CVEs published July 25, 2026
284 CVEs were published on July 25, 2026: 25 critical, 104 high.
- Published
- 284
- Critical
- 25
- High
- 104
- Medium
- 4
- Low
- 0
- Unrated
- 151
- Now in CISA KEV
- 0
- Fix available
- 131
Most affected products
- Linux
- 274
- ImageMagick · Magick.NET-Q16-AnyCPU +16
- 1
- nic Knot Resolver
- 1
- openremote
- 1
- Redis
- 1
- RRWO Catalyst::View::Wkhtmltopdf
- 1
- siyuan-note siyuan
- 1
- Themehigh Checkout Field Editor for WooCommerce
- 1
- WPForms Pro
- 1
- Yoast SEO – Advanced SEO with real-time guidance and built-…
- 1
Critical 25
- CVE-2026-66013OpenRemote before 1.26.2 Authentication Bypass via Console Registrationopenremote
- CVE-2026-66012SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCPsiyuan-note siyuan
- CVE-2026-64523net/handshake: Take a long-lived file reference at submitLinux
- CVE-2026-64459tcp: restore RCU grace period in tcp_ao_destroy_sockLinux
- CVE-2026-64450tipc: fix out-of-bounds read in broadcast Gap ACK blocksLinux
- CVE-2026-64439crypto: krb5 - filter out async aead implementations at allocLinux
- CVE-2026-64410netfilter: flowtable: IPIP tunnel hardware offload is not yet supportLinux
- CVE-2026-64399ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILELinux
- CVE-2026-64397ksmbd: serialize QUERY_DIRECTORY requests per fileLinux
- CVE-2026-64393ksmbd: run set info with opener credentialsLinux
- CVE-2026-64392ksmbd: use opener credentials for delete-on-closeLinux
- CVE-2026-64391ksmbd: use opener credentials for ADS I/OLinux
- CVE-2026-64387smb: client: fix query directory replay double-freeLinux
- CVE-2026-64386smb: client: fix query_info() replay double-freeLinux
- CVE-2026-64385smb: client: fix double-free in SMB2_ioctl() replayLinux
- CVE-2026-64384smb: client: fix change notify replay double-freeLinux
- CVE-2026-64383smb: client: fix double-free in SMB2_flush() replayLinux
- CVE-2026-64355bpf: Reject fragmented frames in devmapLinux
- CVE-2026-64320nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log PageLinux
- CVE-2026-64319nvmet-auth: validate reply message payload bounds against transfer lengthLinux
- CVE-2026-64303spi: fsl-lpspi: terminate the RX channel on TX prepare failure pathLinux
- CVE-2026-64269RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sgLinux
- CVE-2026-64268RDMA/siw: bound Read Response placement to the RREAD lengthLinux
- CVE-2026-64257smb: client: reject overlapping data areas in SMB2 responsesLinux
- CVE-2026-16766Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render optionsRRWO Catalyst::View::Wkhtmltopdf
High 104
- CVE-2026-64529crypto: qat - remove unused character device and IOCTLsLinux
- CVE-2026-64524drm/hyperv: validate resolution_count and fix WIN8 fallbackLinux
- CVE-2026-64522net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SALinux
- CVE-2026-64520firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copiesLinux
- CVE-2026-64516drm/amdgpu/vce1: Fix VCE 1 firmware size and offsetsLinux
- CVE-2026-64515wifi: mac80211: fix MLE defragmentationLinux
- CVE-2026-64510ACPI: NFIT: core: Fix acpi_nfit_init() error cleanupLinux
- CVE-2026-64502iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devicesLinux
- CVE-2026-64501iio: adc: ad_sigma_delta: fix CS held asserted and state leaksLinux
- CVE-2026-64496iio: event: Fix event FIFO reset raceLinux
- CVE-2026-64490ALSA: virtio: Validate control metadata from the deviceLinux
- CVE-2026-64485ALSA: compress: Fix task creation error unwindLinux
- CVE-2026-64481ALSA: hda/cs35l41: Fix firmware load work teardownLinux
- CVE-2026-64475vfio/pci: Release the VGA arbiter client on register_device() failureLinux
- CVE-2026-64469binder: fix UAF in binder_thread_release()Linux
- CVE-2026-64468binder: fix UAF in binder_free_transaction()Linux
- CVE-2026-64467rust_binder: use a u64 stride when cleaning up the offsets arrayLinux
- CVE-2026-64463usb: typec: tcpci_rt1711h: unregister TCPCI port with devresLinux
- CVE-2026-64460PCI/IOV: Skip VF Resizable BAR restore on read errorLinux
- CVE-2026-64456hwrng: virtio: clamp device-reported used.len at copy_data()Linux
- CVE-2026-644526lowpan: fix NHC entry use-after-free on error pathLinux
- CVE-2026-64449staging: vme_user: bound slave read/write to the kern_buf sizeLinux
- CVE-2026-64448smb: client: restrict implied bcc[0] exemption to responses without data areaLinux
- CVE-2026-64447staging: media: ipu7: fix double-free and use-after-free in error pathsLinux
- CVE-2026-64445staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()Linux
- CVE-2026-64444staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loopLinux
- CVE-2026-64443staging: rtl8723bs: fix OOB read in update_beacon_info() IE loopLinux
- CVE-2026-64442staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()Linux
- CVE-2026-64441staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()Linux
- CVE-2026-64440staging: rtl8723bs: fix OOB write in HT_caps_handler()Linux
- CVE-2026-64438crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()Linux
- CVE-2026-64437ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCELLinux
- CVE-2026-64436net: af_key: initialize alg_key_len for IPComp statesLinux
- CVE-2026-64435audit: Fix data races of skb_queue_len() readers on audit_queueLinux
- CVE-2026-64434Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn refLinux
- CVE-2026-64432fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcnsLinux
- CVE-2026-64431ntfs: avoid calling post_write_mst_fixup() for invalid index_blockLinux
- CVE-2026-64430NTB: epf: Avoid calling pci_irq_vector() from hardirq contextLinux
- CVE-2026-64423ipv4: igmp: remove multicast group from hash table on device destructionLinux
- CVE-2026-64422net: ipv4: bound TCP reordering sysctl writes and MTU probe sizesLinux
- CVE-2026-64420mfd: cros_ec: Delay dev_set_drvdata() until probe successLinux
- CVE-2026-64418mm: shrinker: fix shrinker_info teardown race with expansionLinux
- CVE-2026-64414netfilter: handle unreadable fragsLinux
- CVE-2026-64413netfilter: ebtables: zero chainstack arrayLinux
- CVE-2026-64412netfilter: ebtables: module names must be null-terminatedLinux
- CVE-2026-64411netfilter: ebtables: terminate table name before find_table_lock()Linux
- CVE-2026-64408Bluetooth: bnep: pin L2CAP connection during netdev registrationLinux
- CVE-2026-64406Bluetooth: fix UAF in bt_accept_dequeue()Linux
- CVE-2026-64403Bluetooth: L2CAP: validate option length before reading conf opt valueLinux
- CVE-2026-64402coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()Linux
- CVE-2026-64401smb: client: resolve SWN tcon from live registrationsLinux
- CVE-2026-64400ksmbd: prevent path traversal bypass by restricting caseless retryLinux
- CVE-2026-64398ksmbd: add a permission check for FSCTL_SET_ZERO_DATALinux
- CVE-2026-64396ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellationLinux
- CVE-2026-64395ksmbd: require source read access for duplicate extentsLinux
- CVE-2026-64394ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITYLinux
- CVE-2026-64390ksmbd: track the connection owning a byte-range lockLinux
- CVE-2026-64389ksmbd: validate NTLMv2 response before updating session keyLinux
- CVE-2026-64388smb/client: fix chown/chgrp with SMB3 POSIX ExtensionsLinux
- CVE-2026-64382smb: client: fix double-free in SMB2_open() replayLinux
- CVE-2026-64380smb: client: harden POSIX SID length parsingLinux
- CVE-2026-64379smb: client: mask server-provided mode to 07777 in modefromsidLinux
- CVE-2026-64378writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()Linux
- CVE-2026-64375proc: protect ptrace_may_access() with exec_update_lock (FD links)Linux
- CVE-2026-64374sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RTLinux
- CVE-2026-64372cpufreq: pcc: fix use-after-free and double free in _OSC evaluationLinux
- CVE-2026-64368mm/slab: do not limit zeroing to orig_size when only red zoning is enabledLinux
- CVE-2026-64367HID: hid-goodix-spi: validate report size to prevent stack buffer overflowLinux
- CVE-2026-64366HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insertLinux
- CVE-2026-64364HID: multitouch: fix out-of-bounds bit access on mt_io_flagsLinux
- CVE-2026-64361hfs/hfsplus: fix u32 overflow in check_and_correct_requested_lengthLinux
- CVE-2026-64354bpf: Validate BTF repeated field counts before expansionLinux
- CVE-2026-64333USB: serial: digi_acceleport: fix write buffer corruptionLinux
- CVE-2026-64324udf: validate free block extents against the partition lengthLinux
- CVE-2026-64323udf: validate VAT header length against the VAT inode sizeLinux
- CVE-2026-64322udf: validate sparing table length as an entry count, not a byte countLinux
- CVE-2026-64318partitions: aix: bound the pp_count scan to the ppe arrayLinux
- CVE-2026-64317isofs: bound Rock Ridge symlink components to the SL recordLinux
- CVE-2026-64315crypto: caam - use print_hex_dump_devel to guard key hex dumpsLinux
- CVE-2026-64313crypto: ecc - Fix carry overflow in vli multiplicationLinux
- CVE-2026-64312crypto: pcrypt - restore callback for non-parallel fallbackLinux
- CVE-2026-64311crypto: loongson - Remove broken and unused loongson-rngLinux
- CVE-2026-64304crypto: qat - validate RSA CRT component lengthsLinux
- CVE-2026-64300perf/aux: Fix page UAF in map_range()Linux
- CVE-2026-64299tracing: Prevent out-of-bounds read in glob matchingLinux
- CVE-2026-64298NFSv4: include MAY_WRITE in open permission mask for O_TRUNCLinux
- CVE-2026-64296exfat: bound uniname advance in exfat_find_dir_entry()Linux
- CVE-2026-64293iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq readLinux
- CVE-2026-64287KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPULinux
- CVE-2026-64286KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPULinux
- CVE-2026-64284KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exitsLinux
- CVE-2026-64281svcrdma: wake sq waiters when the transport closesLinux
- CVE-2026-64280fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()Linux
- CVE-2026-64279i2c: core: fix adapter deregistration raceLinux
- CVE-2026-64277Input: synaptics-rmi4 - bound the F3A keymap to the GPIO countLinux
- CVE-2026-64276Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED countLinux
- CVE-2026-64266fuse: re-lock request before returning from fuse_ref_folio()Linux
- CVE-2026-64265fuse: clear intr_entry in fuse_resend and fuse_remove_pending_reqLinux
- CVE-2026-64261fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queuesLinux
- CVE-2026-64260fuse-uring: Avoid queue->stopped races and set/read that value under lockLinux
- CVE-2026-64259fuse-uring: make a fuse_req on SQE commit only findable after memcpyLinux
- CVE-2026-10818WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize OrderingWPForms Pro
- CVE-2026-66374Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.nic Knot Resolver
- CVE-2026-66373Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE paylRedis
Medium, low and unrated 155
- CVE-2026-10681SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slotzephyrproject zephyr
- CVE-2026-66011ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI OptionsImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-64528tty: serial: samsung: Remove redundant port lock acquisition in rx helpersLinux
- CVE-2026-64527drm/hyperv: validate VMBus packet size in receive callbackLinux
- CVE-2026-64526ethtool: tsconfig: fix missing ethnl_ops_complete()Linux
- CVE-2026-64525xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exitLinux
- CVE-2026-64521pinctrl: meson: amlogic-a4: fix deadlock issueLinux
- CVE-2026-64519NFSD: Fix infinite loop in layout state revocationLinux
- CVE-2026-64518tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().Linux
- CVE-2026-64517drm/xe/gsc: Fix double-free of managed BO in error pathLinux
- CVE-2026-64514userfaultfd: gate must_wait writability check on pte_present()Linux
- CVE-2026-64513KVM: x86: Unconditionally recompute CR8 intercept on PPR updateLinux
- CVE-2026-64512ACPI: CPPC: Suppress UBSAN warning caused by field misuseLinux
- CVE-2026-64511ACPI: NFIT: core: Fix possible NULL pointer dereferenceLinux
- CVE-2026-64509rust: block: fix GenDisk cleanup pathsLinux
- CVE-2026-64508bpf: Support for hardening against JIT sprayingLinux
- CVE-2026-64507x86/bugs: Enable IBPB flush on BPF JIT allocationLinux
- CVE-2026-64506wifi: rtw89: correct drop logic for malformed AMPDU framesLinux
- CVE-2026-64505usb: gadget: function: rndis: add length check for headerLinux
- CVE-2026-64504iio: accel: bmc150: clamp the device-reported FIFO frame countLinux
- CVE-2026-64503iio: accel: kxsd9: fix runtime PM imbalance on write_raw() errorLinux
- CVE-2026-64500iio: adc: lpc32xx: Initialize completion before requesting IRQLinux
- CVE-2026-64499iio: adc: ti-ads1119: fix PM reference leak in buffer preenableLinux
- CVE-2026-64498iio: buffer: hw-consumer: free scan_mask on buffer releaseLinux
- CVE-2026-64497iio: chemical: scd30: Cleanup initializations and fix sign-extension bugLinux
- CVE-2026-64495iio: gyro: bmg160: bail out when bandwidth/filter is not in tableLinux
- CVE-2026-64494iio: light: gp2ap002: fix runtime PM leak on read errorLinux
- CVE-2026-64493iio: pressure: mpl115: fix runtime PM leak on read errorLinux
- CVE-2026-64492iio: temperature: tmp006: use devm_iio_trigger_registerLinux
- CVE-2026-64491ALSA: usx2y: us144mkii: fix work UAF on disconnectLinux
- CVE-2026-64489ALSA: ymfpci: check snd_ctl_new1() return valueLinux
- CVE-2026-64488ALSA: aoa: check snd_ctl_new1() return valueLinux
- CVE-2026-64487ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parserLinux
- CVE-2026-64486ALSA: cmipci: check snd_ctl_new1() return valueLinux
- CVE-2026-64484ALSA: es1938: check snd_ctl_new1() return valueLinux
- CVE-2026-64483ALSA: firewire: isight: bound the sample count to the packet payloadLinux
- CVE-2026-64482ALSA: gus: check snd_ctl_new1() return valueLinux
- CVE-2026-64480ALSA: ice1712: check snd_ctl_new1() return valueLinux
- CVE-2026-64479ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()Linux
- CVE-2026-64478ALSA: usb-audio: avoid kobject path lookup in DualSense matchLinux
- CVE-2026-64477x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabledLinux
- CVE-2026-64476vfio/pci: Latch disable_idle_d3 per deviceLinux
- CVE-2026-64474vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arcLinux
- CVE-2026-64473vfio: Remove device debugfs before releasing devresLinux
- CVE-2026-64472vfio/mlx5: Fix racy bitfields and tighten struct layoutLinux
- CVE-2026-64471Bluetooth: btusb: fix use-after-free on registration failureLinux
- CVE-2026-64470Bluetooth: btusb: fix use-after-free on marvell probe failureLinux
- CVE-2026-64466rust_binder: clear freeze listener on node removalLinux
- CVE-2026-64465usb: xhci: Fix sleep in atomic context in xhci_free_streams()Linux
- CVE-2026-64464xhci: sideband: fix ring sg table pages leakLinux
- CVE-2026-64462PCI: altera: Fix resource leaks on probe failureLinux
- CVE-2026-64461PCI: mediatek: Fix IRQ domain leak when port fails to enableLinux
- CVE-2026-64458mm/damon/ops-common: handle extreme intervals in damon_hot_score()Linux
- CVE-2026-64457virtio_pci: fix vq info pointer lookup via wrong indexLinux
- CVE-2026-64455USB: chaoskey: Fix slab-use-after-free in chaoskey_release()Linux
- CVE-2026-64454usb: dwc3: run gadget disconnect from sleepable suspend contextLinux
- CVE-2026-64453usb: misc: usbio: fix disconnect UAF in client teardownLinux
- CVE-2026-64451tracing: Fix NULL pointer dereference in func_set_flag()Linux
- CVE-2026-64446staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()Linux
- CVE-2026-64433Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_completeLinux
- CVE-2026-64429gpio: eic-sprd: use raw_spinlock_t in the irq startup pathLinux
- CVE-2026-64428gpio: sch: use raw_spinlock_t in the irq startup pathLinux
- CVE-2026-64427HID: logitech-dj: Fix maxfield check in DJ short report validationLinux
- CVE-2026-64426io_uring/nop: fix file reference leak with IOSQE_FIXED_FILELinux
- CVE-2026-64425io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work itemLinux
- CVE-2026-64424netpoll: fix a use-after-free on shutdown pathLinux
- CVE-2026-64421media: nxp: imx8-isi: Fix use-after-free on removeLinux
- CVE-2026-64419mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()Linux
- CVE-2026-64417mm: shrinker: fix NULL pointer dereference in debugfsLinux
- CVE-2026-64416mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless hostLinux
- CVE-2026-64415mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockupLinux
- CVE-2026-64409Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()Linux
- CVE-2026-64407Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()Linux
- CVE-2026-64405Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()Linux
- CVE-2026-64404Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()Linux
- CVE-2026-64381smb: client: Fix next buffer leak in receive_encrypted_standard()Linux
- CVE-2026-64377cpufreq: qcom-cpufreq-hw: Fix possible double freeLinux
- CVE-2026-64376firmware_loader: fix device reference leak in firmware_upload_register()Linux
- CVE-2026-64373cpufreq: Fix hotplug-suspend race during rebootLinux
- CVE-2026-64371proc: protect ptrace_may_access() with exec_update_lock (part 1)Linux
- CVE-2026-64370posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error pathLinux
- CVE-2026-64369s390: Revert support for DCACHE_WORD_ACCESSLinux
- CVE-2026-64365HID: letsketch: fix UAF on inrange_timer at driver unbindLinux
- CVE-2026-64363HID: appleir: fix UAF on pending key_up_timer in remove()Linux
- CVE-2026-64362HID: lg-g15: cancel pending work on remove to fix a use-after-freeLinux
- CVE-2026-64360hfs/hfsplus: zero-initialize buffer in hfs_bnode_readLinux
- CVE-2026-64359nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbersLinux
- CVE-2026-64358media: mtk-jpeg: cancel workqueue on release for supported platforms onlyLinux
- CVE-2026-64357xfs: fix exchmaps reservation limit checkLinux
- CVE-2026-64356xfs: fix memory leak in xfs_dqinode_metadir_create()Linux
- CVE-2026-64353bpf: Keep dynamic inner array lookups nullableLinux
- CVE-2026-64352bpf: Allow LPM map access from sleepable BPF programsLinux
- CVE-2026-64351net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()Linux
- CVE-2026-64350usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()Linux
- CVE-2026-64349usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()Linux
- CVE-2026-64348usb: free iso schedules on failed submitLinux
- CVE-2026-64347usb: gadget: composite: fix dead empty check in the USB_DT_OTG handlerLinux
- CVE-2026-64346usb: gadget: udc: Fix use-after-free in gadget_match_driverLinux
- CVE-2026-64345usb: gadget: f_printer: take kref only for successful openLinux
- CVE-2026-64344USB: idmouse: fix use-after-free on disconnect raceLinux
- CVE-2026-64343USB: ldusb: fix use-after-free on disconnect raceLinux
- CVE-2026-64342USB: iowarrior: fix use-after-free on disconnectLinux
- CVE-2026-64341USB: iowarrior: fix use-after-free on disconnect raceLinux
- CVE-2026-64340USB: legousbtower: fix use-after-free on disconnect raceLinux
- CVE-2026-64339usb: misc: usbio: bound bulk IN response length to the received transferLinux
- CVE-2026-64338USB: misc: uss720: unregister parport on probe failureLinux
- CVE-2026-64337usb: mtu3: unmap request DMA on queue failureLinux
- CVE-2026-64336USB: serial: keyspan_pda: fix information leakLinux
- CVE-2026-64335USB: serial: digi_acceleport: fix broken rx after throttleLinux
- CVE-2026-64334USB: serial: digi_acceleport: fix hard lockup on disconnectLinux
- CVE-2026-64332USB: ulpi: fix memory leak on registration failureLinux
- CVE-2026-64331usbip: vudc: fix NULL deref in vep_dequeue()Linux
- CVE-2026-64330usb: typec: tcpm: Validate SVID index in svdm_consume_modes()Linux
- CVE-2026-64329usb: typec: ucsi: ccg: Fix use-after-free of ucsi on removeLinux
- CVE-2026-64328usb: gadget: f_fs: Fix DMA fence leakLinux
- CVE-2026-64327usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checksLinux
- CVE-2026-64326block: skip sync_blockdev() on surprise removal in bdev_mark_dead()Linux
- CVE-2026-64325wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beaconLinux
- CVE-2026-64321nvme: target: rdma: fix ndev refcount leak on queue connectLinux
- CVE-2026-64316crypto: caam - use print_hex_dump_devel to guard key hex dumpsLinux
- CVE-2026-64314crypto: chacha20poly1305 - validate poly1305 template argumentLinux
- CVE-2026-64310crypto: ccp - Do not initialize SNP for SEV ioctlsLinux
- CVE-2026-64309crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)Linux
- CVE-2026-64308crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)Linux
- CVE-2026-64307crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)Linux
- CVE-2026-64306crypto: drbg - Fix returning success on failure in CTR_DRBGLinux
- CVE-2026-64305crypto: qat - protect service table iterations with service_lockLinux
- CVE-2026-64302x86/mm: Fix freeing of PMD-sized vmemmap pagesLinux
- CVE-2026-64301regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()Linux
- CVE-2026-64297module: decompress: check return value of module_extend_max_pages()Linux
- CVE-2026-64295mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN accessLinux
- CVE-2026-64294mm: do file ownership checks with the proper mount idmapLinux
- CVE-2026-64292iommufd: Move vevent memory allocation outside spinlockLinux
- CVE-2026-64291iommufd: Set veventq_depth upper boundLinux
- CVE-2026-64290iommufd: Break the loop on failure in iommufd_fault_fops_read()Linux
- CVE-2026-64289iommufd: Set upper bounds on cache invalidation entry_num and entry_lenLinux
- CVE-2026-64288KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLBLinux
- CVE-2026-64285KVM: SEV: Pin source page for write when adding CPUID data for SNP guestLinux
- CVE-2026-64283KVM: guest_memfd: Treat memslot binding offset+size as unsigned valuesLinux
- CVE-2026-64282KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifierLinux
- CVE-2026-64278i2c: imx-lpi2c: mark I2C adapter when hardware is powered downLinux
- CVE-2026-64275Input: elan_i2c - prevent division by zero and arithmetic underflowLinux
- CVE-2026-64274Input: goodix - clamp the device-reported contact countLinux
- CVE-2026-64273Input: iforce - bound the device-reported force-feedback effect indexLinux
- CVE-2026-64272Input: mms114 - fix touch indexing for MMS134S and MMS136Linux
- CVE-2026-64271Input: touchwin - reset the packet index on every complete packetLinux
- CVE-2026-64270Input: mms114 - reject an oversized device packet sizeLinux
- CVE-2026-64267fuse: avoid 32-bit prune notification count wrapLinux
- CVE-2026-64264fuse-uring: fix EFAULT clobber in fuse_uring_commitLinux
- CVE-2026-64263fuse-uring: fix moving cancelled entry to ent_in_userspace listLinux
- CVE-2026-64262fuse-uring: end fuse_req on io-uring cancel task workLinux
- CVE-2026-64258fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL derefLinux
- CVE-2026-64256xfs: don't wrap around quota ids in dqiterateLinux
- CVE-2026-15425Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)Yoast SEO – Advanced SEO with real-time guidance and built-…
- CVE-2026-14955Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' ParameterThemehigh Checkout Field Editor for WooCommerce