# CVEs published 2026-07-25

284 CVEs were published on July 25, 2026: 25 critical, 104 high. Days are UTC.

- [CVE-2026-10681](https://cve.now/CVE-2026-10681.md): SMP race in \`thread\_idx\_alloc()\` lets concurrent \`k\_object\_alloc(K\_OBJ\_THREAD)\` callers share a kernel-object permission slot (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-66013](https://cve.now/CVE-2026-66013.md): OpenRemote before 1.26.2 Authentication Bypass via Console Registration (CVSS 9.3, openremote)
- [CVE-2026-66012](https://cve.now/CVE-2026-66012.md): SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP (CVSS 10.0, siyuan-note siyuan)
- [CVE-2026-66011](https://cve.now/CVE-2026-66011.md): ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-64529](https://cve.now/CVE-2026-64529.md): crypto: qat - remove unused character device and IOCTLs (CVSS 7.8, Linux)
- [CVE-2026-64528](https://cve.now/CVE-2026-64528.md): tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (no CVSS, Linux)
- [CVE-2026-64527](https://cve.now/CVE-2026-64527.md): drm/hyperv: validate VMBus packet size in receive callback (no CVSS, Linux)
- [CVE-2026-64526](https://cve.now/CVE-2026-64526.md): ethtool: tsconfig: fix missing ethnl\_ops\_complete() (no CVSS, Linux)
- [CVE-2026-64525](https://cve.now/CVE-2026-64525.md): xfrm: move policy\_bydst RCU sync from per-netns .exit to .pre\_exit (no CVSS, Linux)
- [CVE-2026-64524](https://cve.now/CVE-2026-64524.md): drm/hyperv: validate resolution\_count and fix WIN8 fallback (CVSS 7.7, Linux)
- [CVE-2026-64523](https://cve.now/CVE-2026-64523.md): net/handshake: Take a long-lived file reference at submit (CVSS 9.8, Linux)
- [CVE-2026-64522](https://cve.now/CVE-2026-64522.md): net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (CVSS 8.8, Linux)
- [CVE-2026-64521](https://cve.now/CVE-2026-64521.md): pinctrl: meson: amlogic-a4: fix deadlock issue (no CVSS, Linux)
- [CVE-2026-64520](https://cve.now/CVE-2026-64520.md): firmware: arm\_ffa: Bound PARTITION\_INFO\_GET\_REGS copies (CVSS 8.4, Linux)
- [CVE-2026-64519](https://cve.now/CVE-2026-64519.md): NFSD: Fix infinite loop in layout state revocation (no CVSS, Linux)
- [CVE-2026-64518](https://cve.now/CVE-2026-64518.md): tcp: Fix out-of-bounds access for twsk in tcp\_ao\_established\_key(). (no CVSS, Linux)
- [CVE-2026-64517](https://cve.now/CVE-2026-64517.md): drm/xe/gsc: Fix double-free of managed BO in error path (no CVSS, Linux)
- [CVE-2026-64516](https://cve.now/CVE-2026-64516.md): drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets (CVSS 8.8, Linux)
- [CVE-2026-64515](https://cve.now/CVE-2026-64515.md): wifi: mac80211: fix MLE defragmentation (CVSS 8.3, Linux)
- [CVE-2026-64514](https://cve.now/CVE-2026-64514.md): userfaultfd: gate must\_wait writability check on pte\_present() (no CVSS, Linux)
- [CVE-2026-64513](https://cve.now/CVE-2026-64513.md): KVM: x86: Unconditionally recompute CR8 intercept on PPR update (no CVSS, Linux)
- [CVE-2026-64512](https://cve.now/CVE-2026-64512.md): ACPI: CPPC: Suppress UBSAN warning caused by field misuse (no CVSS, Linux)
- [CVE-2026-64511](https://cve.now/CVE-2026-64511.md): ACPI: NFIT: core: Fix possible NULL pointer dereference (no CVSS, Linux)
- [CVE-2026-64510](https://cve.now/CVE-2026-64510.md): ACPI: NFIT: core: Fix acpi\_nfit\_init() error cleanup (CVSS 7.0, Linux)
- [CVE-2026-64509](https://cve.now/CVE-2026-64509.md): rust: block: fix GenDisk cleanup paths (no CVSS, Linux)
- [CVE-2026-64508](https://cve.now/CVE-2026-64508.md): bpf: Support for hardening against JIT spraying (no CVSS, Linux)
- [CVE-2026-64507](https://cve.now/CVE-2026-64507.md): x86/bugs: Enable IBPB flush on BPF JIT allocation (no CVSS, Linux)
- [CVE-2026-64506](https://cve.now/CVE-2026-64506.md): wifi: rtw89: correct drop logic for malformed AMPDU frames (no CVSS, Linux)
- [CVE-2026-64505](https://cve.now/CVE-2026-64505.md): usb: gadget: function: rndis: add length check for header (no CVSS, Linux)
- [CVE-2026-64504](https://cve.now/CVE-2026-64504.md): iio: accel: bmc150: clamp the device-reported FIFO frame count (no CVSS, Linux)
- [CVE-2026-64503](https://cve.now/CVE-2026-64503.md): iio: accel: kxsd9: fix runtime PM imbalance on write\_raw() error (no CVSS, Linux)
- [CVE-2026-64502](https://cve.now/CVE-2026-64502.md): iio: adc: ad\_sigma\_delta: fix clear\_pending\_event for registerless devices (CVSS 7.8, Linux)
- [CVE-2026-64501](https://cve.now/CVE-2026-64501.md): iio: adc: ad\_sigma\_delta: fix CS held asserted and state leaks (CVSS 7.1, Linux)
- [CVE-2026-64500](https://cve.now/CVE-2026-64500.md): iio: adc: lpc32xx: Initialize completion before requesting IRQ (no CVSS, Linux)
- [CVE-2026-64499](https://cve.now/CVE-2026-64499.md): iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (no CVSS, Linux)
- [CVE-2026-64498](https://cve.now/CVE-2026-64498.md): iio: buffer: hw-consumer: free scan\_mask on buffer release (no CVSS, Linux)
- [CVE-2026-64497](https://cve.now/CVE-2026-64497.md): iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (no CVSS, Linux)
- [CVE-2026-64496](https://cve.now/CVE-2026-64496.md): iio: event: Fix event FIFO reset race (CVSS 7.1, Linux)
- [CVE-2026-64495](https://cve.now/CVE-2026-64495.md): iio: gyro: bmg160: bail out when bandwidth/filter is not in table (no CVSS, Linux)
- [CVE-2026-64494](https://cve.now/CVE-2026-64494.md): iio: light: gp2ap002: fix runtime PM leak on read error (no CVSS, Linux)
- [CVE-2026-64493](https://cve.now/CVE-2026-64493.md): iio: pressure: mpl115: fix runtime PM leak on read error (no CVSS, Linux)
- [CVE-2026-64492](https://cve.now/CVE-2026-64492.md): iio: temperature: tmp006: use devm\_iio\_trigger\_register (no CVSS, Linux)
- [CVE-2026-64491](https://cve.now/CVE-2026-64491.md): ALSA: usx2y: us144mkii: fix work UAF on disconnect (no CVSS, Linux)
- [CVE-2026-64490](https://cve.now/CVE-2026-64490.md): ALSA: virtio: Validate control metadata from the device (CVSS 8.4, Linux)
- [CVE-2026-64489](https://cve.now/CVE-2026-64489.md): ALSA: ymfpci: check snd\_ctl\_new1() return value (no CVSS, Linux)
- [CVE-2026-64488](https://cve.now/CVE-2026-64488.md): ALSA: aoa: check snd\_ctl\_new1() return value (no CVSS, Linux)
- [CVE-2026-64487](https://cve.now/CVE-2026-64487.md): ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (no CVSS, Linux)
- [CVE-2026-64486](https://cve.now/CVE-2026-64486.md): ALSA: cmipci: check snd\_ctl\_new1() return value (no CVSS, Linux)
- [CVE-2026-64485](https://cve.now/CVE-2026-64485.md): ALSA: compress: Fix task creation error unwind (CVSS 7.8, Linux)
- [CVE-2026-64484](https://cve.now/CVE-2026-64484.md): ALSA: es1938: check snd\_ctl\_new1() return value (no CVSS, Linux)
- [CVE-2026-64483](https://cve.now/CVE-2026-64483.md): ALSA: firewire: isight: bound the sample count to the packet payload (no CVSS, Linux)
- [CVE-2026-64482](https://cve.now/CVE-2026-64482.md): ALSA: gus: check snd\_ctl\_new1() return value (no CVSS, Linux)
- [CVE-2026-64481](https://cve.now/CVE-2026-64481.md): ALSA: hda/cs35l41: Fix firmware load work teardown (CVSS 7.8, Linux)
- [CVE-2026-64480](https://cve.now/CVE-2026-64480.md): ALSA: ice1712: check snd\_ctl\_new1() return value (no CVSS, Linux)
- [CVE-2026-64479](https://cve.now/CVE-2026-64479.md): ALSA: seq: Fix uninitialised heap leak in snd\_seq\_event\_dup() (no CVSS, Linux)
- [CVE-2026-64478](https://cve.now/CVE-2026-64478.md): ALSA: usb-audio: avoid kobject path lookup in DualSense match (no CVSS, Linux)
- [CVE-2026-64477](https://cve.now/CVE-2026-64477.md): x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (no CVSS, Linux)
- [CVE-2026-64476](https://cve.now/CVE-2026-64476.md): vfio/pci: Latch disable\_idle\_d3 per device (no CVSS, Linux)
- [CVE-2026-64475](https://cve.now/CVE-2026-64475.md): vfio/pci: Release the VGA arbiter client on register\_device() failure (CVSS 8.8, Linux)
- [CVE-2026-64474](https://cve.now/CVE-2026-64474.md): vfio: prevent infinite loop in vfio\_mig\_get\_next\_state() on blocked arc (no CVSS, Linux)
- [CVE-2026-64473](https://cve.now/CVE-2026-64473.md): vfio: Remove device debugfs before releasing devres (no CVSS, Linux)
- [CVE-2026-64472](https://cve.now/CVE-2026-64472.md): vfio/mlx5: Fix racy bitfields and tighten struct layout (no CVSS, Linux)
- [CVE-2026-64471](https://cve.now/CVE-2026-64471.md): Bluetooth: btusb: fix use-after-free on registration failure (no CVSS, Linux)
- [CVE-2026-64470](https://cve.now/CVE-2026-64470.md): Bluetooth: btusb: fix use-after-free on marvell probe failure (no CVSS, Linux)
- [CVE-2026-64469](https://cve.now/CVE-2026-64469.md): binder: fix UAF in binder\_thread\_release() (CVSS 7.8, Linux)
- [CVE-2026-64468](https://cve.now/CVE-2026-64468.md): binder: fix UAF in binder\_free\_transaction() (CVSS 7.8, Linux)
- [CVE-2026-64467](https://cve.now/CVE-2026-64467.md): rust\_binder: use a u64 stride when cleaning up the offsets array (CVSS 8.8, Linux)
- [CVE-2026-64466](https://cve.now/CVE-2026-64466.md): rust\_binder: clear freeze listener on node removal (no CVSS, Linux)
- [CVE-2026-64465](https://cve.now/CVE-2026-64465.md): usb: xhci: Fix sleep in atomic context in xhci\_free\_streams() (no CVSS, Linux)
- [CVE-2026-64464](https://cve.now/CVE-2026-64464.md): xhci: sideband: fix ring sg table pages leak (no CVSS, Linux)
- [CVE-2026-64463](https://cve.now/CVE-2026-64463.md): usb: typec: tcpci\_rt1711h: unregister TCPCI port with devres (CVSS 7.8, Linux)
- [CVE-2026-64462](https://cve.now/CVE-2026-64462.md): PCI: altera: Fix resource leaks on probe failure (no CVSS, Linux)
- [CVE-2026-64461](https://cve.now/CVE-2026-64461.md): PCI: mediatek: Fix IRQ domain leak when port fails to enable (no CVSS, Linux)
- [CVE-2026-64460](https://cve.now/CVE-2026-64460.md): PCI/IOV: Skip VF Resizable BAR restore on read error (CVSS 7.0, Linux)
- [CVE-2026-64459](https://cve.now/CVE-2026-64459.md): tcp: restore RCU grace period in tcp\_ao\_destroy\_sock (CVSS 9.8, Linux)
- [CVE-2026-64458](https://cve.now/CVE-2026-64458.md): mm/damon/ops-common: handle extreme intervals in damon\_hot\_score() (no CVSS, Linux)
- [CVE-2026-64457](https://cve.now/CVE-2026-64457.md): virtio\_pci: fix vq info pointer lookup via wrong index (no CVSS, Linux)
- [CVE-2026-64456](https://cve.now/CVE-2026-64456.md): hwrng: virtio: clamp device-reported used.len at copy\_data() (CVSS 7.7, Linux)
- [CVE-2026-64455](https://cve.now/CVE-2026-64455.md): USB: chaoskey: Fix slab-use-after-free in chaoskey\_release() (no CVSS, Linux)
- [CVE-2026-64454](https://cve.now/CVE-2026-64454.md): usb: dwc3: run gadget disconnect from sleepable suspend context (no CVSS, Linux)
- [CVE-2026-64453](https://cve.now/CVE-2026-64453.md): usb: misc: usbio: fix disconnect UAF in client teardown (no CVSS, Linux)
- [CVE-2026-64452](https://cve.now/CVE-2026-64452.md): 6lowpan: fix NHC entry use-after-free on error path (CVSS 7.1, Linux)
- [CVE-2026-64451](https://cve.now/CVE-2026-64451.md): tracing: Fix NULL pointer dereference in func\_set\_flag() (no CVSS, Linux)
- [CVE-2026-64450](https://cve.now/CVE-2026-64450.md): tipc: fix out-of-bounds read in broadcast Gap ACK blocks (CVSS 9.1, Linux)
- [CVE-2026-64449](https://cve.now/CVE-2026-64449.md): staging: vme\_user: bound slave read/write to the kern\_buf size (CVSS 7.8, Linux)
- [CVE-2026-64448](https://cve.now/CVE-2026-64448.md): smb: client: restrict implied bcc\[0\] exemption to responses without data area (CVSS 8.2, Linux)
- [CVE-2026-64447](https://cve.now/CVE-2026-64447.md): staging: media: ipu7: fix double-free and use-after-free in error paths (CVSS 7.8, Linux)
- [CVE-2026-64446](https://cve.now/CVE-2026-64446.md): staging: rtl8723bs: fix heap buffer overflow in rtw\_cfg80211\_set\_wpa\_ie() (no CVSS, Linux)
- [CVE-2026-64445](https://cve.now/CVE-2026-64445.md): staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (CVSS 8.8, Linux)
- [CVE-2026-64444](https://cve.now/CVE-2026-64444.md): staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (CVSS 8.1, Linux)
- [CVE-2026-64443](https://cve.now/CVE-2026-64443.md): staging: rtl8723bs: fix OOB read in update\_beacon\_info() IE loop (CVSS 8.1, Linux)
- [CVE-2026-64442](https://cve.now/CVE-2026-64442.md): staging: rtl8723bs: fix OOB reads in IE loops in issue\_assocreq() and join\_cmd\_hdl() (CVSS 8.1, Linux)
- [CVE-2026-64441](https://cve.now/CVE-2026-64441.md): staging: rtl8723bs: fix OOB reads in rtw\_get\_sec\_ie(), rtw\_get\_wapi\_ie(), and rtw\_get\_wps\_attr() (CVSS 8.8, Linux)
- [CVE-2026-64440](https://cve.now/CVE-2026-64440.md): staging: rtl8723bs: fix OOB write in HT\_caps\_handler() (CVSS 8.1, Linux)
- [CVE-2026-64439](https://cve.now/CVE-2026-64439.md): crypto: krb5 - filter out async aead implementations at alloc (CVSS 9.8, Linux)
- [CVE-2026-64438](https://cve.now/CVE-2026-64438.md): crypto: qat - fix VF2PF work teardown race in adf\_disable\_sriov() (CVSS 8.8, Linux)
- [CVE-2026-64437](https://cve.now/CVE-2026-64437.md): ksmbd: fix use-after-free of a deferred file\_lock on SMB2\_CLOSE then SMB2\_CANCEL (CVSS 8.8, Linux)
- [CVE-2026-64436](https://cve.now/CVE-2026-64436.md): net: af\_key: initialize alg\_key\_len for IPComp states (CVSS 7.1, Linux)
- [CVE-2026-64435](https://cve.now/CVE-2026-64435.md): audit: Fix data races of skb\_queue\_len() readers on audit\_queue (CVSS 8.2, Linux)
- [CVE-2026-64434](https://cve.now/CVE-2026-64434.md): Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (CVSS 8.8, Linux)
- [CVE-2026-64433](https://cve.now/CVE-2026-64433.md): Bluetooth: MGMT: Fix UAF of hci\_conn\_params in add\_device\_complete (no CVSS, Linux)
- [CVE-2026-64432](https://cve.now/CVE-2026-64432.md): fs/ntfs3: validate Dirty Page Table capacity in log\_replay copy\_lcns (CVSS 7.8, Linux)
- [CVE-2026-64431](https://cve.now/CVE-2026-64431.md): ntfs: avoid calling post\_write\_mst\_fixup() for invalid index\_block (CVSS 7.8, Linux)
- [CVE-2026-64430](https://cve.now/CVE-2026-64430.md): NTB: epf: Avoid calling pci\_irq\_vector() from hardirq context (CVSS 7.5, Linux)
- [CVE-2026-64429](https://cve.now/CVE-2026-64429.md): gpio: eic-sprd: use raw\_spinlock\_t in the irq startup path (no CVSS, Linux)
- [CVE-2026-64428](https://cve.now/CVE-2026-64428.md): gpio: sch: use raw\_spinlock\_t in the irq startup path (no CVSS, Linux)
- [CVE-2026-64427](https://cve.now/CVE-2026-64427.md): HID: logitech-dj: Fix maxfield check in DJ short report validation (no CVSS, Linux)
- [CVE-2026-64426](https://cve.now/CVE-2026-64426.md): io\_uring/nop: fix file reference leak with IOSQE\_FIXED\_FILE (no CVSS, Linux)
- [CVE-2026-64425](https://cve.now/CVE-2026-64425.md): io\_uring/io-wq: re-check IO\_WQ\_BIT\_EXIT for each linked work item (no CVSS, Linux)
- [CVE-2026-64424](https://cve.now/CVE-2026-64424.md): netpoll: fix a use-after-free on shutdown path (no CVSS, Linux)
- [CVE-2026-64423](https://cve.now/CVE-2026-64423.md): ipv4: igmp: remove multicast group from hash table on device destruction (CVSS 7.8, Linux)
- [CVE-2026-64422](https://cve.now/CVE-2026-64422.md): net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (CVSS 7.1, Linux)
- [CVE-2026-64421](https://cve.now/CVE-2026-64421.md): media: nxp: imx8-isi: Fix use-after-free on remove (no CVSS, Linux)
- [CVE-2026-64420](https://cve.now/CVE-2026-64420.md): mfd: cros\_ec: Delay dev\_set\_drvdata() until probe success (CVSS 7.0, Linux)
- [CVE-2026-64419](https://cve.now/CVE-2026-64419.md): mm/shrinker: do not hold RCU lock in shrinker\_debugfs\_count\_show() (no CVSS, Linux)
- [CVE-2026-64418](https://cve.now/CVE-2026-64418.md): mm: shrinker: fix shrinker\_info teardown race with expansion (CVSS 7.8, Linux)
- [CVE-2026-64417](https://cve.now/CVE-2026-64417.md): mm: shrinker: fix NULL pointer dereference in debugfs (no CVSS, Linux)
- [CVE-2026-64416](https://cve.now/CVE-2026-64416.md): mm: swap\_cgroup: fix NULL deref in lookup\_swap\_cgroup\_id on swapless host (no CVSS, Linux)
- [CVE-2026-64415](https://cve.now/CVE-2026-64415.md): mm/swap: add cond\_resched() in swap\_reclaim\_full\_clusters to prevent softlockup (no CVSS, Linux)
- [CVE-2026-64414](https://cve.now/CVE-2026-64414.md): netfilter: handle unreadable frags (CVSS 7.5, Linux)
- [CVE-2026-64413](https://cve.now/CVE-2026-64413.md): netfilter: ebtables: zero chainstack array (CVSS 7.0, Linux)
- [CVE-2026-64412](https://cve.now/CVE-2026-64412.md): netfilter: ebtables: module names must be null-terminated (CVSS 7.1, Linux)
- [CVE-2026-64411](https://cve.now/CVE-2026-64411.md): netfilter: ebtables: terminate table name before find\_table\_lock() (CVSS 7.1, Linux)
- [CVE-2026-64410](https://cve.now/CVE-2026-64410.md): netfilter: flowtable: IPIP tunnel hardware offload is not yet support (CVSS 9.8, Linux)
- [CVE-2026-64409](https://cve.now/CVE-2026-64409.md): Bluetooth: btmtksdio: fix infinite loop in btmtksdio\_txrx\_work() (no CVSS, Linux)
- [CVE-2026-64408](https://cve.now/CVE-2026-64408.md): Bluetooth: bnep: pin L2CAP connection during netdev registration (CVSS 8.8, Linux)
- [CVE-2026-64407](https://cve.now/CVE-2026-64407.md): Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp\_recv\_fw\_req\_v3() (no CVSS, Linux)
- [CVE-2026-64406](https://cve.now/CVE-2026-64406.md): Bluetooth: fix UAF in bt\_accept\_dequeue() (CVSS 8.0, Linux)
- [CVE-2026-64405](https://cve.now/CVE-2026-64405.md): Bluetooth: hci\_conn: Fix null ptr deref in hci\_abort\_conn() (no CVSS, Linux)
- [CVE-2026-64404](https://cve.now/CVE-2026-64404.md): Bluetooth: ISO: avoid NULL deref of conn in iso\_conn\_big\_sync() (no CVSS, Linux)
- [CVE-2026-64403](https://cve.now/CVE-2026-64403.md): Bluetooth: L2CAP: validate option length before reading conf opt value (CVSS 7.1, Linux)
- [CVE-2026-64402](https://cve.now/CVE-2026-64402.md): coresight: ultrasoc-smb: Fix OOB write in smb\_sync\_perf\_buffer() (CVSS 7.8, Linux)
- [CVE-2026-64401](https://cve.now/CVE-2026-64401.md): smb: client: resolve SWN tcon from live registrations (CVSS 7.8, Linux)
- [CVE-2026-64400](https://cve.now/CVE-2026-64400.md): ksmbd: prevent path traversal bypass by restricting caseless retry (CVSS 8.6, Linux)
- [CVE-2026-64399](https://cve.now/CVE-2026-64399.md): ksmbd: add permission checks for FSCTL\_DUPLICATE\_EXTENTS\_TO\_FILE (CVSS 9.8, Linux)
- [CVE-2026-64398](https://cve.now/CVE-2026-64398.md): ksmbd: add a permission check for FSCTL\_SET\_ZERO\_DATA (CVSS 8.1, Linux)
- [CVE-2026-64397](https://cve.now/CVE-2026-64397.md): ksmbd: serialize QUERY\_DIRECTORY requests per file (CVSS 9.8, Linux)
- [CVE-2026-64396](https://cve.now/CVE-2026-64396.md): ksmbd: fix UAF of struct file\_lock in SMB2\_LOCK deferred-lock cancellation (CVSS 8.8, Linux)
- [CVE-2026-64395](https://cve.now/CVE-2026-64395.md): ksmbd: require source read access for duplicate extents (CVSS 7.5, Linux)
- [CVE-2026-64394](https://cve.now/CVE-2026-64394.md): ksmbd: add a WRITE\_DAC/WRITE\_OWNER check to SMB2 SET\_INFO SECURITY (CVSS 8.8, Linux)
- [CVE-2026-64393](https://cve.now/CVE-2026-64393.md): ksmbd: run set info with opener credentials (CVSS 9.1, Linux)
- [CVE-2026-64392](https://cve.now/CVE-2026-64392.md): ksmbd: use opener credentials for delete-on-close (CVSS 9.1, Linux)
- [CVE-2026-64391](https://cve.now/CVE-2026-64391.md): ksmbd: use opener credentials for ADS I/O (CVSS 9.8, Linux)
- [CVE-2026-64390](https://cve.now/CVE-2026-64390.md): ksmbd: track the connection owning a byte-range lock (CVSS 8.8, Linux)
- [CVE-2026-64389](https://cve.now/CVE-2026-64389.md): ksmbd: validate NTLMv2 response before updating session key (CVSS 8.2, Linux)
- [CVE-2026-64388](https://cve.now/CVE-2026-64388.md): smb/client: fix chown/chgrp with SMB3 POSIX Extensions (CVSS 7.8, Linux)
- [CVE-2026-64387](https://cve.now/CVE-2026-64387.md): smb: client: fix query directory replay double-free (CVSS 9.8, Linux)
- [CVE-2026-64386](https://cve.now/CVE-2026-64386.md): smb: client: fix query\_info() replay double-free (CVSS 9.8, Linux)
- [CVE-2026-64385](https://cve.now/CVE-2026-64385.md): smb: client: fix double-free in SMB2\_ioctl() replay (CVSS 9.8, Linux)
- [CVE-2026-64384](https://cve.now/CVE-2026-64384.md): smb: client: fix change notify replay double-free (CVSS 9.8, Linux)
- [CVE-2026-64383](https://cve.now/CVE-2026-64383.md): smb: client: fix double-free in SMB2\_flush() replay (CVSS 9.8, Linux)
- [CVE-2026-64382](https://cve.now/CVE-2026-64382.md): smb: client: fix double-free in SMB2\_open() replay (CVSS 8.8, Linux)
- [CVE-2026-64381](https://cve.now/CVE-2026-64381.md): smb: client: Fix next buffer leak in receive\_encrypted\_standard() (no CVSS, Linux)
- [CVE-2026-64380](https://cve.now/CVE-2026-64380.md): smb: client: harden POSIX SID length parsing (CVSS 8.2, Linux)
- [CVE-2026-64379](https://cve.now/CVE-2026-64379.md): smb: client: mask server-provided mode to 07777 in modefromsid (CVSS 7.1, Linux)
- [CVE-2026-64378](https://cve.now/CVE-2026-64378.md): writeback: fix race between cgroup\_writeback\_umount() and inode\_switch\_wbs() (CVSS 7.8, Linux)
- [CVE-2026-64377](https://cve.now/CVE-2026-64377.md): cpufreq: qcom-cpufreq-hw: Fix possible double free (no CVSS, Linux)
- [CVE-2026-64376](https://cve.now/CVE-2026-64376.md): firmware\_loader: fix device reference leak in firmware\_upload\_register() (no CVSS, Linux)
- [CVE-2026-64375](https://cve.now/CVE-2026-64375.md): proc: protect ptrace\_may\_access() with exec\_update\_lock (FD links) (CVSS 7.8, Linux)
- [CVE-2026-64374](https://cve.now/CVE-2026-64374.md): sched/rt: Have RT\_PUSH\_IPI be default off for non PREEMPT\_RT (CVSS 7.5, Linux)
- [CVE-2026-64373](https://cve.now/CVE-2026-64373.md): cpufreq: Fix hotplug-suspend race during reboot (no CVSS, Linux)
- [CVE-2026-64372](https://cve.now/CVE-2026-64372.md): cpufreq: pcc: fix use-after-free and double free in \_OSC evaluation (CVSS 7.8, Linux)
- [CVE-2026-64371](https://cve.now/CVE-2026-64371.md): proc: protect ptrace\_may\_access() with exec\_update\_lock (part 1) (no CVSS, Linux)
- [CVE-2026-64370](https://cve.now/CVE-2026-64370.md): posix-cpu-timers: Fix pid refcount leak in do\_cpu\_nanosleep() error path (no CVSS, Linux)
- [CVE-2026-64369](https://cve.now/CVE-2026-64369.md): s390: Revert support for DCACHE\_WORD\_ACCESS (no CVSS, Linux)
- [CVE-2026-64368](https://cve.now/CVE-2026-64368.md): mm/slab: do not limit zeroing to orig\_size when only red zoning is enabled (CVSS 8.1, Linux)
- [CVE-2026-64367](https://cve.now/CVE-2026-64367.md): HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (CVSS 7.8, Linux)
- [CVE-2026-64366](https://cve.now/CVE-2026-64366.md): HID: wacom: fix slab-out-of-bounds write in wacom\_wac\_queue\_insert (CVSS 8.8, Linux)
- [CVE-2026-64365](https://cve.now/CVE-2026-64365.md): HID: letsketch: fix UAF on inrange\_timer at driver unbind (no CVSS, Linux)
- [CVE-2026-64364](https://cve.now/CVE-2026-64364.md): HID: multitouch: fix out-of-bounds bit access on mt\_io\_flags (CVSS 8.8, Linux)
- [CVE-2026-64363](https://cve.now/CVE-2026-64363.md): HID: appleir: fix UAF on pending key\_up\_timer in remove() (no CVSS, Linux)
- [CVE-2026-64362](https://cve.now/CVE-2026-64362.md): HID: lg-g15: cancel pending work on remove to fix a use-after-free (no CVSS, Linux)
- [CVE-2026-64361](https://cve.now/CVE-2026-64361.md): hfs/hfsplus: fix u32 overflow in check\_and\_correct\_requested\_length (CVSS 7.8, Linux)
- [CVE-2026-64360](https://cve.now/CVE-2026-64360.md): hfs/hfsplus: zero-initialize buffer in hfs\_bnode\_read (no CVSS, Linux)
- [CVE-2026-64359](https://cve.now/CVE-2026-64359.md): nilfs2: reject CLEAN\_SEGMENTS ioctl with out-of-range segment numbers (no CVSS, Linux)
- [CVE-2026-64358](https://cve.now/CVE-2026-64358.md): media: mtk-jpeg: cancel workqueue on release for supported platforms only (no CVSS, Linux)
- [CVE-2026-64357](https://cve.now/CVE-2026-64357.md): xfs: fix exchmaps reservation limit check (no CVSS, Linux)
- [CVE-2026-64356](https://cve.now/CVE-2026-64356.md): xfs: fix memory leak in xfs\_dqinode\_metadir\_create() (no CVSS, Linux)
- [CVE-2026-64355](https://cve.now/CVE-2026-64355.md): bpf: Reject fragmented frames in devmap (CVSS 9.8, Linux)
- [CVE-2026-64354](https://cve.now/CVE-2026-64354.md): bpf: Validate BTF repeated field counts before expansion (CVSS 7.8, Linux)
- [CVE-2026-64353](https://cve.now/CVE-2026-64353.md): bpf: Keep dynamic inner array lookups nullable (no CVSS, Linux)
- [CVE-2026-64352](https://cve.now/CVE-2026-64352.md): bpf: Allow LPM map access from sleepable BPF programs (no CVSS, Linux)
- [CVE-2026-64351](https://cve.now/CVE-2026-64351.md): net: usb: kalmia: bound RX frame length in kalmia\_rx\_fixup() (no CVSS, Linux)
- [CVE-2026-64350](https://cve.now/CVE-2026-64350.md): usb: cdnsp: fix stream context array leak in cdnsp\_alloc\_stream\_info() (no CVSS, Linux)
- [CVE-2026-64349](https://cve.now/CVE-2026-64349.md): usb: dwc3: fix dwc3\_readl() and dwc3\_writel() calls in dwc3\_ulpi\_setup() (no CVSS, Linux)
- [CVE-2026-64348](https://cve.now/CVE-2026-64348.md): usb: free iso schedules on failed submit (no CVSS, Linux)
- [CVE-2026-64347](https://cve.now/CVE-2026-64347.md): usb: gadget: composite: fix dead empty check in the USB\_DT\_OTG handler (no CVSS, Linux)
- [CVE-2026-64346](https://cve.now/CVE-2026-64346.md): usb: gadget: udc: Fix use-after-free in gadget\_match\_driver (no CVSS, Linux)
- [CVE-2026-64345](https://cve.now/CVE-2026-64345.md): usb: gadget: f\_printer: take kref only for successful open (no CVSS, Linux)
- [CVE-2026-64344](https://cve.now/CVE-2026-64344.md): USB: idmouse: fix use-after-free on disconnect race (no CVSS, Linux)
- [CVE-2026-64343](https://cve.now/CVE-2026-64343.md): USB: ldusb: fix use-after-free on disconnect race (no CVSS, Linux)
- [CVE-2026-64342](https://cve.now/CVE-2026-64342.md): USB: iowarrior: fix use-after-free on disconnect (no CVSS, Linux)
- [CVE-2026-64341](https://cve.now/CVE-2026-64341.md): USB: iowarrior: fix use-after-free on disconnect race (no CVSS, Linux)
- [CVE-2026-64340](https://cve.now/CVE-2026-64340.md): USB: legousbtower: fix use-after-free on disconnect race (no CVSS, Linux)
- [CVE-2026-64339](https://cve.now/CVE-2026-64339.md): usb: misc: usbio: bound bulk IN response length to the received transfer (no CVSS, Linux)
- [CVE-2026-64338](https://cve.now/CVE-2026-64338.md): USB: misc: uss720: unregister parport on probe failure (no CVSS, Linux)
- [CVE-2026-64337](https://cve.now/CVE-2026-64337.md): usb: mtu3: unmap request DMA on queue failure (no CVSS, Linux)
- [CVE-2026-64336](https://cve.now/CVE-2026-64336.md): USB: serial: keyspan\_pda: fix information leak (no CVSS, Linux)
- [CVE-2026-64335](https://cve.now/CVE-2026-64335.md): USB: serial: digi\_acceleport: fix broken rx after throttle (no CVSS, Linux)
- [CVE-2026-64334](https://cve.now/CVE-2026-64334.md): USB: serial: digi\_acceleport: fix hard lockup on disconnect (no CVSS, Linux)
- [CVE-2026-64333](https://cve.now/CVE-2026-64333.md): USB: serial: digi\_acceleport: fix write buffer corruption (CVSS 7.8, Linux)
- [CVE-2026-64332](https://cve.now/CVE-2026-64332.md): USB: ulpi: fix memory leak on registration failure (no CVSS, Linux)
- [CVE-2026-64331](https://cve.now/CVE-2026-64331.md): usbip: vudc: fix NULL deref in vep\_dequeue() (no CVSS, Linux)
- [CVE-2026-64330](https://cve.now/CVE-2026-64330.md): usb: typec: tcpm: Validate SVID index in svdm\_consume\_modes() (no CVSS, Linux)
- [CVE-2026-64329](https://cve.now/CVE-2026-64329.md): usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (no CVSS, Linux)
- [CVE-2026-64328](https://cve.now/CVE-2026-64328.md): usb: gadget: f\_fs: Fix DMA fence leak (no CVSS, Linux)
- [CVE-2026-64327](https://cve.now/CVE-2026-64327.md): usb: gadget: f\_fs: Initialize epfile-\>in early to fix endpoint direction checks (no CVSS, Linux)
- [CVE-2026-64326](https://cve.now/CVE-2026-64326.md): block: skip sync\_blockdev() on surprise removal in bdev\_mark\_dead() (no CVSS, Linux)
- [CVE-2026-64325](https://cve.now/CVE-2026-64325.md): wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon (no CVSS, Linux)
- [CVE-2026-64324](https://cve.now/CVE-2026-64324.md): udf: validate free block extents against the partition length (CVSS 7.8, Linux)
- [CVE-2026-64323](https://cve.now/CVE-2026-64323.md): udf: validate VAT header length against the VAT inode size (CVSS 7.1, Linux)
- [CVE-2026-64322](https://cve.now/CVE-2026-64322.md): udf: validate sparing table length as an entry count, not a byte count (CVSS 7.8, Linux)
- [CVE-2026-64321](https://cve.now/CVE-2026-64321.md): nvme: target: rdma: fix ndev refcount leak on queue connect (no CVSS, Linux)
- [CVE-2026-64320](https://cve.now/CVE-2026-64320.md): nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVSS 9.1, Linux)
- [CVE-2026-64319](https://cve.now/CVE-2026-64319.md): nvmet-auth: validate reply message payload bounds against transfer length (CVSS 9.1, Linux)
- [CVE-2026-64318](https://cve.now/CVE-2026-64318.md): partitions: aix: bound the pp\_count scan to the ppe array (CVSS 7.1, Linux)
- [CVE-2026-64317](https://cve.now/CVE-2026-64317.md): isofs: bound Rock Ridge symlink components to the SL record (CVSS 7.1, Linux)
- [CVE-2026-64316](https://cve.now/CVE-2026-64316.md): crypto: caam - use print\_hex\_dump\_devel to guard key hex dumps (no CVSS, Linux)
- [CVE-2026-64315](https://cve.now/CVE-2026-64315.md): crypto: caam - use print\_hex\_dump\_devel to guard key hex dumps (CVSS 7.0, Linux)
- [CVE-2026-64314](https://cve.now/CVE-2026-64314.md): crypto: chacha20poly1305 - validate poly1305 template argument (no CVSS, Linux)
- [CVE-2026-64313](https://cve.now/CVE-2026-64313.md): crypto: ecc - Fix carry overflow in vli multiplication (CVSS 8.8, Linux)
- [CVE-2026-64312](https://cve.now/CVE-2026-64312.md): crypto: pcrypt - restore callback for non-parallel fallback (CVSS 7.5, Linux)
- [CVE-2026-64311](https://cve.now/CVE-2026-64311.md): crypto: loongson - Remove broken and unused loongson-rng (CVSS 7.8, Linux)
- [CVE-2026-64310](https://cve.now/CVE-2026-64310.md): crypto: ccp - Do not initialize SNP for SEV ioctls (no CVSS, Linux)
- [CVE-2026-64309](https://cve.now/CVE-2026-64309.md): crypto: ccp - Do not initialize SNP for ioctl(SNP\_COMMIT) (no CVSS, Linux)
- [CVE-2026-64308](https://cve.now/CVE-2026-64308.md): crypto: ccp - Do not initialize SNP for ioctl(SNP\_VLEK\_LOAD) (no CVSS, Linux)
- [CVE-2026-64307](https://cve.now/CVE-2026-64307.md): crypto: ccp - Do not initialize SNP for ioctl(SNP\_CONFIG) (no CVSS, Linux)
- [CVE-2026-64306](https://cve.now/CVE-2026-64306.md): crypto: drbg - Fix returning success on failure in CTR\_DRBG (no CVSS, Linux)
- [CVE-2026-64305](https://cve.now/CVE-2026-64305.md): crypto: qat - protect service table iterations with service\_lock (no CVSS, Linux)
- [CVE-2026-64304](https://cve.now/CVE-2026-64304.md): crypto: qat - validate RSA CRT component lengths (CVSS 7.8, Linux)
- [CVE-2026-64303](https://cve.now/CVE-2026-64303.md): spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVSS 9.8, Linux)
- [CVE-2026-64302](https://cve.now/CVE-2026-64302.md): x86/mm: Fix freeing of PMD-sized vmemmap pages (no CVSS, Linux)
- [CVE-2026-64301](https://cve.now/CVE-2026-64301.md): regulator: scmi: fix of\_node refcount leak in scmi\_regulator\_probe() (no CVSS, Linux)
- [CVE-2026-64300](https://cve.now/CVE-2026-64300.md): perf/aux: Fix page UAF in map\_range() (CVSS 7.8, Linux)
- [CVE-2026-64299](https://cve.now/CVE-2026-64299.md): tracing: Prevent out-of-bounds read in glob matching (CVSS 7.1, Linux)
- [CVE-2026-64298](https://cve.now/CVE-2026-64298.md): NFSv4: include MAY\_WRITE in open permission mask for O\_TRUNC (CVSS 7.1, Linux)
- [CVE-2026-64297](https://cve.now/CVE-2026-64297.md): module: decompress: check return value of module\_extend\_max\_pages() (no CVSS, Linux)
- [CVE-2026-64296](https://cve.now/CVE-2026-64296.md): exfat: bound uniname advance in exfat\_find\_dir\_entry() (CVSS 7.8, Linux)
- [CVE-2026-64295](https://cve.now/CVE-2026-64295.md): mm: page\_ext: add count limit to page\_ext\_iter\_next to prevent invalid PFN access (no CVSS, Linux)
- [CVE-2026-64294](https://cve.now/CVE-2026-64294.md): mm: do file ownership checks with the proper mount idmap (no CVSS, Linux)
- [CVE-2026-64293](https://cve.now/CVE-2026-64293.md): iommufd: Use sizeof(\*hdr) instead of sizeof(hdr) in veventq read (CVSS 7.8, Linux)
- [CVE-2026-64292](https://cve.now/CVE-2026-64292.md): iommufd: Move vevent memory allocation outside spinlock (no CVSS, Linux)
- [CVE-2026-64291](https://cve.now/CVE-2026-64291.md): iommufd: Set veventq\_depth upper bound (no CVSS, Linux)
- [CVE-2026-64290](https://cve.now/CVE-2026-64290.md): iommufd: Break the loop on failure in iommufd\_fault\_fops\_read() (no CVSS, Linux)
- [CVE-2026-64289](https://cve.now/CVE-2026-64289.md): iommufd: Set upper bounds on cache invalidation entry\_num and entry\_len (no CVSS, Linux)
- [CVE-2026-64288](https://cve.now/CVE-2026-64288.md): KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB (no CVSS, Linux)
- [CVE-2026-64287](https://cve.now/CVE-2026-64287.md): KVM: arm64: Bound used\_lrs when flushing the pKVM hyp vCPU (CVSS 8.2, Linux)
- [CVE-2026-64286](https://cve.now/CVE-2026-64286.md): KVM: arm64: Clear \_\_hyp\_running\_vcpu when flushing the pKVM hyp vCPU (CVSS 8.2, Linux)
- [CVE-2026-64285](https://cve.now/CVE-2026-64285.md): KVM: SEV: Pin source page for write when adding CPUID data for SNP guest (no CVSS, Linux)
- [CVE-2026-64284](https://cve.now/CVE-2026-64284.md): KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits (CVSS 7.1, Linux)
- [CVE-2026-64283](https://cve.now/CVE-2026-64283.md): KVM: guest\_memfd: Treat memslot binding offset+size as unsigned values (no CVSS, Linux)
- [CVE-2026-64282](https://cve.now/CVE-2026-64282.md): KVM: arm64: Don't leak PFN when kvm\_translate\_vncr() races MMU notifier (no CVSS, Linux)
- [CVE-2026-64281](https://cve.now/CVE-2026-64281.md): svcrdma: wake sq waiters when the transport closes (CVSS 7.5, Linux)
- [CVE-2026-64280](https://cve.now/CVE-2026-64280.md): fpga: dfl-afu: validate DMA mapping length in afu\_dma\_map\_region() (CVSS 8.8, Linux)
- [CVE-2026-64279](https://cve.now/CVE-2026-64279.md): i2c: core: fix adapter deregistration race (CVSS 7.8, Linux)
- [CVE-2026-64278](https://cve.now/CVE-2026-64278.md): i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (no CVSS, Linux)
- [CVE-2026-64277](https://cve.now/CVE-2026-64277.md): Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVSS 7.8, Linux)
- [CVE-2026-64276](https://cve.now/CVE-2026-64276.md): Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVSS 7.8, Linux)
- [CVE-2026-64275](https://cve.now/CVE-2026-64275.md): Input: elan\_i2c - prevent division by zero and arithmetic underflow (no CVSS, Linux)
- [CVE-2026-64274](https://cve.now/CVE-2026-64274.md): Input: goodix - clamp the device-reported contact count (no CVSS, Linux)
- [CVE-2026-64273](https://cve.now/CVE-2026-64273.md): Input: iforce - bound the device-reported force-feedback effect index (no CVSS, Linux)
- [CVE-2026-64272](https://cve.now/CVE-2026-64272.md): Input: mms114 - fix touch indexing for MMS134S and MMS136 (no CVSS, Linux)
- [CVE-2026-64271](https://cve.now/CVE-2026-64271.md): Input: touchwin - reset the packet index on every complete packet (no CVSS, Linux)
- [CVE-2026-64270](https://cve.now/CVE-2026-64270.md): Input: mms114 - reject an oversized device packet size (no CVSS, Linux)
- [CVE-2026-64269](https://cve.now/CVE-2026-64269.md): RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma\_write\_sg (CVSS 9.1, Linux)
- [CVE-2026-64268](https://cve.now/CVE-2026-64268.md): RDMA/siw: bound Read Response placement to the RREAD length (CVSS 9.8, Linux)
- [CVE-2026-64267](https://cve.now/CVE-2026-64267.md): fuse: avoid 32-bit prune notification count wrap (no CVSS, Linux)
- [CVE-2026-64266](https://cve.now/CVE-2026-64266.md): fuse: re-lock request before returning from fuse\_ref\_folio() (CVSS 7.8, Linux)
- [CVE-2026-64265](https://cve.now/CVE-2026-64265.md): fuse: clear intr\_entry in fuse\_resend and fuse\_remove\_pending\_req (CVSS 7.8, Linux)
- [CVE-2026-64264](https://cve.now/CVE-2026-64264.md): fuse-uring: fix EFAULT clobber in fuse\_uring\_commit (no CVSS, Linux)
- [CVE-2026-64263](https://cve.now/CVE-2026-64263.md): fuse-uring: fix moving cancelled entry to ent\_in\_userspace list (no CVSS, Linux)
- [CVE-2026-64262](https://cve.now/CVE-2026-64262.md): fuse-uring: end fuse\_req on io-uring cancel task work (no CVSS, Linux)
- [CVE-2026-64261](https://cve.now/CVE-2026-64261.md): fuse-uring: Avoid use-after-free in fuse\_uring\_async\_stop\_queues (CVSS 7.8, Linux)
- [CVE-2026-64260](https://cve.now/CVE-2026-64260.md): fuse-uring: Avoid queue-\>stopped races and set/read that value under lock (CVSS 7.8, Linux)
- [CVE-2026-64259](https://cve.now/CVE-2026-64259.md): fuse-uring: make a fuse\_req on SQE commit only findable after memcpy (CVSS 7.8, Linux)
- [CVE-2026-64258](https://cve.now/CVE-2026-64258.md): fuse-uring: remove request-less entries from ent\_w\_req\_queue to fix NULL deref (no CVSS, Linux)
- [CVE-2026-64257](https://cve.now/CVE-2026-64257.md): smb: client: reject overlapping data areas in SMB2 responses (CVSS 9.1, Linux)
- [CVE-2026-64256](https://cve.now/CVE-2026-64256.md): xfs: don't wrap around quota ids in dqiterate (no CVSS, Linux)
- [CVE-2026-16766](https://cve.now/CVE-2026-16766.md): Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options (CVSS 9.8, RRWO Catalyst::View::Wkhtmltopdf)
- [CVE-2026-10818](https://cve.now/CVE-2026-10818.md): WPForms Pro \<= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering (CVSS 8.1, WPForms Pro)
- [CVE-2026-15425](https://cve.now/CVE-2026-15425.md): Yoast SEO \<= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post\_name) (CVSS 6.4, Yoast SEO – Advanced SEO with real-time guidance and built-…)
- [CVE-2026-14955](https://cve.now/CVE-2026-14955.md): Checkout Field Editor for WooCommerce (Pro) \<= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe\_legacy\_file' Parameter (CVSS 6.5, Themehigh Checkout Field Editor for WooCommerce)
- [CVE-2026-66374](https://cve.now/CVE-2026-66374.md): Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path. (CVSS 8.1, nic Knot Resolver)
- [CVE-2026-66373](https://cve.now/CVE-2026-66373.md): Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payl (CVSS 7.5, Redis)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.