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ringLinux
- CVE-2026-64046net: tls: prevent chain-after-chain in plain text SGLinux
- CVE-2026-64037wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabledLinux
- CVE-2026-64035igc: set tx buffer type for SMD framesLinux
- CVE-2026-64034net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA bufferLinux
- CVE-2026-64033RDMA/rtrs: Fix use-after-free in path file creation cleanupLinux
- CVE-2026-64025bpf, skmsg: fix verdict sk_data_ready racing with ktls rxLinux
- CVE-2026-64024tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN predictionLinux
- CVE-2026-64018net: mana: validate rx_req_idx to prevent out-of-bounds array accessLinux
- CVE-2026-64016ksmbd: fix durable reconnect error path file lifetimeLinux
- CVE-2026-64007netfilter: synproxy: refresh tcphdr after skb_ensure_writableLinux
- CVE-2026-64000net: hsr: fix potential OOB access in supervision frame handlingLinux
- CVE-2026-63994tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()Linux
- CVE-2026-63993vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()Linux
- CVE-2026-63992tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()Linux
- CVE-2026-63984ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()Linux
- CVE-2026-63979net/handshake: hand off the pinned file reference to accept_doitLinux
- CVE-2026-63978net/handshake: Drain pending requests at net namespace exitLinux
- CVE-2026-63940KVM: SEV: Ignore Port I/O requests of length '0'Linux
- CVE-2026-63939KVM: SEV: Compute the correct max length of the in-GHCB scratch areaLinux
- CVE-2026-63938KVM: SEV: Check PSC request indices against the actual size of the bufferLinux
- CVE-2026-63924ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()Linux
- CVE-2026-63922ipv6: exthdrs: refresh nh after handling HAO optionLinux
- CVE-2026-63912xfrm: esp: restore combined single-frag length gateLinux
- CVE-2026-63888scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()Linux
- CVE-2026-63887scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_bufLinux
- CVE-2026-63886scsi: target: iscsi: Validate CHAP_R length before base64 decodeLinux
- CVE-2026-63857net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()Linux
- CVE-2026-63830net: skmsg: preserve sg.copy across SG transformsLinux
- CVE-2026-63825gcov: use atomic counter updates to fix concurrent access crashesLinux
- CVE-2026-63808exfat: fix potential use-after-free in exfat_find_dir_entry()Linux
- CVE-2026-63800pNFS: Fix use-after-free in pnfs_update_layout()Linux
- CVE-2026-637959p: avoid putting oldfid in p9_client_walk() error pathLinux
- CVE-2026-53399nfsd: release layout stid on setlease failureLinux
- CVE-2026-53398NFSD: Fix SECINFO_NO_NAME decode error cleanupLinux
- CVE-2026-53384serial: 8250_dw: unregister 8250 port if clk_notifier_register() failsLinux
High 205
- CVE-2026-42566Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failuremeshtastic firmware
- CVE-2026-12484Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_configkeras-team/keras · keras
- CVE-2026-64181mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()Linux
- CVE-2026-64178Bluetooth: bnep: Fix UAF read of dev->nameLinux
- CVE-2026-64176wifi: iwlwifi: mvm: fix driver-set TX rates on old devicesLinux
- CVE-2026-64175wifi: iwlwifi: mld: stop TX during firmware restartLinux
- CVE-2026-64172KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)Linux
- CVE-2026-64153drm/msm: Fix iommu_map_sgtable() return value check and avoid WARNLinux
- CVE-2026-64152iommu: Handle unmap error when iommu_debug is enabledLinux
- CVE-2026-64151iommupt: Check for missing PAGE_SIZE in the pgsize_bitmapLinux
- CVE-2026-64148pds_core: fix error handling in pdsc_devcmd_waitLinux
- CVE-2026-64141ksmbd: fix null pointer dereference in compare_guid_key()Linux
- CVE-2026-64140ksmbd: fix null pointer dereference in proc_show_files()Linux
- CVE-2026-64138ksmbd: validate SID in parent security descriptor during ACL inheritanceLinux
- CVE-2026-64137smb: client: require net admin for CIFS SWN netlinkLinux
- CVE-2026-64134ALSA: pcm: Don't setup bogus iov_iter for silencingLinux
- CVE-2026-64133ALSA: asihpi: Fix potential OOB array access at reading cacheLinux
- CVE-2026-64126Bluetooth: MGMT: validate Add Extended Advertising Data lengthLinux
- CVE-2026-64124net: devmem: reject dma-buf bind with non-page-aligned size or SG lengthLinux
- CVE-2026-64123net: hsr: defer node table free until after RCU readersLinux
- CVE-2026-64118qed: fix double free in qed_cxt_tables_alloc()Linux
- CVE-2026-64117wifi: mac80211: capture fast-RX rate before mesh reuses skb->cbLinux
- CVE-2026-64116ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()Linux
- CVE-2026-64115vsock/vmci: fix UAF when peer resets connection during handshakeLinux
- CVE-2026-64114ipv4: raw: reject IP_HDRINCL packets with ihl < 5Linux
- CVE-2026-64112rbd: eliminate a race in lock_dwork draining on unmapLinux
- CVE-2026-64111lsm: hold cred_guard_mutex for lsm_set_self_attr()Linux
- CVE-2026-64109af_unix: Fix UAF read of tail->len in unix_stream_data_wait()Linux
- CVE-2026-64108cifs: Fix busy dentry used after unmountingLinux
- CVE-2026-64104virt: sev-guest: Explicitly leak pages in unknown stateLinux
- CVE-2026-64099drm/v3d: Fix use-after-free of CPU job query arrays on error pathLinux
- CVE-2026-64098drm/virtio: use uninterruptible resv lock for plane updatesLinux
- CVE-2026-64097drm/amd/display: Validate GPIO pin LUT table size before iteratingLinux
- CVE-2026-64096batman-adv: mcast: fix use-after-free in orig_node RCU releaseLinux
- CVE-2026-64095batman-adv: bla: avoid double decrement of bla.num_requestsLinux
- CVE-2026-64093batman-adv: tp_meter: directly shut down timer on cleanupLinux
- CVE-2026-64088batman-adv: tt: fix negative tt_buff_lenLinux
- CVE-2026-64086hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read bufferLinux
- CVE-2026-64084hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NRLinux
- CVE-2026-64082riscv: Fix register corruption from uninitialized cregs on errorLinux
- CVE-2026-64081firmware: arm_ffa: Validate framework notification message layoutLinux
- CVE-2026-64078netfilter: x_tables: add and use xtables_unregister_table_exitLinux
- CVE-2026-64077netfilter: ebtables: move to two-stage removal schemeLinux
- CVE-2026-64076netfilter: bridge: eb_tables: close module init raceLinux
- CVE-2026-64074fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmapLinux
- CVE-2026-64073irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RTLinux
- CVE-2026-64058netfs: Fix netfs_read_folio() to wait on writebackLinux
- CVE-2026-64057afs: Fix the locking used by afs_get_link()Linux
- CVE-2026-64053block: don't overwrite bip_vcnt in bio_integrity_copy_user()Linux
- CVE-2026-64051accel/qaic: Add overflow check to remap_pfn_range during mmapLinux
- CVE-2026-64050drm/msm/dpu: don't mix devm and drmm functionsLinux
- CVE-2026-64048net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slotLinux
- CVE-2026-64045ovpn: tcp - use cached peer pointer in ovpn_tcp_close()Linux
- CVE-2026-64044ovpn: respect peer refcount in CMD_NEW_PEER error pathLinux
- CVE-2026-64042vfio/pci: Check BAR resources before exporting a DMABUFLinux
- CVE-2026-64041ASoC: codecs: fs210x: fix possible buffer overflowLinux
- CVE-2026-64039drm/msm/snapshot: fix dumping of the unaligned regionsLinux
- CVE-2026-64036cgroup/rstat: validate cpu before css_rstat_cpu() accessLinux
- CVE-2026-64032bridge: mcast: Fix a possible use-after-free when removing a bridge portLinux
- CVE-2026-64031erofs: fix managed cache race for unaligned extentsLinux
- CVE-2026-64030wifi: mac80211: bounds-check link_id in ieee80211_ml_epcsLinux
- CVE-2026-64029ALSA: seq: Serialize UMP output teardown with event_inputLinux
- CVE-2026-64027net: shaper: rework the VALID marking (again)Linux
- CVE-2026-64026rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsgLinux
- CVE-2026-64023gpio: aggregator: fix a potential use-after-freeLinux
- CVE-2026-64020nvme-pci: fix dma_vecs leak on p2p memoryLinux
- CVE-2026-64017blk-mq: pop cached request if it is usableLinux
- CVE-2026-64015security/keys: fix missed RCU read section on lookupLinux
- CVE-2026-64011nfc: llcp: Fix use-after-free in llcp_sock_release()Linux
- CVE-2026-64010nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()Linux
- CVE-2026-64009xfrm: Check for underflow in xfrm_state_mtuLinux
- CVE-2026-64008accel/rocket: fix UAF via dangling GEM handle in create_boLinux
- CVE-2026-64005net/smc: Do not re-initialize smc hashtablesLinux
- CVE-2026-64004net/iucv: fix locking in .getsockoptLinux
- CVE-2026-64003scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queuesLinux
- CVE-2026-64002ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()Linux
- CVE-2026-63996ethtool: cmis: require exact CDB reply lengthLinux
- CVE-2026-63995ethtool: cmis: validate start_cmd_payload_size from moduleLinux
- CVE-2026-63987ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILESLinux
- CVE-2026-63985ethtool: eeprom: add more safeties to EEPROM Netlink fallbackLinux
- CVE-2026-63980net/handshake: Use spin_lock_bh for hn_lockLinux
- CVE-2026-63977dpll: zl3073x: use __dpll_device_change_ntf() and remove change_workLinux
- CVE-2026-63976Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration successLinux
- CVE-2026-63975Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rspLinux
- CVE-2026-63974Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device closeLinux
- CVE-2026-63972net: mana: Skip redundant detach on already-detached portLinux
- CVE-2026-63971sctp: fix race between sctp_wait_for_connect and peeloffLinux
- CVE-2026-63970vsock/virtio: bind uarg before filling zerocopy skbLinux
- CVE-2026-63968ipv6: fix possible infinite loop in fib6_select_path()Linux
- CVE-2026-63955mm/vmalloc: do not trigger BUG() on BH disabled contextLinux
- CVE-2026-63954hpfs: fix a crash if hpfs_map_dnode_bitmap failsLinux
- CVE-2026-63952memfd: deny writeable mappings when implying SEAL_WRITELinux
- CVE-2026-63951zram: fix use-after-free in zram_writeback_endioLinux
- CVE-2026-63950mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_oneLinux
- CVE-2026-63947Bluetooth: HIDP: fix missing length checks in hidp_input_report()Linux
- CVE-2026-63946Bluetooth: ISO: fix UAF in iso_recv_frameLinux
- CVE-2026-63945Bluetooth: ISO: serialize iso_sock_clear_timer with socket lockLinux
- CVE-2026-63944Bluetooth: hci_sync: fix UAF in hci_le_create_cis_syncLinux
- CVE-2026-63942parport: Fix race between port and client registrationLinux
- CVE-2026-63941KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisorLinux
- CVE-2026-63937KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC bufferLinux
- CVE-2026-63930iio: buffer: hw-consumer: fix use-after-free in error pathLinux
- CVE-2026-63927usb: dwc2: Fix use after free in debug codeLinux
- CVE-2026-63926bpf: sockmap: fix tail fragment offset in bpf_msg_push_dataLinux
- CVE-2026-63925macsec: fix replay protection at XPN lower-PN wrapLinux
- CVE-2026-63923octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notifyLinux
- CVE-2026-63921ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().Linux
- CVE-2026-63920ipv6: validate extension header length before copying to cmsgLinux
- CVE-2026-63919xfrm: input: hold netns during deferred transport reinjectionLinux
- CVE-2026-63918l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifnameLinux
- CVE-2026-63917ip6: vti: Use ip6_tnl.net in vti6_changelink().Linux
- CVE-2026-63916HID: wacom: Fix OOB write in wacom_hid_set_device_mode()Linux
- CVE-2026-63915nfc: hci: fix out-of-bounds read in HCP header parsingLinux
- CVE-2026-63914xfrm: route MIGRATE notifications to caller's netnsLinux
- CVE-2026-63913netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction checkLinux
- CVE-2026-63911xfrm: iptfs: reset runtime state when cloning SAsLinux
- CVE-2026-63910dma-buf: fix UAF in dma_buf_fd() tracepointLinux
- CVE-2026-63909ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loopsLinux
- CVE-2026-63906usb: musb: omap2430: Fix use-after-free in omap2430_probe()Linux
- CVE-2026-63894usb: gadget: f_fs: serialize DMABUF cancel against request completionLinux
- CVE-2026-63893thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()Linux
- CVE-2026-63889scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32Linux
- CVE-2026-63885drm/gem: fix race between change_handle and handle_deleteLinux
- CVE-2026-63884drm/i915: Fix potential UAF in TTM object purgeLinux
- CVE-2026-63883serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQLinux
- CVE-2026-63881drm/amdkfd: fix a vulnerability of integer overflow in kfd debuggerLinux
- CVE-2026-63879drm/amdgpu: fix amdgpu_hmm_range_get_pagesLinux
- CVE-2026-63875arm64: tlb: Flush walk cache when unsharing PMD tablesLinux
- CVE-2026-63874net: mctp: usb: fix race between urb completion and rx_retry cancellationLinux
- CVE-2026-63870ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()Linux
- CVE-2026-63869wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotapLinux
- CVE-2026-63867mptcp: close TOCTOU race while computing rcv_wndLinux
- CVE-2026-16221fast-uri vulnerable to host confusion via literal backslash authority delimiterfast-uri
- CVE-2026-63866wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()Linux
- CVE-2026-63865bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooksLinux
- CVE-2026-63864bpf: Propagate error from visit_tailcall_insnLinux
- CVE-2026-63863drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()Linux
- CVE-2026-63860RDMA/core: Prefer NLA_NUL_STRINGLinux
- CVE-2026-63858netfilter: nf_tables: add hook transactions for device deletionsLinux
- CVE-2026-63856drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec ringsLinux
- CVE-2026-63855drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec ringsLinux
- CVE-2026-63854drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec ringsLinux
- CVE-2026-63853drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ringLinux
- CVE-2026-63852drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ringLinux
- CVE-2026-63851drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ringLinux
- CVE-2026-63850drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ringLinux
- CVE-2026-63849drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ringLinux
- CVE-2026-63848drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ringLinux
- CVE-2026-63847drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ringLinux
- CVE-2026-63846drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ringLinux
- CVE-2026-63845drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ringLinux
- CVE-2026-63844drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ringLinux
- CVE-2026-63843drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ringLinux
- CVE-2026-63842drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ringLinux
- CVE-2026-63841drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ringLinux
- CVE-2026-63840drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ringLinux
- CVE-2026-63833ntfs3: reject direct userspace writes to reserved $LX* xattrsLinux
- CVE-2026-63832wifi: mt76: add wcid publish check in mt76_sta_addLinux
- CVE-2026-63831mac802154: llsec: add skb_cow_data() before in-place cryptoLinux
- CVE-2026-63829net: ip_gre: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-63828apparmor: mediate the implicit connect of TCP fast open sendmsgLinux
- CVE-2026-63827apparmor: fix use-after-free in rawdata dedup loopLinux
- CVE-2026-63824KEYS: fix overflow in keyctl_pkey_params_get_2()Linux
- CVE-2026-63823keys: Pin request_key_auth payload in instantiate pathsLinux
- CVE-2026-63819f2fs: fix to do sanity check on f2fs_get_node_folio_ra()Linux
- CVE-2026-63818f2fs: validate orphan inode entry countLinux
- CVE-2026-63817f2fs: validate compress cache inode only when enabledLinux
- CVE-2026-63816f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inodeLinux
- CVE-2026-63815f2fs: bound i_inline_xattr_size for non-inline-xattr inodesLinux
- CVE-2026-63814f2fs: validate ACL entry sizes in f2fs_acl_from_disk()Linux
- CVE-2026-63813Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"Linux
- CVE-2026-63812f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()Linux
- CVE-2026-63809bpf: use kvfree() for replaced sysctl write bufferLinux
- CVE-2026-63807KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping levelLinux
- CVE-2026-63806KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()Linux
- CVE-2026-63805crypto: nx - fix nx_crypto_ctx_exit argumentLinux
- CVE-2026-63803hdlc_ppp: sync per-proto timers before freeing hdlc stateLinux
- CVE-2026-63802blk-cgroup: fix UAF in __blkcg_rstat_flush()Linux
- CVE-2026-63801tipc: fix slab-use-after-free Read in tipc_aead_decrypt_doneLinux
- CVE-2026-63799sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup pathLinux
- CVE-2026-63797rpmsg: char: Fix use-after-free on probe error pathLinux
- CVE-2026-63796ocfs2: reject oversized group bitmap descriptorsLinux
- CVE-2026-63793ntfs: serialize volume label accessesLinux
- CVE-2026-53402fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()Linux
- CVE-2026-53401fbdev: omap2: fix use-after-free in omapfb_mmapLinux
- CVE-2026-53400i2c: core: fix adapter registration raceLinux
- CVE-2026-53397nfsd: fix posix_acl leak on SETACL decode failureLinux
- CVE-2026-53396nfsd: fix posix_acl leak and ignored error in nfsd4_create_fileLinux
- CVE-2026-53395nfsd: fix dead ACL conflict guard in nfsd4_createLinux
- CVE-2026-53394nfsd: avoid leaking pre-allocated openowner on unconfirmed retry raceLinux
- CVE-2026-53392NFSv4/flexfiles: reject zero filehandle version countLinux
- CVE-2026-53391NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addrLinux
- CVE-2026-53390ksmbd: fix out-of-bounds read in smb_check_perm_dacl()Linux
- CVE-2026-53389net/tcp-ao: fix use-after-free of key in del_async pathLinux
- CVE-2026-53388fuse: re-lock request before replacing page cache folioLinux
- CVE-2026-53387iio: light: veml6075: add bounds check to veml6075_it_ms indexLinux
- CVE-2026-53386iio: adc: ti-ads1298: add bounds check to pga_settings indexLinux
- CVE-2026-53383ksmbd: reject non-VALID session in compound request branchLinux
- CVE-2026-53381virtiofs: fix UAF on submount umountLinux
- CVE-2026-53380media: rzv2h-ivc: Fix concurrent buffer list accessLinux
- CVE-2026-53375drm/amdgpu/vce: Prevent partial address patchesLinux
- CVE-2026-53374drm/amdgpu: zero-initialize GART table on allocationLinux
- CVE-2026-53373mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()Linux
- CVE-2026-53369udf: reject descriptors with oversized CRC lengthLinux
- CVE-2026-53368f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usageLinux
Medium, low and unrated 201
- CVE-2026-45138CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Ruleci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-64186iommu/amd: Remove latent out-of-bounds access in IOMMU debugfsLinux
- CVE-2026-64185sysfs: don't remove existing directory on update failureLinux
- CVE-2026-64184mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()Linux
- CVE-2026-64183efi: Allocate runtime workqueue before ACPI initLinux
- CVE-2026-64182drivers/base/memory: fix memory block reference leak in poison accountingLinux
- CVE-2026-64180mm/memory_hotplug: fix memory block reference leak on removeLinux
- CVE-2026-64179net: wwan: iosm: fix potential memory leaks in ipc_imem_init()Linux
- CVE-2026-64177phonet/pep: disable BH around forwarded sk_receive_skb()Linux
- CVE-2026-64174wifi: cfg80211: advance loop vars in cfg80211_merge_profile()Linux
- CVE-2026-64173tracing: Do not call map->ops->elt_free() if elt_alloc() failsLinux
- CVE-2026-64171i2c: tegra: fix pm_runtime leak on mutex_lock failureLinux
- CVE-2026-64170spi: qup: fix error pointer deref after DMA setup failureLinux
- CVE-2026-64169spi: ep93xx: fix error pointer deref after DMA setup failureLinux
- CVE-2026-64168spi: sprd: fix error pointer deref after DMA setup failureLinux
- CVE-2026-64167kho: skip KHO for crash kernelLinux
- CVE-2026-64166firmware: arm_ffa: Check for NULL FF-A ID table while driver registrationLinux
- CVE-2026-64165ARM: integrator: Fix early initializationLinux
- CVE-2026-64164btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()Linux
- CVE-2026-64163test_kprobes: clear kprobes between test runsLinux
- CVE-2026-64161net: ti: icssm-prueth: fix eth_ports_node leak in probeLinux
- CVE-2026-64159netfs: Fix zeropoint update where i_size > remote_i_sizeLinux
- CVE-2026-64157netfs: Fix partial invalidation of streaming-write folioLinux
- CVE-2026-64156netfs, afs: Fix write skipping in dir/link writepagesLinux
- CVE-2026-64155wifi: ath11k: fix error path leaks in some WMI WOW callsLinux
- CVE-2026-64154drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()Linux
- CVE-2026-64149dma-mapping: move dma_map_resource() sanity check into debug codeLinux
- CVE-2026-64147pds_core: fix debugfs_lookup dentry leak and error handlingLinux
- CVE-2026-64146erofs: fix metabuf leak in inode xattr initializationLinux
- CVE-2026-64145wifi: wilc1000: fix dma_buffer leak on bus acquire failureLinux
- CVE-2026-64144Bluetooth: btmtk: fix urb->setup_packet leak in error pathsLinux
- CVE-2026-64143platform/x86: uniwill-laptop: Do not enable the charging limit even when forcedLinux
- CVE-2026-64139ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflowLinux
- CVE-2026-64135hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAXLinux
- CVE-2026-64131mm/memory: fix spurious warning when unmapping device-private/exclusive pagesLinux
- CVE-2026-64130mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_freeLinux
- CVE-2026-64129mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_pageLinux
- CVE-2026-64128Bluetooth: ISO: drop ISO_END frames received without prior ISO_STARTLinux
- CVE-2026-64127Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointerLinux
- CVE-2026-64121net: ifb: report ethtool stats over num_tx_queuesLinux
- CVE-2026-64120net: ethtool: fix NULL pointer dereference in phy_reply_sizeLinux
- CVE-2026-64119l2tp: use list_del_rcu in l2tp_session_unhashLinux
- CVE-2026-64110igc: fix potential skb leak in igc_fpe_xmit_smd_frame()Linux
- CVE-2026-64107ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()Linux
- CVE-2026-64105KVM: arm64: vgic: Free private_irqs when init fails after allocationLinux
- CVE-2026-64103scsi: isci: Fix use-after-free in device removal pathLinux
- CVE-2026-64101fwctl: pds: Validate RPC input size before parsingLinux
- CVE-2026-64100drm/msm: Fix shrinker deadlockLinux
- CVE-2026-64094batman-adv: bla: avoid NULL-ptr deref for claim via dropped interfaceLinux
- CVE-2026-64092batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdownLinux
- CVE-2026-64090batman-adv: tt: avoid empty VLAN responsesLinux
- CVE-2026-64087hwmon: (pmbus/adm1266) reject implausible blackbox record_countLinux
- CVE-2026-64085hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized bufferLinux
- CVE-2026-64083hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessorsLinux
- CVE-2026-64079netfilter: x_tables: allocate hook ops while under mutexLinux
- CVE-2026-64075fprobe: Fix unregister_fprobe() to wait for RCU grace periodLinux
- CVE-2026-64072nvme: fix bio leak on mapping failureLinux
- CVE-2026-64071nvme-pci: fix use-after-free in nvme_free_host_mem()Linux
- CVE-2026-64070powerpc/hv-gpci: fix preempt count leak in sysfs show pathsLinux
- CVE-2026-64065netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() callLinux
- CVE-2026-64064netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes goneLinux
- CVE-2026-64063netfs: Fix streaming write being overwrittenLinux
- CVE-2026-64062netfs: Fix potential deadlock in write-through modeLinux
- CVE-2026-64060netfs: Fix leak of request in netfs_write_begin() error handlingLinux
- CVE-2026-64059netfs: Fix folio->private handling in netfs_perform_write()Linux
- CVE-2026-64054net: shaper: reject duplicate leaves in GROUP requestLinux
- CVE-2026-64052block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()Linux
- CVE-2026-64049drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xxLinux
- CVE-2026-64043ovpn: fix race between deleting interface and adding new peerLinux
- CVE-2026-64040cachefiles: Fix error return when vfs_mkdir() failsLinux
- CVE-2026-64038hwmon: (lm90) Stop work before releasing hwmon deviceLinux
- CVE-2026-64028tracing: Avoid NULL return from hist_field_name() on truncationLinux
- CVE-2026-64022gpio: aggregator: remove the software node when deactivating the aggregatorLinux
- CVE-2026-64021drm/xe/oa: Fix exec_queue leak on width check in stream openLinux
- CVE-2026-64019nvme-pci: fix dma mapping leak on data setup errorLinux
- CVE-2026-64014Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer sizeLinux
- CVE-2026-64013ACPI: button: Fix ACPI GPE handler leak during removalLinux
- CVE-2026-64012net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peekedLinux
- CVE-2026-64006netfilter: nf_tables: fix dst corruption in same register operationLinux
- CVE-2026-64001ALSA: pcm: oss: Fix setup list UAF on proc write errorLinux
- CVE-2026-63999ethtool: rss: fix indir_table and hkey leak on get_rxfh failureLinux
- CVE-2026-63998ethtool: module: call ethnl_ops_complete() on module flash errorsLinux
- CVE-2026-63997ethtool: module: avoid leaking a netdev ref on module flash errorsLinux
- CVE-2026-63991Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()Linux
- CVE-2026-63990bonding: refuse to enslave CAN devicesLinux
- CVE-2026-63989bridge: Fix sleep in atomic context in netlink pathLinux
- CVE-2026-63988bridge: Fix sleep in atomic context in sysfs pathLinux
- CVE-2026-63986ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failureLinux
- CVE-2026-63983net/sched: fix packet loop on netem when duplicate is onLinux
- CVE-2026-63982net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loopLinux
- CVE-2026-63981net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflowLinux
- CVE-2026-63973net: mana: Add NULL guards in teardown path to prevent panic on attach failureLinux
- CVE-2026-63969ipv6: fix possible infinite loop in rt6_fill_node()Linux
- CVE-2026-63967iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO bufferLinux
- CVE-2026-63966iio: imu: adis16550: fix stack leak in trigger handlerLinux
- CVE-2026-63965iio: pressure: bmp280: fix stack leak in bmp580 trigger handlerLinux
- CVE-2026-63964usb: typec: ucsi: ccg: reject firmware images without a ':' record headerLinux
- CVE-2026-63963usb: typec: tcpm: validate VDO count in Discover Identity ACK handlersLinux
- CVE-2026-63962usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()Linux
- CVE-2026-63961usb: typec: altmodes/displayport: validate count before reading Status Update VDOLinux
- CVE-2026-63960usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()Linux
- CVE-2026-63959usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNTLinux
- CVE-2026-63958usb: typec: ucsi: validate connector number in ucsi_connector_change()Linux
- CVE-2026-63957USB: serial: safe_serial: fix memory corruption with small endpointLinux
- CVE-2026-63956USB: serial: cypress_m8: fix memory corruption with small endpointLinux
- CVE-2026-63953mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_pageLinux
- CVE-2026-63949auxdisplay: line-display: fix OOB read on zero-length message_store()Linux
- CVE-2026-63948Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !connLinux
- CVE-2026-63943Input: xpad - fix out-of-bounds access for Share buttonLinux
- CVE-2026-63936iio: adc: mt6359: fix unchecked return value in mt6358_read_impLinux
- CVE-2026-63935iio: adc: nxp-sar-adc: fix division by zero in write_rawLinux
- CVE-2026-63934iio: gyro: itg3200: fix i2c read into the wrong stack locationLinux
- CVE-2026-63933iio: gyro: adis16260: fix division by zero in write_rawLinux
- CVE-2026-63932iio: chemical: mhz19b: reject oversized serial repliesLinux
- CVE-2026-63931iio: chemical: scd30: fix division by zero in write_rawLinux
- CVE-2026-63929iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()Linux
- CVE-2026-63928USB: serial: omninet: fix memory corruption with small endpointLinux
- CVE-2026-63908Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_memLinux
- CVE-2026-63907uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memoryLinux
- CVE-2026-63905usbip: vudc: Fix use after free bug in vudc_remove due to race conditionLinux
- CVE-2026-63904usb: usbtmc: check URB actual_length for interrupt-IN notificationsLinux
- CVE-2026-63903USB: serial: belkin_sa: validate interrupt status lengthLinux
- CVE-2026-63902USB: serial: cypress_m8: validate interrupt packet headersLinux
- CVE-2026-63901USB: serial: digi_acceleport: fix memory corruption with small endpointsLinux
- CVE-2026-63900USB: serial: keyspan: fix missing indat transfer sanity checkLinux
- CVE-2026-63899USB: serial: mxuport: fix memory corruption with small endpointLinux
- CVE-2026-63898USB: serial: mct_u232: fix memory corruption with small endpointLinux
- CVE-2026-63897USB: serial: mct_u232: fix missing interrupt-in transfer sanity checkLinux
- CVE-2026-63896usb: gadget: composite: fix integer underflow in WebUSB GET_URL handlingLinux
- CVE-2026-63895usb: gadget: f_fs: copy only received bytes on short ep0 readLinux
- CVE-2026-63892thunderbolt: property: Reject dir_len < 4 to prevent size_t underflowLinux
- CVE-2026-63891thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()Linux
- CVE-2026-63890scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walkerLinux
- CVE-2026-63882drm/amdkfd: fix NULL pointer bug in svm_range_set_attrLinux
- CVE-2026-63880drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFOLinux
- CVE-2026-63878drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFOLinux
- CVE-2026-63877serial: dz: Convert to use a platform deviceLinux
- CVE-2026-63876serial: zs: Convert to use a platform deviceLinux
- CVE-2026-63873accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()Linux
- CVE-2026-63871Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route callsLinux
- CVE-2026-63868net: garp: fix unsigned integer underflow in garp_pdu_parse_attrLinux
- CVE-2026-63862PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not foundLinux
- CVE-2026-63861spi: mtk-snfi: unregister ECC engine on probe failure and remove() callbackLinux
- CVE-2026-63859net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()Linux
- CVE-2026-63839platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()Linux
- CVE-2026-63838ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]Linux
- CVE-2026-63837net: ena: PHC: Check return code before setting timestamp outputLinux
- CVE-2026-63836batman-adv: tp_meter: avoid divide-by-zero for dec_cwndLinux
- CVE-2026-63835batman-adv: v: prevent OGM aggregation on disabled hardifLinux
- CVE-2026-63834batman-adv: tp_meter: restrict number of unacked list entriesLinux
- CVE-2026-63826fbdev: fix use-after-free in store_modes()Linux
- CVE-2026-63822wifi: ath11k: fix warning when unbindingLinux
- CVE-2026-63821wifi: rtw88: usb: fix memory leaks on USB write failuresLinux
- CVE-2026-63820f2fs: fix missing read bio submission on large folio errorLinux
- CVE-2026-63811f2fs: read COW data with the original inode during atomic writeLinux
- CVE-2026-63810block: Avoid mounting the bdev pseudo-filesystem in userspaceLinux
- CVE-2026-63804gfs2: fix use-after-free in gfs2_qd_deallocLinux
- CVE-2026-63798irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on removeLinux
- CVE-2026-63794KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT pathLinux
- CVE-2026-53403fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_varLinux
- CVE-2026-53393nfsd: reset write verifier on deferred writeback errorsLinux
- CVE-2026-53385vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_writeLinux
- CVE-2026-53382media: vidtv: fix NULL pointer dereference in vidtv_mux_push_siLinux
- CVE-2026-53379media: i2c: ov8856: free control handler on error in ov8856_init_controls()Linux
- CVE-2026-53378drm/colorop: Fix blob property reference tracking in state lifecycleLinux
- CVE-2026-53377drm/msm: always recover the gpuLinux
- CVE-2026-53376drm/amdkfd: Add upper bound check for num_of_nodesLinux
- CVE-2026-16229itsourcecode Courier Management System index.php cross site scriptingitsourcecode Courier Management System
- CVE-2026-16228SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-16227SourceCodester Class and Exam Timetabling System edit_subject.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-53372iommu/vt-d: Block PASID attachment to nested domain with dirty trackingLinux
- CVE-2026-53371RDMA/ionic: bound node_desc sysfs read with %.64sLinux
- CVE-2026-53370perf/x86/intel: Improve validation and configuration of ACR masksLinux
- CVE-2026-53367selinux: fix avdcache auditingLinux
- CVE-2026-16226SourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted uploadSourceCodester Pizzafy Ecommerce System
- CVE-2026-16225davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds writedavenardella snap7
- CVE-2026-16224jxxghp MoviePilot Application API improper authorizationjxxghp MoviePilot
- CVE-2026-162231Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery1Panel-dev CordysCRM
- CVE-2026-162221Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery1Panel-dev CordysCRM
- CVE-2026-16220code-projects Online Examination System account.php cross site scriptingcode-projects Online Examination System
- CVE-2026-16219Croogo CMS Admin File Manager FileManager.php isEditable path traversalCroogo CMS
- CVE-2026-16218hunvreus devpush Storage Reset Failure storage.py reset_storage improper check or handling of exceptional conditionshunvreus devpush
- CVE-2026-16217guohongze adminset Delivery Deployment Endpoint deli.py authorizationguohongze adminset
- CVE-2026-16216geex-arts django-jet OAuth cross-site request forgerygeex-arts django-jet
- CVE-2026-16215geex-arts django-jet OAuth Credential Revoke authorizationgeex-arts django-jet
- CVE-2026-16214geex-arts django-jet Dashboard views.py authorizationgeex-arts django-jet
- CVE-2026-16213Fantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storageFantomas42 django-blog-zinnia
- CVE-2026-16212awesto django-shop Purchase Stock inventory.py race conditionawesto django-shop
- CVE-2026-16211allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race conditionallegro
- CVE-2026-16210newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authenticationnewpanjing simpleui
- CVE-2026-16209Gerapy Project Upload Endpoint views.py missing authenticationGerapy
- CVE-2026-16208django-tastypie throttle.py CacheDBThrottle race conditiondjango-tastypie
- CVE-2026-16207django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query stringsdjango-tastypie
- CVE-2026-16206django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expirationdjango-oauth-toolkit
- CVE-2026-16205Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scriptingPluck CMS
- CVE-2026-16204zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injectionzevorn rt-claw
- CVE-2026-16203SourceCodester Class and Exam Timetabling System forCYS.php cross site scriptingSourceCodester Class and Exam Timetabling System
- CVE-2026-16202SourceCodester Class and Exam Timetabling System CYS.php cross site scriptingSourceCodester Class and Exam Timetabling System
- CVE-2026-16201zevorn rt-claw http_request net.c claw_net_post information disclosurezevorn rt-claw
- CVE-2026-16200zevorn rt-claw RPC swarm.c claw_tool_invoke authorizationzevorn rt-claw
- CVE-2026-16199nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorizationnextlevelbuilder GoClaw