CVEs published August 15, 2026
924 CVEs were published on August 15, 2026: 150 critical, 400 high.
- Published
- 924
- Critical
- 150
- High
- 400
- Medium
- 37
- Low
- 1
- Unrated
- 336
- Now in CISA KEV
- 0
- Fix available
- 487
Most affected products
- Linux
- 844
- siyuan-note siyuan
- 10
- Apache Software Foundation Apache Struts
- 4
- ECS
- 3
- matthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA A…
- 3
- @fastify/multipart
- 2
- code-projects Online Food Order System
- 2
- code-projects Online Shopping System
- 2
- DBI
- 2
- LB-LINK X-PRO
- 2
Critical 150
- CVE-2026-73053SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emojisiyuan-note siyuan
- CVE-2026-73052SiYuan before v3.7.4 Stored XSS via Attribute-View Field Namessiyuan-note siyuan
- CVE-2026-73050SiYuan before v3.7.4 Stored XSS via select option colorsiyuan-note siyuan
- CVE-2026-73046SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Authsiyuan-note siyuan
- CVE-2026-73044SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Widthsiyuan-note siyuan
- CVE-2026-73043SiYuan before v3.7.4 Remote Code Execution via Template Calculationsiyuan-note siyuan
- CVE-2026-73042SiYuan before v3.7.4 Remote Code Execution via Menu Metadatasiyuan-note siyuan
- CVE-2026-73041SiYuan before v3.7.4 Remote Code Execution via PDF Annotationssiyuan-note siyuan
- CVE-2026-74764Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandorapandora-analysis pandora
- CVE-2026-18855Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameterjackdewey Link Library
- CVE-2026-19598Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Routersc0ttkclark Pods – Custom Content Types and Fields
- CVE-2026-19901LB-LINK X-PRO easycwmp hard-coded credentialsLB-LINK X-PRO
- CVE-2026-19900LB-LINK X-PRO shadow hard-coded credentialsLB-LINK X-PRO
- CVE-2026-15689Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_sendABEVERLEY Dancer2::Plugin::Auth::Extensible
- CVE-2026-74573iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICELinux
- CVE-2026-74570ntfs: harden runlist realloc size calculationsLinux
- CVE-2026-74569netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()Linux
- CVE-2026-74568KVM: arm64: vgic: Fix race between LPI release and re-registrationLinux
- CVE-2026-74556scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection bufferLinux
- CVE-2026-74545rtase: fix double free of multi-frag skb on DMA map failureLinux
- CVE-2026-74521ksmbd: use memcmp() to compare ClientGUIDsLinux
- CVE-2026-74517KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUsLinux
- CVE-2026-74495igbvf: Fix leak in TX DMA error cleanupLinux
- CVE-2026-74493net/smc: fix socket use-after-free during link group terminationLinux
- CVE-2026-74480net: bridge: stop fast-leave after deleting a port groupLinux
- CVE-2026-74478um: vector: fix use-after-free in vector_mmsg_rx()Linux
- CVE-2026-74476veth: convert frag_list skbs before running XDPLinux
- CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()Linux
- CVE-2026-74474vxlan: use pskb_network_may_pull() for transmit path header pullsLinux
- CVE-2026-74473vxlan: use pskb_network_may_pull() in route_shortcircuit()Linux
- CVE-2026-73194DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparseDBI
- CVE-2026-73193DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparseDBI
- CVE-2026-16142TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameterthemetechmount TrueBooker – Appointment Booking and Schedul…
- CVE-2026-15826User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parametercozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2026-74439iommu/vt-d: Clear Present bit before tearing down scalable-mode context entryLinux
- CVE-2026-74436rxrpc: serialize kernel accept preallocation with socket teardownLinux
- CVE-2026-74434rxrpc: Don't move a peeked OOB message onto the pending queueLinux
- CVE-2026-74433rxrpc: Fix UAF in rxgk_issue_challenge()Linux
- CVE-2026-74428rxrpc: Fix double unlock in rxrpc_recvmsg()Linux
- CVE-2026-74427afs: Fix netns teardown to cancel the preallocation chargerLinux
- CVE-2026-74406vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().Linux
- CVE-2026-74401dlm: fix add msg handle in send_queue orderedLinux
- CVE-2026-74398ipv6: addrconf: bail out of dad_failure when state is no longer POSTDADLinux
- CVE-2026-74394RDMA/srpt: fix integer overflow in immediate data length checkLinux
- CVE-2026-74384nvme-multipath: fix flex array size in struct nvme_ns_headLinux
- CVE-2026-74376md/raid10: reset read_slot when reusing r10bio for discardLinux
- CVE-2026-74361nvme: fix FDP fdpcidx bounds checkLinux
- CVE-2026-74350ocfs2: validate fast symlink target during inode readLinux
- CVE-2026-74345RDMA/siw: Fix endpoint/socket association handlingLinux
- CVE-2026-74315lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()Linux
- CVE-2026-74310vhost/net: complete zerocopy ubufs only onceLinux
- CVE-2026-74309vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handlerLinux
- CVE-2026-74287sctp: validate embedded address parameter lengthLinux
- CVE-2026-74280crypto: marvell/octeontx - fix DMA cleanup using wrong loop indexLinux
- CVE-2026-74279crypto: cavium/cpt - fix DMA cleanup using wrong loop indexLinux
- CVE-2026-74269bnxt: fix head underflow on XDP head-growLinux
- CVE-2026-74268tcp: clear sock_ops cb flags before force-closing a child socketLinux
- CVE-2026-74267net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlenLinux
- CVE-2026-74255tipc: fix UAF in tipc_l2_send_msg()Linux
- CVE-2026-72496RDMA/bnxt_re: Proper rollback if the ioremap failsLinux
- CVE-2026-72495RDMA/bnxt_re: Avoid repeated requests to allocate WC pagesLinux
- CVE-2026-72494RDMA/irdma: Replace waitqueue and flag with completionLinux
- CVE-2026-72493net: serialize netif_running() check in enqueue_to_backlog()Linux
- CVE-2026-72491net/9p: fix race condition on rdma->state in trans_rdma.cLinux
- CVE-2026-72477fs/ntfs3: call _ntfs_bad_inode() when failing to renameLinux
- CVE-2026-72473xprtrdma: Decouple req recycling from RPC completionLinux
- CVE-2026-72472nfs: use nfsi->rwsem to protect traversal of the file lock listLinux
- CVE-2026-72466xprtrdma: Fix bcall rep leak and unbounded peekLinux
- CVE-2026-72463xfrm: Fix dev use-after-free in xfrm async resumptionLinux
- CVE-2026-72451xfrm: Fix xfrm state cache insertion raceLinux
- CVE-2026-72442netfilter: flowtable: fix and simplify IP6IP6 tunnel handlingLinux
- CVE-2026-72436netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash typesLinux
- CVE-2026-72429ipv6: ioam: fix type confusion of dst_entryLinux
- CVE-2026-72422ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATELinux
- CVE-2026-72421ipv4: fib: Don't ignore error route in local/main tables.Linux
- CVE-2026-72417netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()Linux
- CVE-2026-72412s390/mm: Fix handling of _PAGE_UNUSED pte bitLinux
- CVE-2026-72408geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hintLinux
- CVE-2026-72407geneve: validate inner network offset in geneve_gro_complete()Linux
- CVE-2026-72399net: enetc: check the number of BDs needed for xdp_frameLinux
- CVE-2026-72398sctp: add INIT verification after cookie unpackingLinux
- CVE-2026-72393eth: fbnic: don't cache shinfo across skb reallocLinux
- CVE-2026-72381ksmbd: fix use-after-free of fp->owner.name in durable handle owner checkLinux
- CVE-2026-72366netfs: Fix netfs_create_write_req() to handle async cache object creationLinux
- CVE-2026-72355netfs: Fix barriering when walking subrequest listLinux
- CVE-2026-72351gue: validate REMCSUM private option lengthLinux
- CVE-2026-72348netfilter: ip6tables: mark malformed IPv6 extension headers for hotdropLinux
- CVE-2026-72339qede: fix off-by-one in BD ring consumption on build_skb failureLinux
- CVE-2026-72329net/liquidio: drop cached VF pci_dev LUTLinux
- CVE-2026-72323ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()Linux
- CVE-2026-72322ipv6: mcast: Fix potential UAF in MLD delayed workLinux
- CVE-2026-72320netfilter: nft_lookup: fix catchall element handling with inverted lookupsLinux
- CVE-2026-72319ipvs: ensure inner headers in ICMP errors are in headroomLinux
- CVE-2026-72318cifs: validate DFS referral string offsetsLinux
- CVE-2026-72317SUNRPC: pin upper rpc_clnt across the TLS connect_workerLinux
- CVE-2026-72299tipc: restrict socket queue dumps in enqueue tracepointsLinux
- CVE-2026-72296net: ife: require ETH_HLEN to be pullable in ife_decode()Linux
- CVE-2026-72291KVM: s390: Fix unlikely race in try_get_locked_pte()Linux
- CVE-2026-72289KVM: arm64: vgic: Check the interrupt is still ours before migrating itLinux
- CVE-2026-72288KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disablingLinux
- CVE-2026-72279KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCRLinux
- CVE-2026-72278KVM: arm64: nv: Re-translate VNCR before injecting abortLinux
- CVE-2026-72277KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memoryLinux
- CVE-2026-72251netfilter: nf_nat_sip: reload possible stale data pointerLinux
- CVE-2026-72249netfilter: flowtable: use dst in this direction when pushing IPIP headerLinux
- CVE-2026-72248netfilter: flowtable: support IPIP tunnel with direct xmitLinux
- CVE-2026-72239x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"Linux
- CVE-2026-72234batman-adv: access unicast_ttvn skb->data only after skb reallocLinux
- CVE-2026-72226batman-adv: tt: prevent TVLV OOB check overflowLinux
- CVE-2026-72222sunrpc: pin svc_xprt across the asynchronous TLS handshake callbackLinux
- CVE-2026-72221sunrpc: wait for in-flight TLS handshake callback when cancel loses raceLinux
- CVE-2026-72220sunrpc: harden rq_procinfo lifecycle to prevent double-freeLinux
- CVE-2026-72217SUNRPC: Bound-check xdr_buf_to_bvec() stores before writingLinux
- CVE-2026-72211ntfs: grow index root value before reparent header updateLinux
- CVE-2026-72210ntfs: fix off-by-one in mapping pairs decoding bounds checksLinux
- CVE-2026-72209ntfs: validate attribute values on lookupLinux
- CVE-2026-72208ntfs: add bounds check before accessing EA entriesLinux
- CVE-2026-72207ntfs: not change 0-byte $DATA attribute to non-residentLinux
- CVE-2026-72206ntfs: validate index block header more strictlyLinux
- CVE-2026-72201ntfs: validate index entries on readingLinux
- CVE-2026-72200ntfs: detect mapping-pairs LCN accumulator overflowLinux
- CVE-2026-72199ntfs: validate resident index root values on lookupLinux
- CVE-2026-72194fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflowLinux
- CVE-2026-72192ntfs3: bound to_move in indx_insert_into_root before hdr_insert_headLinux
- CVE-2026-72191ntfs3: validate split-point offset in indx_insert_into_bufferLinux
- CVE-2026-72188ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()Linux
- CVE-2026-72186ntfs: make system files immutable to prevent corruptionLinux
- CVE-2026-72185ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()Linux
- CVE-2026-72139tcp: defer md5sig_info kfree past RCU grace period in tcp_connectLinux
- CVE-2026-72137xfrm: nat_keepalive: avoid double free on send errorLinux
- CVE-2026-72130nvmet-auth: reject short AUTH_RECEIVE buffersLinux
- CVE-2026-72129nvmet-rdma: handle inline data with a nonzero offsetLinux
- CVE-2026-72098dm-verity: fix buffer overflow in FEC calculationLinux
- CVE-2026-72085scsi: xen: scsiback: Free unsubmitted command instead of double-putting itLinux
- CVE-2026-72084scsi: target: Bound PR-OUT TransportID parsing to the received bufferLinux
- CVE-2026-72083scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVELinux
- CVE-2026-72069locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()Linux
- CVE-2026-72065net: mana: Validate the packet length reported by the NICLinux
- CVE-2026-72064net: mana: Sync page pool RX frags for CPULinux
- CVE-2026-72046gve: fix header buffer corruption with header-split and HW-GROLinux
- CVE-2026-72041espintcp: use sk_msg_free_partial to fix partial sendLinux
- CVE-2026-72033orangefs: keep the readdir entry size 64-bit in fill_from_part()Linux
- CVE-2026-72020ipvs: reset full ip_vs_seq structs in ip_vs_conn_newLinux
- CVE-2026-72014drbd: reject data replies with an out-of-range payload sizeLinux
- CVE-2026-68477ipvs: fix more places with wrong ipv6 transport offsetsLinux
- CVE-2026-68476ipvs: reload ip header after head reallocationLinux
- CVE-2026-68457ksmbd: use opener credentials for FSCTL mutationsLinux
- CVE-2026-15341User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parametersrafasashi User Session Synchronizer
- CVE-2026-153036Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parametersixstorage 6Storage Rentals
- CVE-2026-14484RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameterspietror91 RapiSafe – Secure Multi File Upload for Contact F…
High 400
- CVE-2026-74767Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bombpandora-analysis pandora
- CVE-2026-73054SiYuan before v3.7.4 Authentication Bypass via WebSocketsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73047siyuan before v3.7.4 Server-Side Template Injection via attribute-viewsiyuan-note siyuan
- CVE-2026-73045SiYuan before 3.7.4 Brute-Force via authFilePublishAccesssiyuan-note siyuan
- CVE-2026-19474@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload@fastify/multipart
- CVE-2026-18549@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit@fastify/multipart
- CVE-2026-18500@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key@fastify/jwt
- CVE-2026-74576mm/slab: prevent unbounded recursion in free path with new kmalloc typeLinux
- CVE-2026-74575thunderbolt: Prevent XDomain delayed work use-after-free on disconnectLinux
- CVE-2026-74574dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()Linux
- CVE-2026-74572btrfs: zoned: fix deadlock between metadata writeback and transaction commitLinux
- CVE-2026-74567keys: fix out-of-bounds read in keyring_get_key_chunk()Linux
- CVE-2026-74565netfilter: nf_tables: make nft_object rhltable per tableLinux
- CVE-2026-74564netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCHLinux
- CVE-2026-74563rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()Linux
- CVE-2026-74562nexthop: take nh->lock for f6i_list walks in replace check and notifyLinux
- CVE-2026-74561nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flushLinux
- CVE-2026-74557scsi: libiscsi: Fix stale-data leak into the SCSI sense bufferLinux
- CVE-2026-74554wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()Linux
- CVE-2026-74551hwmon: (nzxt-smart2) DMA-align output bufferLinux
- CVE-2026-74550net: do not send ICMP/NDISC Redirects when peer allocation failsLinux
- CVE-2026-74549hwmon: (nct6775-core) Prevent access to unsupported weight registersLinux
- CVE-2026-74548forcedeth: fix UAF of txrx_stats in nv_removeLinux
- CVE-2026-74544net/sched: cls_u32: validate offshift to prevent shift-out-of-boundsLinux
- CVE-2026-74541Bluetooth: ISO: clear iso_data always when detaching conn from hconLinux
- CVE-2026-74540Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rspLinux
- CVE-2026-74539Bluetooth: ISO: lock sk in iso_sock_getnameLinux
- CVE-2026-74538Bluetooth: ISO: lock sk in iso_connect_indLinux
- CVE-2026-74537Bluetooth: ISO: hold sk properly in iso_conn_readyLinux
- CVE-2026-74535Bluetooth: ISO: avoid deadlocks in iso_sock_timeoutLinux
- CVE-2026-74534Bluetooth: ISO: fix refcounting of iso_connLinux
- CVE-2026-74533Bluetooth: ISO: fix race of kfree vs kref_get_unless_zeroLinux
- CVE-2026-74531Bluetooth: hci_conn: hold conn reference in abort_conn_sync()Linux
- CVE-2026-74530Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callbackLinux
- CVE-2026-74529Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callbackLinux
- CVE-2026-74528Bluetooth: hci_sync: hold conn in hci_past_sync() callbackLinux
- CVE-2026-74527octeontx2-af: Block VFs from clobbering special CGX PKIND stateLinux
- CVE-2026-74523qede: sync udp_tunnel ports outside qede_lock in the recovery pathLinux
- CVE-2026-74522ksmbd: fix use-after-free in __close_file_table_ids()Linux
- CVE-2026-74520iommu/iommufd: Fix IOPF group ownership UAFLinux
- CVE-2026-74519pinctrl: devicetree: don't free uninitialized dev_name on error pathLinux
- CVE-2026-74518mm/hugetlb: fix list corruption in allocate_file_region_entries()Linux
- CVE-2026-74516KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is activeLinux
- CVE-2026-74515KVM: s390: pci: Reject adapter interrupt forwarding if already enabledLinux
- CVE-2026-74513dibs: fix use-after-free of dmb_node in loopback attach/detach/unregisterLinux
- CVE-2026-74512audit: fix potential use-after-free in audit_del_rule()Linux
- CVE-2026-74510Bluetooth: mgmt: fix UAF in pair command cancellationLinux
- CVE-2026-74509Bluetooth: hci_sync: Fix advertising data UAFsLinux
- CVE-2026-74508Bluetooth: HIDP: reject frames without a transaction headerLinux
- CVE-2026-74507Bluetooth: HIDP: validate numbered report payloadsLinux
- CVE-2026-74506afs: Fix UAF when sending a messageLinux
- CVE-2026-74503ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completesLinux
- CVE-2026-74497ALSA: usb-audio: Clamp frame size in implicit-feedback modeLinux
- CVE-2026-74496fou: Fix use-after-free in fou_create()Linux
- CVE-2026-74492netfilter: ipset: do not update comments from kernel-side hash addsLinux
- CVE-2026-74490tipc: avoid use-after-free in poll trace queue dumpsLinux
- CVE-2026-74489wifi: mac80211: fix tid_tx use-after-free on BA session stopLinux
- CVE-2026-74488wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS framesLinux
- CVE-2026-74485binfmt_misc: reject a flag character as the field delimiterLinux
- CVE-2026-74482mm/huge_memory: unlock i_mmap_rwsem before releasing after-split foliosLinux
- CVE-2026-74481mm/page_reporting: use system_freezable_wq to fix UAF during suspendLinux
- CVE-2026-74479net: pktgen: fix proc entry use-after-freeLinux
- CVE-2026-74471tracing: Check return value of __register_event() in trace_module_add_events()Linux
- CVE-2026-74470scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB writeLinux
- CVE-2026-74469sctp: prevent peer transport count overflowLinux
- CVE-2026-74467s390/qeth: Check CAP_NET_ADMIN for private ioctlsLinux
- CVE-2026-74465net: openvswitch: fix potential UAF on meter attach failureLinux
- CVE-2026-74461i2c: imx: Cancel hrtimer before clearing slave pointerLinux
- CVE-2026-74456can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit errorLinux
- CVE-2026-74454drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO sizeLinux
- CVE-2026-74453drm/vc4: Zero the tile state data array before each BIN jobLinux
- CVE-2026-74452drm/panthor: reject firmware sections with oversized dataLinux
- CVE-2026-74451drm/panthor: validate firmware interface structure sizesLinux
- CVE-2026-74450drm/amd/pm: fix pptable use-after-freeLinux
- CVE-2026-74449drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewportLinux
- CVE-2026-74447drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignmentLinux
- CVE-2026-74446drm/amdkfd: hold event_mutex while checkpointing CRIU eventsLinux
- CVE-2026-74444drm/vmwgfx: validate DRAW_PRIMITIVES header size before divisionLinux
- CVE-2026-74443drm/vmwgfx: bound DMA command body size against suffix pointerLinux
- CVE-2026-74440drm/xe: Wait on external BO kernel fences in exec IOCTLLinux
- CVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request localeApache Software Foundation Apache Struts
- CVE-2026-73634Apache Struts: Unbounded read of a Content Security Policy violation reportApache Software Foundation Apache Struts
- CVE-2026-18438Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatchwpdevteam Templately – Elementor & Gutenberg Template Libra…
- CVE-2026-15142Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID CollisionWebCodingPlace Real Estate Manager Pro
- CVE-2026-14279Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parametercedcommerce Wholesale Market
- CVE-2026-16611Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration DisclosureProduct Feed PRO for WooCommerce by AdTribes
- CVE-2026-74438crypto: sun4i-ss - Remove insecure and unused rng_algLinux
- CVE-2026-74435rxrpc: rxrpc_verify_data ensure rx_dec_buffer allocLinux
- CVE-2026-74431rxrpc: Fix potential infinite loop in rxrpc_recvmsg()Linux
- CVE-2026-74430rxrpc: Fix ACKALL packet handlingLinux
- CVE-2026-74429rxrpc: Fix the reception of a reply packet before data transmissionLinux
- CVE-2026-74425afs: handle CB.InitCallBackState3 requests without a server recordLinux
- CVE-2026-74419accel/amdxdna: Adjust size for copy_to_user()Linux
- CVE-2026-74417drm/radeon: fix integer overflow in radeon_align_pitch()Linux
- CVE-2026-74413wifi: rtw89: fix wrong pci_get_drvdata type in AER handlersLinux
- CVE-2026-74412wifi: rtw88: fix wrong pci_get_drvdata type in AER handlersLinux
- CVE-2026-74411wifi: rtw89: Correct data type for scan index to avoid infinite loopLinux
- CVE-2026-74410wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA bufferLinux
- CVE-2026-74409wifi: rtw89: add bounds check on firmware mac_id in link lookupLinux
- CVE-2026-74408wifi: ath9k: fix OOB access from firmware tx status queue IDLinux
- CVE-2026-74407wifi: ath11k: cancel SSR work items during PCI shutdownLinux
- CVE-2026-74405OPP: Fix race between OPP addition and lookupLinux
- CVE-2026-74404crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-oneLinux
- CVE-2026-74403crypto: ccp - Check for page allocation failure correctly in TIOLinux
- CVE-2026-74397IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlierLinux
- CVE-2026-74396RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failureLinux
- CVE-2026-74390RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrsLinux
- CVE-2026-74388ALSA: seq: oss: Fix UAF at handling events with embedded SysEx dataLinux
- CVE-2026-74387ALSA: seq: midi: Serialize output teardown with event_inputLinux
- CVE-2026-74385nvmet-tcp: check return value of nvmet_tcp_set_queue_sockLinux
- CVE-2026-74383nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_poolsLinux
- CVE-2026-74380gpu: host1x: Fix iommu_map_sgtable() return value checkLinux
- CVE-2026-74378RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqeLinux
- CVE-2026-74377RDMA/rxe: Copy WQE to local buffer in non-SRQ receive pathLinux
- CVE-2026-74374md/raid1,raid10: fix error-path detection with md_cloned_bio()Linux
- CVE-2026-74371bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compatLinux
- CVE-2026-74367wifi: ath12k: fix inconsistent arvif state in vdev_create error pathsLinux
- CVE-2026-74365nvdimm/btt: Handle preemption in BTT lane acquisitionLinux
- CVE-2026-74364bpf: Reject exclusive maps as inner maps in map-in-mapLinux
- CVE-2026-74363bpf: fix UAF by restoring RCU-delayed inode freeing in bpffsLinux
- CVE-2026-74359configfs_lookup(): don't leave ->s_dentry dangling on failureLinux
- CVE-2026-74357drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dumpLinux
- CVE-2026-74356vhost: fix vhost_get_avail_idx for a non empty ringLinux
- CVE-2026-74355iommu/vt-d: Fix RB-tree corruption in probe error pathLinux
- CVE-2026-74354bpf: Take mmap_lock in zap_pages()Linux
- CVE-2026-74349ocfs2: reject FITRIM ranges shorter than a clusterLinux
- CVE-2026-74347netfilter: cttimeout: detach dataplane timeout policy and repurpose refcountLinux
- CVE-2026-74344bpf: Clear rb node linkage when freeing bpf_rb_rootLinux
- CVE-2026-74343kernfs: fix xattr race condition with multiple superblocksLinux
- CVE-2026-74341wifi: wcn36xx: fix heap overflow from oversized firmware HAL responseLinux
- CVE-2026-74340wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indicationLinux
- CVE-2026-74338bpf: Reject sleepable BPF_LSM_CGROUP programs at load timeLinux
- CVE-2026-74334RDMA/nldev: Fix locking when accessing mr->pdLinux
- CVE-2026-74333ASoC: amd: acp-sdw-legacy: Bound DAI link iterationLinux
- CVE-2026-74332ASoC: amd: acp-sdw-sof: Bound DAI link iterationLinux
- CVE-2026-74330configfs: fix lockless traversals of ->s_childrenLinux
- CVE-2026-74328iommufd: Destroy the pages content after detaching from dmabufLinux
- CVE-2026-74325wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_linkLinux
- CVE-2026-74323wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()Linux
- CVE-2026-74321btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()Linux
- CVE-2026-74317ixgbe: do not configure xps for XDP queuesLinux
- CVE-2026-74316NFSD: Handle layout stid in nfsd4_drop_revoked_stid()Linux
- CVE-2026-74314bpf: Cancel special fields on map value recycleLinux
- CVE-2026-74313vduse: hold vduse_lock across IDR lookup in open pathLinux
- CVE-2026-74312vhost/vdpa: validate virtqueue index in mmap and fault pathsLinux
- CVE-2026-74311virtio: rtc: tear down old virtqueues before restoreLinux
- CVE-2026-74306vfio/qat: fix f_pos race in qat_vf_resume_write()Linux
- CVE-2026-74305bpf: Tighten cgroup storage cookie checks for prog arraysLinux
- CVE-2026-74302Bluetooth: hci_core: Fix UAF in hci_unregister_dev()Linux
- CVE-2026-74300Bluetooth: hci: validate codec capability element lengthLinux
- CVE-2026-74297RDMA/mlx5: Fix undefined shift of user RQ WQE sizeLinux
- CVE-2026-74296RDMA/mlx5: Release the HW‑provided UAR index rather than the SW oneLinux
- CVE-2026-74295ASoC: codecs: hdac_hdmi: Validate written enum valueLinux
- CVE-2026-74294ASoC: meson: aiu: Validate written enum valuesLinux
- CVE-2026-74293ASoC: fsl: fsl_audmix: Validate written enum valuesLinux
- CVE-2026-74292ASoC: tegra: tegra210_ahub: Validate written enum valueLinux
- CVE-2026-74289ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().Linux
- CVE-2026-74288net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().Linux
- CVE-2026-74285net: Stop leased rxq before uninstalling its memory providerLinux
- CVE-2026-74283tipc: require net admin for TIPCv2 netlink mutatorsLinux
- CVE-2026-74282tipc: prevent snt_unacked underflow on CONN_ACKLinux
- CVE-2026-74281tipc: reject inverted service ranges from peer bindingsLinux
- CVE-2026-74277iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA pathLinux
- CVE-2026-74275cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()Linux
- CVE-2026-74270handshake: Require admin permission for DONE commandLinux
- CVE-2026-74264net: watchdog: fix refcount tracking racesLinux
- CVE-2026-74262kcm: use WRITE_ONCE() when changing lower socket callbacksLinux
- CVE-2026-74260netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use themLinux
- CVE-2026-74258bpf: Guard __get_user acesss with access_ok for uprobe_multi dataLinux
- CVE-2026-74257sockmap: Fix use-after-free in udp_bpf_recvmsg()Linux
- CVE-2026-74256bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds checkLinux
- CVE-2026-72502tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)Linux
- CVE-2026-72500RDMA/bnxt_re: Free SRQ toggle page after firmware teardownLinux
- CVE-2026-72499RDMA/bnxt_re: Free CQ toggle page after firmware teardownLinux
- CVE-2026-72497RDMA/bnxt_re: Add a max slot check for SQLinux
- CVE-2026-72492ksmbd: fix use-after-free in same_client_has_lease()Linux
- CVE-2026-72489staging: nvec: fix use-after-free in nvec_rx_completed()Linux
- CVE-2026-72488soundwire: fix bug in sdw_add_element_group_count found by syzkallerLinux
- CVE-2026-72487PCI: Check ROM header and data structure addr before accessingLinux
- CVE-2026-72485coresight: platform: defer connection counter increment until alloc succeedsLinux
- CVE-2026-72483usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()Linux
- CVE-2026-72482gpib: fix double decrement of descriptor_busy in command_ioctl()Linux
- CVE-2026-72480iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handlingLinux
- CVE-2026-72478fs/ntfs3: add bounds check to run_get_highest_vcn()Linux
- CVE-2026-72476dmaengine: Fix possible use after freeLinux
- CVE-2026-72471fs/ntfs3: prevent potential lcn remains uninitializedLinux
- CVE-2026-72470fs/ntfs3: resize log->one_page_buf when adopting on-disk page sizeLinux
- CVE-2026-72469xprtrdma: Fix ep kref imbalance on ADDR_CHANGELinux
- CVE-2026-72465xprtrdma: Sanitize the reply credit grant after parsingLinux
- CVE-2026-72464xprtrdma: Repost Receive buffers for malformed repliesLinux
- CVE-2026-72462apparmor: fix race in unix socket mediation when peer_path is usedLinux
- CVE-2026-72461apparmor: fix refcount leak when updating the sk_ctxLinux
- CVE-2026-72460apparmor: check label build before no_new_privs testLinux
- CVE-2026-72459apparmor: aa_label_alloc use aa_label_free on alloc failureLinux
- CVE-2026-72455apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()Linux
- CVE-2026-72454i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()Linux
- CVE-2026-72452drm/i915: clear CRTC color blob pointers after dropping refsLinux
- CVE-2026-72450xfrm: validate selector family and prefixlen during matchLinux
- CVE-2026-72449drm/amdkfd: fix list_del corruption in kfd_criu_resume_svmLinux
- CVE-2026-72446ALSA: usb-audio: qcom: reject stream disable with no active interfaceLinux
- CVE-2026-72444flow_dissector: check device type before reading ETH_ADDRSLinux
- CVE-2026-72440md/raid1: fix writes_pending and barrier reference leaks on write failuresLinux
- CVE-2026-72438md/raid10: fix writes_pending and barrier reference leaks on discard failuresLinux
- CVE-2026-72435netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()Linux
- CVE-2026-72434netfilter: ipset: make sure gc is properly stoppedLinux
- CVE-2026-72427bpf: Fix effective prog array index with BPF_F_PREORDERLinux
- CVE-2026-72426bpf: Preserve pointer spill metadata during half-slot cleanupLinux
- CVE-2026-72425ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()Linux
- CVE-2026-72423bpf: Guard conntrack opts error writesLinux
- CVE-2026-72420md/raid5: avoid R5_Overlap races while breaking stripe batchesLinux
- CVE-2026-72419netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()Linux
- CVE-2026-72418netfilter: nf_conncount: prevent connlimit drops for early confirmed ctLinux
- CVE-2026-72416netfilter: nft_compat: ebtables emulation must reject non-bridge targetsLinux
- CVE-2026-72415ASoC: SDCA: Validate written enum value in ge_put_enum_double()Linux
- CVE-2026-72411net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_workLinux
- CVE-2026-72410octeontx2-af: Validate NIX maximum LFs correctlyLinux
- CVE-2026-72409net: mvneta: re-enable percpu interrupt on resumeLinux
- CVE-2026-72406net: sungem: fix probe error cleanupLinux
- CVE-2026-72405net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_syncLinux
- CVE-2026-72404tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()Linux
- CVE-2026-72400seg6: validate SRH length before reading fixed fieldsLinux
- CVE-2026-72397hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()Linux
- CVE-2026-72395hwmon: (pmbus) Fix passing events to regulator coreLinux
- CVE-2026-72390net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAFLinux
- CVE-2026-72389bridge: stp: Fix a potential use-after-free when deleting a bridgeLinux
- CVE-2026-72383sctp: fix addr_wq_timer race in sctp_free_addr_wq()Linux
- CVE-2026-72382ksmbd: reject undersized DACLs before parsing ACEsLinux
- CVE-2026-72380xen/pvcalls: bound backend response req_id before indexing rsp[]Linux
- CVE-2026-72378afs: Fix error code in afs_extract_vl_addrs()Linux
- CVE-2026-72375afs: Fix reinitialisation of the inode, in particular ->lock_workLinux
- CVE-2026-72374afs: Fix callback service message parsers to pass through -EAGAINLinux
- CVE-2026-72373afs: Fix missing NULL pointer check in afs_break_some_callbacks()Linux
- CVE-2026-72372afs: Fix lack of locking around modifications of net->cells_dyn_inoLinux
- CVE-2026-72371afs: Fix the volume AFS_VOLUME_RM_TREE is set onLinux
- CVE-2026-72369minix: avoid overflow in bitmap block count calculationLinux
- CVE-2026-72368cachefiles: Fix double unlock in nomem_d_alloc error pathLinux
- CVE-2026-72367iomap: guard io_size EOF trim against concurrent truncate underflowLinux
- CVE-2026-72364netfs: Fix writeback error handlingLinux
- CVE-2026-72360drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relaysLinux
- CVE-2026-72358drm/xe/pt: prevent invalid cursor access for purged BOsLinux
- CVE-2026-72357uprobes/x86: Use proper mm_struct in __in_uprobe_trampolineLinux
- CVE-2026-72356cifs: Fix missing credit release on failure in cifs_issue_read()Linux
- CVE-2026-72354ntfs: avoid stale runlist element dereference in MFT writebackLinux
- CVE-2026-72353ntfs: avoid stale runlist element dereference in fallocateLinux
- CVE-2026-72352HID: bpf: Fix hid_bpf_get_data() range checkLinux
- CVE-2026-72350netfilter: xt_u32: reject invalid shift countsLinux
- CVE-2026-72347netfilter: xt_connmark: reject invalid shift parametersLinux
- CVE-2026-72345net/mlx5: LAG, Fix off-by-one in single-FDB error rollbackLinux
- CVE-2026-72344net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailableLinux
- CVE-2026-72343net/mlx5e: Fix HV VHCA stats zero-sized buffer allocationLinux
- CVE-2026-72342net/mlx5e: Fix HV VHCA stats agent registration raceLinux
- CVE-2026-72340net: microchip: vcap: fix races on the shared Super VCAP blockLinux
- CVE-2026-72338net/sched: act_pedit: fix TOCTOU heap OOB write in tc offloadLinux
- CVE-2026-72335Bluetooth: MGMT: Fix adv monitor add failure cleanupLinux
- CVE-2026-72334Bluetooth: ISO: fix malformed ISO_END/CONT handlingLinux
- CVE-2026-72331accel/amdxdna: Fix VMA access raceLinux
- CVE-2026-72330net/tls: Consume empty data records in tls_sw_read_sock()Linux
- CVE-2026-72328accel/amdxdna: Fix potential amdxdna_umap lifetime raceLinux
- CVE-2026-72315smb: client: fix busy dentry warning on unmount after DIOLinux
- CVE-2026-72314regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCKLinux
- CVE-2026-72312octeontx2-af: fix VF bringup affecting PF promiscuous stateLinux
- CVE-2026-72310smb: client: fix overflow in passthrough ioctl bounds checkLinux
- CVE-2026-72304ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_putLinux
- CVE-2026-72303ASoC: SOF: ipc4-control: Validate notification payload sizeLinux
- CVE-2026-72302ASoC: SOF: ipc3-control: Use overflow checks in control_update size calcLinux
- CVE-2026-72301ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_getLinux
- CVE-2026-72298net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()Linux
- CVE-2026-72297net: atm: reject out-of-range traffic classes in QoS validationLinux
- CVE-2026-72295LoongArch: KVM: Validate irqchip index in irqfd routingLinux
- CVE-2026-72294LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()Linux
- CVE-2026-72287KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checksLinux
- CVE-2026-72286KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMsLinux
- CVE-2026-72285KVM: TDX: Reject concurrent change to CPUID entry countLinux
- CVE-2026-72284KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIsLinux
- CVE-2026-72283KVM: x86: Nullify irqfd->producer if updating IRTE for bypass failsLinux
- CVE-2026-72282KVM: Move kvm_io_bus_get_dev() locking responsibilities to callersLinux
- CVE-2026-72280KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2Linux
- CVE-2026-72262ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/getLinux
- CVE-2026-72261ASoC: SOF: ipc3-control: Validate size in snd_sof_update_controlLinux
- CVE-2026-72255netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dstLinux
- CVE-2026-72254netfilter: nft_fib: reject fib expression on the netdev egress hookLinux
- CVE-2026-72253netfilter: nf_conntrack_sip: validate skb_dst() before accessing itLinux
- CVE-2026-72252netfilter: nft_set_pipapo: don't leak bad clone into future transactionLinux
- CVE-2026-72250netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defragLinux
- CVE-2026-72247netfilter: nf_conncount: fix zone comparison in tuple dedupLinux
- CVE-2026-72244gpu/buddy: bail out of try_harder when alignment cannot be honouredLinux
- CVE-2026-72243selinux: check connect-related permissions on TCP Fast OpenLinux
- CVE-2026-72242selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()Linux
- CVE-2026-72235batman-adv: retrieve ethhdr after potential skb realloc on RXLinux
- CVE-2026-72233batman-adv: bla: reacquire gw address after skb reallocLinux
- CVE-2026-72232batman-adv: ensure minimal ethernet header on TXLinux
- CVE-2026-72231batman-adv: tt: avoid request storms during pending requestLinux
- CVE-2026-72227batman-adv: mcast: avoid OOB read of num_dests headerLinux
- CVE-2026-72225jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()Linux
- CVE-2026-72213mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatchLinux
- CVE-2026-72204ntfs: centalize $INDEX_ROOT header validationLinux
- CVE-2026-72203ntfs: skip extent mft records in writeback to prevent deadlockLinux
- CVE-2026-72202ntfs: avoid heap allocation for free-cluster readahead stateLinux
- CVE-2026-72198ntfs: reject non-resident records for resident-only attributesLinux
- CVE-2026-72197fs/ntfs3: bound DeleteIndexEntryAllocation memmove lengthLinux
- CVE-2026-72196fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis passLinux
- CVE-2026-72195fs/ntfs3: bound attr_off in UpdateResidentValue against data_offLinux
- CVE-2026-72183landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO pathLinux
- CVE-2026-72181mips: sched: Fix CPUMASK_OFFSTACK memory corruptionLinux
- CVE-2026-72175fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update raceLinux
- CVE-2026-72172mm/mm_init: fix uninitialized struct pages for ZONE_DEVICELinux
- CVE-2026-72171mtd: slram: remove failed entries from the device listLinux
- CVE-2026-721709p: skip nlink update in cacheless mode to fix WARN_ONLinux
- CVE-2026-72165mtd: rawnand: fix condition in 'nand_select_target()'Linux
- CVE-2026-72164ocfs2: avoid moving extents to occupied clustersLinux
- CVE-2026-72162ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_recLinux
- CVE-2026-72160ocfs2: reject dinodes with non-canonical i_mode typeLinux
- CVE-2026-72157net: thunderbolt: Fix frags[] overflow by bounding frame_countLinux
- CVE-2026-72154openrisc: Fix jump_label smp syncingLinux
- CVE-2026-72151tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_saltLinux
- CVE-2026-72149dmaengine: tegra: Fix burst size calculationLinux
- CVE-2026-72148dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASKLinux
- CVE-2026-72146dmaengine: sh: rz-dmac: Move interrupt request after everything is set upLinux
- CVE-2026-72144platform/x86: dell-laptop: fix missing cleanups in init error pathLinux
- CVE-2026-72143platform/x86: ISST: Restore SST-PP control to all domainsLinux
- CVE-2026-72141i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)Linux
- CVE-2026-72136xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-72135tpm: Make the TPM character devices non-seekableLinux
- CVE-2026-72134spi: imx: reconfigure for PIO when DMA cannot be startedLinux
- CVE-2026-72133spi: uniphier: Fix completion initialization order before devm_request_irq()Linux
- CVE-2026-72126can: isotp: use unconditional synchronize_rcu() in isotp_release()Linux
- CVE-2026-72125can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTERLinux
- CVE-2026-72124can: isotp: serialize TX state transitions under so->rx_lockLinux
- CVE-2026-72123can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAFLinux
- CVE-2026-72122can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failureLinux
- CVE-2026-72121can: bcm: add locking when updating filter and timer valuesLinux
- CVE-2026-72120can: bcm: add missing rcu list annotations and operationsLinux
- CVE-2026-72119can: bcm: extend bcm_tx_lock usage for data and timer updatesLinux
- CVE-2026-72116can: bcm: fix stale rx/tx ops after device removalLinux
- CVE-2026-72115can: bcm: track a single source interface for ANYDEV timeout/throttle opsLinux
- CVE-2026-72114can: bcm: validate frame length in bcm_rx_setup() for RTR repliesLinux
- CVE-2026-72113can: bcm: add missing device refcount for CAN filter removalLinux
- CVE-2026-72112io_uring/bpf-ops: reject re-registration of an already-bound opsLinux
- CVE-2026-72111bpf: Reset register bounds before narrowing retval range in check_mem_access()Linux
- CVE-2026-72110bpf,fork: wipe ->bpf_storage before bailouts that access itLinux
- CVE-2026-72109net: sparx5: unregister blocking notifier on init failureLinux
- CVE-2026-72108dm thin metadata: fix metadata snapshot consistency on commit failureLinux
- CVE-2026-72107dm era: fix out-of-bounds memory access for non-zero start sectorLinux
- CVE-2026-72105dm-log: fix a bitset_size overflow on 32bit machinesLinux
- CVE-2026-72103dm: avoid leaking the caller's thread keyring via the table device fileLinux
- CVE-2026-72102dm_early_create: fix freeing used table on dm_resume failureLinux
- CVE-2026-72100dm-integrity: fix a bug if the bio is out of limitsLinux
- CVE-2026-72099dm-integrity: don't increment hash_offset twiceLinux
- CVE-2026-72095dma-fence: Make dma_fence_dedup_array() robust against 0-count inputLinux
- CVE-2026-72093accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()Linux
- CVE-2026-72090accel/amdxdna: Use caller client for debug BO syncLinux
- CVE-2026-72089accel/ivpu: Reject firmware log with size smaller than headerLinux
- CVE-2026-72080fs/resctrl: Fix use-after-free during unmountLinux
- CVE-2026-72072net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC deleteLinux
- CVE-2026-72071tracing/user_events: Fix use-after-free in user_event_mm_dup()Linux
- CVE-2026-72067cpu: hotplug: Preserve per instance callback errorsLinux
- CVE-2026-72066cpu: hotplug: Bound hotplug states sysfs outputLinux
- CVE-2026-72061net: sit: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-72057net/sched: act_ct: preserve tc_skb_cb across defragmentationLinux
- CVE-2026-72055net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-72054net: ip_vti: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-72053net: ipip: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-72052net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-72051net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-72049ieee802154: admin-gate legacy LLSEC dump operationsLinux
- CVE-2026-72045octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PFLinux
- CVE-2026-72043LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()Linux
- CVE-2026-72042ipmi: Fix user refcount underflow in event deliveryLinux
- CVE-2026-72036net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peekedLinux
- CVE-2026-72035net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peekedLinux
- CVE-2026-72034fhandle: reject detached mounts in capable_wrt_mount()Linux
- CVE-2026-72029net: wwan: iosm: bound device offsets in the MUX downlink decoderLinux
- CVE-2026-72027mm/compaction: handle free_pages_prepare() properly in compaction_free()Linux
- CVE-2026-72024mac802154: remove interfaces with RCU list deletionLinux
- CVE-2026-72021ipvs: use parsed transport offset in SCTP state lookupLinux
- CVE-2026-72019macsec: don't read an unset MAC header in macsec_encrypt()Linux
- CVE-2026-72018dibs: loopback: validate offset and size in move_data()Linux
- CVE-2026-72012tracing/osnoise: Call synchronize_rcu() when unregisteringLinux
- CVE-2026-72009pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSILinux
- CVE-2026-72005wifi: rt2x00: avoid full teardown before work setup in probeLinux
- CVE-2026-72003wifi: brcmfmac: cyw: fix heap overflow on a short auth frameLinux
- CVE-2026-68479Bluetooth: btrtl: validate firmware patch boundsLinux
- CVE-2026-68474powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()Linux
- CVE-2026-68473powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()Linux
- CVE-2026-68472wifi: cfg80211: validate EHT MLE before MLD ID readLinux
- CVE-2026-68471wifi: ieee80211: validate MLE common info lengthLinux
- CVE-2026-68470wifi: mac80211: validate extension-frame layout before RXLinux
- CVE-2026-68467mtd: mchp23k256: use SPI match data for chip capsLinux
- CVE-2026-68466mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeoutLinux
- CVE-2026-68462bpf: Reject negative const offsets for buffer pointersLinux
- CVE-2026-68461device property: initialize the remaining fields of fwnode_handle in fwnode_init()Linux
- CVE-2026-68458binder: cache secctx size before release zeroes itLinux
- CVE-2026-16007Authenticated SQL Injection in AppFlowyAppFlowy-IO AppFlowy-Cloud
- CVE-2026-16145Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parametermatthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA A…
- CVE-2026-13360Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameterwplegalpages WPLP Cookie Consent – Cookie Banner & Consent…
- CVE-2026-15001bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settingsconnectordev bLoyal: Loyalty & Promotions by bLoyal
- CVE-2026-15162Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injectionminnpost Object Sync for Salesforce
- CVE-2026-15965MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parametersadathimel MaxUpload – Big File Uploads – Increase Maximum…
- CVE-2026-15312Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameterfassionstorage Propovoice: All-in-One Client Management Sys…
- CVE-2026-14433Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' ParameterOnline Booking & Scheduling Calendar by vcita
Medium, low and unrated 374
- CVE-2026-19920code-projects Online Shopping System action.php sql injectioncode-projects Online Shopping System
- CVE-2026-19919code-projects Online Shopping System Login login.php sql injectioncode-projects Online Shopping System
- CVE-2026-19918SpaceX Starlink Router Gen 3 gRPC Management get_status access controlSpaceX Starlink Router Gen
- CVE-2026-19917code-projects Online Food Order System delete_food_items1.php sql injectioncode-projects Online Food Order System
- CVE-2026-19916code-projects Online Food Order System edit_food_items.php cross site scriptingcode-projects Online Food Order System
- CVE-2026-73055Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBoxericcornelissen shescape
- CVE-2026-19906pkp pkp-lib API Key Generation APIProfileForm.php setData entropypkp-lib
- CVE-2026-19905Jinher OA attendance_out_approve.aspx sql injectionJinher OA
- CVE-2026-19904SourceCodester Online Book Store System System Settings index.php site_settings cross site scriptingSourceCodester Online Book Store System
- CVE-2026-19903SourceCodester Online Clothing Store SQL Database Backup shopping.sql file accessSourceCodester Online Clothing Store
- CVE-2026-19899SourceCodester Class and Exam Timetabling System edit_teacher.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-19898VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authenticationVictoriaMetrics
- CVE-2026-19897mangroup dtale Login Endpoint auth.py login excessive authenticationmangroup dtale
- CVE-2026-19896mangroup dtale Flask Session Cookie app.py build_secret_key random valuesmangroup dtale
- CVE-2026-18165@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies@fastify/oauth2
- CVE-2026-19895opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authenticationopensourcepos Open Source Point of Sale
- CVE-2026-74577net: mpls: initialize rtm_tos in mpls_getroute()Linux
- CVE-2026-74571btrfs: skip global block reserve accounting for rescue mountsLinux
- CVE-2026-74566keys: make keyring key-chunk byte order agree with keyring_diff_objects()Linux
- CVE-2026-74560xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer TxLinux
- CVE-2026-74559xsk: drain continuation descs after overflow in xsk_build_skb()Linux
- CVE-2026-74558xsk: reclaim invalid Tx descriptors in ZC batch pathLinux
- CVE-2026-74555scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake raceLinux
- CVE-2026-74553hwmon: (nct6775-core) Fix number of temperature registers for NCT6116Linux
- CVE-2026-74552hwmon: (lm90) Only report alarms if driver is readyLinux
- CVE-2026-74547hwmon: (adt7470) Fix busy-loop and I2C flooding in update threadLinux
- CVE-2026-74546hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed readLinux
- CVE-2026-74543net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()Linux
- CVE-2026-74542netfs: Fix folio_queue ENOMEM in writeback by adding a mempoolLinux
- CVE-2026-74536Bluetooth: ISO: fix leaking sk after socket releaseLinux
- CVE-2026-74532Bluetooth: btintel: Validate length before parsing diagnostics TLVLinux
- CVE-2026-74526scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emitLinux
- CVE-2026-74525net: sxgbe: free TX rings on RX allocation failureLinux
- CVE-2026-74524riscv: mm: Fix out-of-bounds page-table walk during memory hot-removeLinux
- CVE-2026-74514KVM: s390: pci: Fix memory accounting for pinned/unpinned pagesLinux
- CVE-2026-74505ALSA: 6fire: Fix UAF at error handling during probeLinux
- CVE-2026-74504ALSA: seq: Fix division by zero in initialize_timer()Linux
- CVE-2026-74502ALSA: ump: fix double free of out_cvts on rawmidi errorLinux
- CVE-2026-74501ALSA: usb-audio: fix use-after-free in ump_to_endpoint()Linux
- CVE-2026-74500ALSA: usb-audio: fix stack info leak in RME Digiface statusLinux
- CVE-2026-74499ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()Linux
- CVE-2026-74498ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is setLinux
- CVE-2026-74494ksmbd: reject repeated SMB2 NEGOTIATE requestsLinux
- CVE-2026-74491of/address: Fix NULL bus dereference in of_pci_range_parser_one()Linux
- CVE-2026-74487binfmt_misc: restore write access when removing an entryLinux
- CVE-2026-74486binfmt_misc: use exe_file_deny_write_access() for the interpreter cloneLinux
- CVE-2026-74484binfmt_misc: don't let an 'F' entry pin its own instanceLinux
- CVE-2026-74483binfmt_misc: don't leak the user namespace when the mount failsLinux
- CVE-2026-74477uprobes: Fix NULL pointer dereference in hprobe_expire()Linux
- CVE-2026-74472ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()Linux
- CVE-2026-74468gpio: pch: use raw_spinlock_t for the register lockLinux
- CVE-2026-74466s390/zcrypt: Close speculative mem read possibilityLinux
- CVE-2026-74464net: openvswitch: fix skb leak on flow key update failure during ctLinux
- CVE-2026-74463i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlockLinux
- CVE-2026-74462i2c: imx: mark I2C adapter when hardware is powered downLinux
- CVE-2026-74460can: ems_usb: validate CPC message lengthsLinux
- CVE-2026-74459can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failureLinux
- CVE-2026-74458can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extentsLinux
- CVE-2026-74457can: peak_usb: add bounds check for USB channel indexLinux
- CVE-2026-74455can: peak_usb: validate uCAN receive record lengthsLinux
- CVE-2026-74448drm/amdkfd: fix QID bit leak in pqm_create_queue()Linux
- CVE-2026-74445drm/vmwgfx: reject DX_BIND_QUERY without a DX contextLinux
- CVE-2026-74442drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failureLinux
- CVE-2026-74441usb: typec: ucsi: Fix race condition and ordering in port unregistrationLinux
- CVE-2026-19894itsourcecode Hospital Management System viewmedicine.php sql injectionitsourcecode Hospital Management System
- CVE-2026-19893D-Link DIR-842 vsftpd vsftpd.conf default permissionD-Link DIR-842
- CVE-2026-12248WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' ParameterWPML Multilingual CMS
- CVE-2026-19891TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryptionTRENDnet TEW-WLC100
- CVE-2026-73632Apache Struts: Shared serialization state in the JSON pluginApache Software Foundation Apache Struts
- CVE-2026-73631Apache Struts: Shared parsing state in the JSON pluginApache Software Foundation Apache Struts
- CVE-2026-18807ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater HandlersECS
- CVE-2026-18216Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-LoginBackup Migration
- CVE-2026-16541Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST EndpointsSimply Schedule Appointments
- CVE-2026-14230ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater BindingsECS
- CVE-2026-14229ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsloadECS
- CVE-2026-74437media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.workLinux
- CVE-2026-74432rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)Linux
- CVE-2026-74426afs: fix NULL pointer dereference in afs_get_tree()Linux
- CVE-2026-74424fbcon: fix NULL pointer dereference for a console without vc_dataLinux
- CVE-2026-74423accel/amdxdna: Fix leak when pinning ubuf pagesLinux
- CVE-2026-74422drm/rockchip: inno-hdmi: Switch to drmm_kzalloc()Linux
- CVE-2026-74421drm/rockchip: dw_dp: Switch to drmm_kzalloc()Linux
- CVE-2026-74420drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM rangesLinux
- CVE-2026-74418dma-fence: Fix potential tracepoint null pointer dereferencesLinux
- CVE-2026-74416drm/radeon: fix memory leak in radeon_ring_restore() on lock failureLinux
- CVE-2026-74415spi: atcspi200: fix use-after-free when driver unbindLinux
- CVE-2026-74414hfsplus: Remove the duplicate attr inode dirty marking actionLinux
- CVE-2026-74402crypto: atmel-sha204a - fix blocking and non-blocking rng logicLinux
- CVE-2026-74400bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentriesLinux
- CVE-2026-74399evm: terminate and bound the evm_xattrs read bufferLinux
- CVE-2026-74395RDMA/mlx5: Fix devx subscribe-event unwind NULL dereferenceLinux
- CVE-2026-74393drm/syncobj: Fix memory leak in drm_syncobj_find_fence()Linux
- CVE-2026-74392dm: limit target bio polling to one shotLinux
- CVE-2026-74391tracing: Bound synthetic-field strings with seq_bufLinux
- CVE-2026-74389RDMA/hns: Fix log flood after cmd_mbox failureLinux
- CVE-2026-74386nvmet-tcp: fix page fragment cache leak in error pathLinux
- CVE-2026-74382net/sched: cls_bpf: prevent unbounded recursion in offload rollbackLinux
- CVE-2026-74381gpu: host1x: Allow entries in BO caches to be freedLinux
- CVE-2026-74379dax/kmem: account for partial discontiguous resource upon removalLinux
- CVE-2026-74375md/raid1,raid10: fix deadlock in read error recovery pathLinux
- CVE-2026-74373md/raid1,raid10: fix bio accounting for split md cloned biosLinux
- CVE-2026-74372raid1: fix nr_pending leak in REQ_ATOMIC bad-block error pathLinux
- CVE-2026-74370liveupdate: fix TOCTOU race in luo_session_retrieve()Linux
- CVE-2026-74369liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()Linux
- CVE-2026-74368wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()Linux
- CVE-2026-74366wifi: ath12k: fix NULL deref in change_sta_links for unready linkLinux
- CVE-2026-74362ext2: fix ignored return value of generic_write_sync()Linux
- CVE-2026-74360bpf: Reject exclusive maps for bpf_map_elem iteratorsLinux
- CVE-2026-74358ext4: fix fast commit wait/wake bit mapping on 64-bitLinux
- CVE-2026-74353drm/amdkfd: always resume_all after suspend_allLinux
- CVE-2026-74352of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() failsLinux
- CVE-2026-74351ocfs2: rebase copied fsdlm LVB pointers in locking_stateLinux
- CVE-2026-74348ocfs2/dlm: require a ref for locking_state debugfs openLinux
- CVE-2026-74346RDMA/irdma: Fix OOB read during CQ MR registrationLinux
- CVE-2026-74342kernfs: link kn to its parent before the LSM init hookLinux
- CVE-2026-74339ALSA: seq: Clear variable event pointer on readLinux
- CVE-2026-74337bpf: Fix NMI/tracepoint re-entry deadlock on lru locksLinux
- CVE-2026-74336wifi: mac80211: bound S1G TIM PVB walk to the TIM elementLinux
- CVE-2026-74335bpf: Fix NULL pointer dereference in bpf_task_from_vpid()Linux
- CVE-2026-74331firmware_loader: Fix recursive lock in device_cache_fw_images()Linux
- CVE-2026-74329watchdog: unregister PM notifier on watchdog unregisterLinux
- CVE-2026-74327vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()Linux
- CVE-2026-74326wifi: mt76: mt7921: fix resource leak in probe error pathLinux
- CVE-2026-74324wifi: mt76: mt7925: validate skb length in testmode queryLinux
- CVE-2026-74322wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()Linux
- CVE-2026-74320fbdev: sm501fb: Fix buffer errors in OF binding codeLinux
- CVE-2026-74319btrfs: zoned: fix deadlock waiting for ticket during data relocationLinux
- CVE-2026-74318btrfs: fix deadlock cloning inline extent when using flushoncommitLinux
- CVE-2026-74308ext4: fix kernel BUG in ext4_write_inline_data_endLinux
- CVE-2026-74307ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXTLinux
- CVE-2026-74304Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev deviceLinux
- CVE-2026-74303Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev deviceLinux
- CVE-2026-74301Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error pathLinux
- CVE-2026-74299RDMA/core: Fix FRMR aging push to queue error flowLinux
- CVE-2026-74298RDMA/core: Fix FRMR set pinned push error pathLinux
- CVE-2026-74291ASoC: topology: Check PCM and DAI name strings before useLinux
- CVE-2026-74290net/sched: cls_flow: Dont expose folded kernel pointersLinux
- CVE-2026-74286net: pfcp: allocate per-cpu tstats for PFCP netdevsLinux
- CVE-2026-74284net/sched: sch_hfsc: Don't make class passive twiceLinux
- CVE-2026-74278ALSA: seq: Fix kernel heap address leak in bounce_error_event()Linux
- CVE-2026-74276spi: xilinx: use FIFO occupancy register to determine buffer sizeLinux
- CVE-2026-74274cxl/region: Fill first free targets[] slot during auto-discoveryLinux
- CVE-2026-74273cxl/region: Block region delete during region creationLinux
- CVE-2026-74272cxl/region: Resolve region deletion racesLinux
- CVE-2026-74271power: supply: core: fix supplied_from allocationsLinux
- CVE-2026-74266net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlenLinux
- CVE-2026-74265net: mana: initialize gdma queue id to INVALID_QUEUE_IDLinux
- CVE-2026-74263net: wwan: t7xx: check skb_clone in control TXLinux
- CVE-2026-74261ALSA: seq: avoid stale FIFO cells during resizeLinux
- CVE-2026-72501RDMA/bnxt_re: Initialize dpi variable to zeroLinux
- CVE-2026-72498RDMA/bnxt_re: Avoid displaying the kernel pointerLinux
- CVE-2026-72490staging: rtl8723bs: fix stainfo check in rtw_aes_decryptLinux
- CVE-2026-72486mailbox: mtk-adsp: fix UAF during device teardownLinux
- CVE-2026-72484staging: most: video: avoid double free on video register failureLinux
- CVE-2026-72481iio: magnetometer: ak8975: fix potential kernel stack memory leakLinux
- CVE-2026-72479iio: accel: mma8452: handle I2C read error(s) in mma8452_read()Linux
- CVE-2026-72475dmaengine: dma-axi-dmac: Properly free struct axi_dmac_descLinux
- CVE-2026-72474dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptorLinux
- CVE-2026-72468xprtrdma: Initialize re_id before removal registrationLinux
- CVE-2026-72467xprtrdma: Check frwr_wp_create() during connectLinux
- CVE-2026-72458apparmor: fix NULL pointer dereference in unpack_pdbLinux
- CVE-2026-72457apparmor: fail policy unpack on accept2 allocation failureLinux
- CVE-2026-72456apparmor: release exe file resources on path failureLinux
- CVE-2026-72453regcache: Do not overwrite error code when finalizing cache after errorLinux
- CVE-2026-72448octeontx2-pf: Fix leak of SQ timestamp buffer on teardownLinux
- CVE-2026-72447sctp: hold socket lock when dumping endpoints in sctp_diagLinux
- CVE-2026-72445ALSA: usb-audio: qcom: clear opened when stream enable failsLinux
- CVE-2026-72443ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpointsLinux
- CVE-2026-72441ieee802154: fix kernel-infoleak in dgram_recvmsg()Linux
- CVE-2026-72439md/raid10: fix writes_pending leak on write request failuresLinux
- CVE-2026-72437md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retryLinux
- CVE-2026-72433netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leakLinux
- CVE-2026-72432tpm_crb: Check ACPI_COMPANION() against NULL during probeLinux
- CVE-2026-72431alloc_tag: fix use-after-free in /proc/allocinfo after module unloadLinux
- CVE-2026-72430net/sched: act_ct: fix nf_connlabels leak on two error pathsLinux
- CVE-2026-72428bpf: Fix stack slot index in nospec checksLinux
- CVE-2026-72424rtc: msc313: fix NULL deref in shared IRQ handler at probeLinux
- CVE-2026-72414net: dsa: sja1105: round up PTP perout pin durationLinux
- CVE-2026-72413sctp: fix err_chunk memory leaks in INIT handlingLinux
- CVE-2026-72403ALSA: FCP: Fix NULL pointer dereference in interface lookupLinux
- CVE-2026-72402bpf: Mask pseudo pointer values in verifier logsLinux
- CVE-2026-72401bpf: Fix insn_aux_data leak on verifier err_free_env pathLinux
- CVE-2026-72396hwmon: adm1275: Prevent reading uninitialized stackLinux
- CVE-2026-72394hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zeroLinux
- CVE-2026-72392ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dumpLinux
- CVE-2026-72391net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroyLinux
- CVE-2026-72388drm/panthor: Always use the IRQ-safe variant when acquiring the fence lockLinux
- CVE-2026-72387drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()Linux
- CVE-2026-72386drm/panthor: Fix a leak when a group is evicted before the tiler OOM is servicedLinux
- CVE-2026-72385tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()Linux
- CVE-2026-72384irqchip/ts4800: Fix missing chained handler cleanup on removeLinux
- CVE-2026-72379fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgidLinux
- CVE-2026-72377afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpointsLinux
- CVE-2026-72376afs: Fix misplaced inc of net->cells_outstandingLinux
- CVE-2026-72370iomap: release pages on atomic dio size mismatchLinux
- CVE-2026-72365netfs: Fix writethrough to use collection offloadLinux
- CVE-2026-72363netfs: Fix folio state after ENOMEM whilst under writeback iterationLinux
- CVE-2026-72362drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()Linux
- CVE-2026-72361drm/xe/hw_engine: Fix double-free of managed BO in error pathLinux
- CVE-2026-72359drm/xe: fix NPD in bo_meminfo()Linux
- CVE-2026-72349netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()Linux
- CVE-2026-72346platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resumeLinux
- CVE-2026-72341net/mlx5e: Fix publication race for priv->channel_stats[]Linux
- CVE-2026-72337Bluetooth: 6lowpan: avoid untracked enable workLinux
- CVE-2026-72336Bluetooth: 6lowpan: hold L2CAP conn across debugfs controlLinux
- CVE-2026-72333Bluetooth: L2CAP: fix tx ident leak for commands without a responseLinux
- CVE-2026-72332accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()Linux
- CVE-2026-72327drm/v3d: Reject invalid indirect BO handle in indirect CSD setupLinux
- CVE-2026-72326net/sched: cake: reject overhead values that underflow lengthLinux
- CVE-2026-72325perf/x86/amd/core: Avoid enabling BRS from the SVM reload pathLinux
- CVE-2026-72324gpio: mvebu: free generic chips on unbindLinux
- CVE-2026-72321ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()Linux
- CVE-2026-72316dm era: fix NULL pointer dereference in metadata_open()Linux
- CVE-2026-72313drm/fb-helper: Only consider active CRTCs for vblank syncLinux
- CVE-2026-72311drm/xe: free madvise VMA array on L2 flush failureLinux
- CVE-2026-72309tracing/remotes: Fix leak in trace_remote_alloc_buffer() error pathLinux
- CVE-2026-72308mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()Linux
- CVE-2026-72307mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()Linux
- CVE-2026-72306vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iterLinux
- CVE-2026-72305VDUSE: avoid leaking information to userspaceLinux
- CVE-2026-72300ASoC: SOF: topology: validate vendor array size before parsingLinux
- CVE-2026-72293KVM: s390: vsie: Add missing radix_tree_preload() in _gaccess_shadow_fault()Linux
- CVE-2026-72292KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memoryLinux
- CVE-2026-72290KVM: s390: pci: Fix GISC refcount leak on AIF enable failureLinux
- CVE-2026-72281KVM: arm64: account pKVM reclaim against the VM mmLinux
- CVE-2026-72276fbdev: metronomefb: fix potential memory leak in metronomefb_probe()Linux
- CVE-2026-72275fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()Linux
- CVE-2026-72274fbdev: hecubafb: fix potential memory leak in hecubafb_probe()Linux
- CVE-2026-72273fbdev: efifb: fix memory leak in efifb_probe()Linux
- CVE-2026-72272fbdev: radeon: fix potential memory leak in radeonfb_pci_register()Linux
- CVE-2026-72271fbdev: i740fb: fix potential memory leak in i740fb_probe()Linux
- CVE-2026-72270fbdev: s3fb: fix potential memory leak in s3_pci_probe()Linux
- CVE-2026-72269fbdev: uvesafb: fix potential memory leak in uvesafb_probe()Linux
- CVE-2026-72268fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()Linux
- CVE-2026-72267fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()Linux
- CVE-2026-72266fbdev: vesafb: fix memory leak in vesafb_probe()Linux
- CVE-2026-72265fbdev: nvidia: fix potential memory leak in nvidiafb_probe()Linux
- CVE-2026-72264fbdev: tridentfb: fix potential memory leak in trident_pci_probe()Linux
- CVE-2026-72263ASoC: SOF: topology: fix memory leak in snd_sof_load_topologyLinux
- CVE-2026-72260ASoC: mediatek: mt8192: Check runtime resume during probeLinux
- CVE-2026-72259ASoC: mediatek: mt8192: Release reserved memory on cleanupLinux
- CVE-2026-72258ASoC: mediatek: mt8183: Release reserved memory on cleanupLinux
- CVE-2026-72257ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callbackLinux
- CVE-2026-72256netfilter: xt_cluster: reject template conntracks in hash matchLinux
- CVE-2026-72245gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error pathLinux
- CVE-2026-72241leds: uleds: Fix potential buffer overreadLinux
- CVE-2026-72240mfd: sm501: Fix reference leak on failed device registrationLinux
- CVE-2026-72238x86/boot: Validate console=uart8250 baud rate to fix early boot hangLinux
- CVE-2026-72237perf/x86/amd/brs: Fix kernel address leakageLinux
- CVE-2026-72236s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()Linux
- CVE-2026-72230batman-adv: frag: free unfragmentable packetLinux
- CVE-2026-72229batman-adv: clean untagged VLAN on netdev registration failureLinux
- CVE-2026-72228batman-adv: frag: fix primary_if leak on failed linearizationLinux
- CVE-2026-72224nvdimm/btt: Free arenas on btt_init() error pathsLinux
- CVE-2026-72223nvdimm/btt: Free arena sub-allocations on discover_arenas() error pathLinux
- CVE-2026-72219lockd: Plug nlm_file leak when nlm_do_fopen() failsLinux
- CVE-2026-72218lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failureLinux
- CVE-2026-72216remoteproc: qcom: Fix leak when custom dump_segments addition failsLinux
- CVE-2026-72215MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()Linux
- CVE-2026-72214power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leakLinux
- CVE-2026-72212mm/memory_hotplug: fix incorrect altmap passing in error pathLinux
- CVE-2026-72205ntfs: free volume-wide resources on fill_super failureLinux
- CVE-2026-72193ntfs3: cap RESTART_TABLE free-chain walker at rt->usedLinux
- CVE-2026-72190ntfs: fix mrec_lock ABBA deadlock in renameLinux
- CVE-2026-72189ntfs: fail attrlist updates when the superblock is inactiveLinux
- CVE-2026-72187ntfs: avoid self-deadlock during inode evictionLinux
- CVE-2026-72184ntfs: fix hole runlist memory leak in insert range error pathLinux
- CVE-2026-72182power: supply: charger-manager: fix refcount leak in is_full_charged()Linux
- CVE-2026-72180mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgradeLinux
- CVE-2026-72179riscv: cacheinfo: Fix node reference leak in populate_cache_leavesLinux
- CVE-2026-72178mm/damon/core: always put unsuccessfully committed target pidsLinux
- CVE-2026-72177mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()Linux
- CVE-2026-72176mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal errorLinux
- CVE-2026-72174fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()Linux
- CVE-2026-72173fs/proc/task_mmu: do not warn on seeing non-migration pmd entryLinux
- CVE-2026-72169kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTESLinux
- CVE-2026-72168mtd: maps: vmu-flash: fix fault in unaligned fixupLinux
- CVE-2026-72167mtd: rawnand: pl353: fix probe resource allocationLinux
- CVE-2026-72166net/9p: fix infinite loop in p9_client_rpc on fatal signalLinux
- CVE-2026-72163ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_creditsLinux
- CVE-2026-72161ocfs2: add journal NULL check in ocfs2_checkpoint_inode()Linux
- CVE-2026-72159ocfs2: reject non-inline dinodes with i_size and zero i_clustersLinux
- CVE-2026-72158fpga: dfl: add bounds check in dfh_get_param_size()Linux
- CVE-2026-72156fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()Linux
- CVE-2026-72155mtd: spi-nor: swp: Improve locking user experienceLinux
- CVE-2026-72153irqchip/crossbar: Use correct index in crossbar_domain_free()Linux
- CVE-2026-72152tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()Linux
- CVE-2026-72150sunrpc: fix uninitialized xprt_create_args structureLinux
- CVE-2026-72147dmaengine: dw-edma-pcie: Reject devices without driver dataLinux
- CVE-2026-72145platform/x86/intel/tpmi: use cleanup helpers in mem_write()Linux
- CVE-2026-72142i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)Linux
- CVE-2026-72140i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()Linux
- CVE-2026-72138xen/gntdev: fix error handling in ioctlLinux
- CVE-2026-72132NFS: Charge unstable writes by request size, not folio sizeLinux
- CVE-2026-72131nvme-apple: Prevent shared tags across queues on Apple A11Linux
- CVE-2026-72128nvmet: fix refcount leak in nvmet_sq_create()Linux
- CVE-2026-72127netdev-genl: report NAPI thread PID in the caller's pid namespaceLinux
- CVE-2026-72118can: bcm: fix CAN frame rx/tx statisticsLinux
- CVE-2026-72117can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()Linux
- CVE-2026-72106dm-ioctl: fix a possible overflow in list_version_get_infoLinux
- CVE-2026-72104dm-pcache: reject option groups without valuesLinux
- CVE-2026-72101dm-integrity: fix leaking uninitialized kernel memoryLinux
- CVE-2026-72097dm-verity: fix a possible NULL pointer dereferenceLinux
- CVE-2026-72096dm-verity: make error counter atomicLinux
- CVE-2026-72094dma-buf: dma-fence: Fix potential NULL pointer dereferenceLinux
- CVE-2026-72092accel/amdxdna: reject command submission on devices without a submit opLinux
- CVE-2026-72091accel/amdxdna: reject user command submission without a command BOLinux
- CVE-2026-72088scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset pathLinux
- CVE-2026-72087scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()Linux
- CVE-2026-72086scsi: xen: scsiback: Free the command tag on the TMR submit-failure pathLinux
- CVE-2026-72082scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()Linux
- CVE-2026-72081scsi: elx: efct: Fix I/O leak on unsupported additional CDBLinux
- CVE-2026-72079Input: ims-pcu - fix use-after-free and double-free in disconnectLinux
- CVE-2026-72078Input: ims-pcu - validate control endpoint typeLinux
- CVE-2026-72077Input: ims-pcu - fix firmware leak in async updateLinux
- CVE-2026-72076Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug loggingLinux
- CVE-2026-72075Input: ims-pcu - fix race condition in reset_device sysfs callbackLinux
- CVE-2026-72074Input: ims-pcu - fix type confusion in CDC union descriptor parsingLinux
- CVE-2026-72073mmc: vub300: fix use-after-free on probe failureLinux
- CVE-2026-72070wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()Linux
- CVE-2026-72068posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()Linux
- CVE-2026-72063gpio: tegra: do not call pinctrl for GPIO directionLinux
- CVE-2026-72062gpio: mt7621: avoid corruption of shared interrupt trigger stateLinux
- CVE-2026-72060net: ethernet: ti: icssg: guard PA stat lookupsLinux
- CVE-2026-72059net: wwan: t7xx: destroy DMA pool on CLDMA late init failureLinux
- CVE-2026-72058net: ixp4xx_hss: fix duplicate HDLC netdev allocationLinux
- CVE-2026-72056net: ena: clean up XDP TX queues when regular TX setup failsLinux
- CVE-2026-72050octeontx2-af: Free BPID bitmap on setup failureLinux
- CVE-2026-72048ieee802154: ca8210: fix cas_ctl leak on spi_async failureLinux
- CVE-2026-72047ieee802154: ca8210: fix pointer truncation in kfifo on 64-bitLinux
- CVE-2026-72040ipmi: fix refcount leak in i_ipmi_request()Linux
- CVE-2026-72039bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()Linux
- CVE-2026-72038net: liquidio: fix BAR resource leak on PF number failureLinux
- CVE-2026-72037net: lan743x: Initialize eth_syslock spinlock before useLinux
- CVE-2026-72032net/mlx5: HWS, fix matcher leak on resize target setup failureLinux
- CVE-2026-72031ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSDLinux
- CVE-2026-72030ata: libata-core: Reject an invalid concurrent positioning ranges countLinux
- CVE-2026-72028riscv: probes: save original sp in rethook trampolineLinux
- CVE-2026-72026irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failureLinux
- CVE-2026-72025s390/monwriter: Reject buffer reuse with different data lengthLinux
- CVE-2026-72023octeontx2-pf: fix SQB pointer leak on init failureLinux
- CVE-2026-72022llc: fix SAP refcount leak in llc_ui_autobind()Linux
- CVE-2026-72017net: macb: drop in-flight Tx SKBs on closeLinux
- CVE-2026-72016cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()Linux
- CVE-2026-72015fs/resctrl: Fix double-add of pseudo-locked region's RMID to free listLinux
- CVE-2026-72013riscv: Prevent NULL pointer dereference in machine_kexec_prepare()Linux
- CVE-2026-72011s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()Linux
- CVE-2026-72010cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowedLinux
- CVE-2026-72008pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-checkLinux
- CVE-2026-72007pmdomain: imx: Fix i.MX8MP VC8000E power up sequenceLinux
- CVE-2026-72006net/mlx5: free mlx5_st_idx_data on final deallocLinux
- CVE-2026-72004wifi: mac80211: fix memory leak in ieee80211_register_hw()Linux
- CVE-2026-68478memstick: ms_block: reject a card that reports too many blocksLinux
- CVE-2026-68475reset: sunxi: fix memory region leak on ioremap failureLinux
- CVE-2026-68469wifi: mwifiex: fix permanently busy scans after multiple roam iterationsLinux
- CVE-2026-68468mtd: virt-concat: free duplicate generated nameLinux
- CVE-2026-68465mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restoreLinux
- CVE-2026-68464mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interruptLinux
- CVE-2026-68463mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspendLinux
- CVE-2026-68460f2fs: fix potential deadlock in f2fs_balance_fs()Linux
- CVE-2026-68459f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()Linux
- CVE-2026-68456usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()Linux
- CVE-2026-68455liveupdate: validate session type before performing operationLinux
- CVE-2026-16146Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Valuesmatthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA A…
- CVE-2026-15948Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameterthemefic Hydra Booking — Appointment Scheduling & Booking C…
- CVE-2026-15453KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameteriqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2026-16094Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parametermatthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA A…
- CVE-2026-16586Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'contest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2026-15993Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE ClauseForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-17090Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameterbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2026-18387Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parametertrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2026-12128Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameterdotonpaper Pinpoint Booking System –
- CVE-2026-8840Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Actionwpdevart Booking calendar, Appointment Booking System
- CVE-2026-16080Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameterfishpie Image Uploader for Welcart