# CVEs published 2026-09-11

702 CVEs were published on September 11, 2026: 109 critical, 292 high. Days are UTC.

- [CVE-2026-89266](https://cve.now/CVE-2026-89266.md): stb\_vorbis through 1.22 heap buffer overflow via codebook multiplicands (CVSS 8.8, nothings stb\_vorbis)
- [CVE-2026-90457](https://cve.now/CVE-2026-90457.md): The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, a (CVSS 6.9, CISA Malcolm)
- [CVE-2026-90456](https://cve.now/CVE-2026-90456.md): Use of default credentials in Malcolm (CVSS 9.2, CISA Malcolm)
- [CVE-2026-90455](https://cve.now/CVE-2026-90455.md): Dependency on vulnerable third-party component in Malcolm (CVSS 6.3, CISA Malcolm)
- [CVE-2026-90454](https://cve.now/CVE-2026-90454.md): Missing authorization in Malcolm (CVSS 5.3, CISA Malcolm)
- [CVE-2026-90453](https://cve.now/CVE-2026-90453.md): Open Redirect in Malcolm (CVSS 5.1, CISA Malcolm)
- [CVE-2026-90452](https://cve.now/CVE-2026-90452.md): Improper certificate validation in Malcolm (CVSS 6.0, CISA Malcolm)
- [CVE-2026-90451](https://cve.now/CVE-2026-90451.md): Use of Default Credentials in Malcolm (CVSS 8.2, CISA Malcolm)
- [CVE-2026-90450](https://cve.now/CVE-2026-90450.md): Incorrect Authorization in Malcolm (CVSS 5.3, CISA Malcolm)
- [CVE-2026-90449](https://cve.now/CVE-2026-90449.md): Missing Authentication for Critical Function in Malcolm (CVSS 6.9, CISA Malcolm)
- [CVE-2026-90448](https://cve.now/CVE-2026-90448.md): Missing Authorization in Malcolm (CVSS 7.1, CISA Malcolm)
- [CVE-2026-90447](https://cve.now/CVE-2026-90447.md): Authentication Bypass by Spoofing in Malcolm (CVSS 7.1, CISA Malcolm)
- [CVE-2026-90446](https://cve.now/CVE-2026-90446.md): Server-Side Request Forgery in Malcolm (CVSS 5.3, CISA Malcolm)
- [CVE-2026-90445](https://cve.now/CVE-2026-90445.md): Path Traversal in Malcolm (CVSS 7.1, CISA Malcolm)
- [CVE-2026-90444](https://cve.now/CVE-2026-90444.md): OS Command Injection in Malcolm (CVSS 8.7, CISA Malcolm)
- [CVE-2026-90443](https://cve.now/CVE-2026-90443.md): Cross-site Scripting in Malcolm (CVSS 5.3, CISA Malcolm)
- [CVE-2026-90461](https://cve.now/CVE-2026-90461.md): OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) B (CVSS 6.3, OpenStack Ironic)
- [CVE-2026-54258](https://cve.now/CVE-2026-54258.md): Cross-monitor event media authorization bypass in direct event media endpoints (CVSS 6.5, zoneminder)
- [CVE-2026-49992](https://cve.now/CVE-2026-49992.md): Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes (CVSS 6.3, kimai · kimai/kimai)
- [CVE-2026-50018](https://cve.now/CVE-2026-50018.md): Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions (CVSS 6.5, SpectoLabs hoverfly · github.com/SpectoLabs/hoverfly)
- [CVE-2026-50013](https://cve.now/CVE-2026-50013.md): Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode (CVSS 7.5, SpectoLabs hoverfly · github.com/SpectoLabs/hoverfly)
- [CVE-2026-49846](https://cve.now/CVE-2026-49846.md): libks has path traversal in kws HTTP parser via URI segment overflow (CVSS 7.5, signalwire libks)
- [CVE-2026-54248](https://cve.now/CVE-2026-54248.md): Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration (CVSS 6.5, kimdre doco-cd)
- [CVE-2026-90460](https://cve.now/CVE-2026-90460.md): An issue was discovered in OpenStack Keystone before 29.0.3. (CVSS 7.6, OpenStack Keystone)
- [CVE-2026-54241](https://cve.now/CVE-2026-54241.md): libde265: SAO sequential filter heap buffer overflow via signed integer overflow (CVSS 7.4, strukturag libde265)
- [CVE-2026-54240](https://cve.now/CVE-2026-54240.md): libde265: Pixel accessor signed integer overflow causes heap OOB read/write (CVSS 7.4, strukturag libde265)
- [CVE-2026-44715](https://cve.now/CVE-2026-44715.md): OpenMRS has Broken Access Control in HL7 Configuration (CVSS 8.7, org.openmrs.module:legacyui-api)
- [CVE-2026-48496](https://cve.now/CVE-2026-48496.md): opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (CVSS 6.2, open-telemetry opentelemetry-ebpf-profiler · go.opentelemet…)
- [CVE-2026-45056](https://cve.now/CVE-2026-45056.md): Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution (CVSS 6.9, matrix-org matrix-rust-sdk · matrix-sdk-crypto)
- [CVE-2026-45057](https://cve.now/CVE-2026-45057.md): matrix-sdk-ui: Incomplete edit validation (CVSS 4.9, matrix-org matrix-sdk-ui · matrix-sdk-ui)
- [CVE-2026-49865](https://cve.now/CVE-2026-49865.md): Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-54166](https://cve.now/CVE-2026-54166.md): Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass (CVSS 7.1, Shelf-nu shelf.nu)
- [CVE-2026-54174](https://cve.now/CVE-2026-54174.md): melange: Incomplete package integrity verification allows data section substitution (CVSS 8.3, chainguard-dev melange · chainguard-dev apko +2)
- [CVE-2026-47773](https://cve.now/CVE-2026-47773.md): ArduinoBLE: Memory corruption via malformed ATT write request (CVSS 7.2, arduino-libraries ArduinoBLE)
- [CVE-2026-48490](https://cve.now/CVE-2026-48490.md): ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler (CVSS 6.9, ArduinoCore-avr)
- [CVE-2026-54165](https://cve.now/CVE-2026-54165.md): Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim) (CVSS 6.4, smgdkngt dobase)
- [CVE-2026-49439](https://cve.now/CVE-2026-49439.md): OpenRemote read-only asset users can write predicted datapoints (CVSS 4.3, openremote · io.openremote:openremote-manager)
- [CVE-2026-50025](https://cve.now/CVE-2026-50025.md): Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state (CVSS 6.9, t-mart mousehole)
- [CVE-2026-49464](https://cve.now/CVE-2026-49464.md): NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak (CVSS 8.1, nl-portal-backend-libraries · nl.nl-portal:taak)
- [CVE-2026-81907](https://cve.now/CVE-2026-81907.md): Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete\_entries allowing mass deletion of all entity records (CVSS 6.1, Concrete CMS)
- [CVE-2026-81918](https://cve.now/CVE-2026-81918.md): Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block (CVSS 4.8, Concrete CMS)
- [CVE-2026-81917](https://cve.now/CVE-2026-81917.md): Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags (CVSS 5.1, Concrete CMS)
- [CVE-2026-68535](https://cve.now/CVE-2026-68535.md): Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions (CVSS 5.1, Concrete CMS)
- [CVE-2026-81916](https://cve.now/CVE-2026-81916.md): Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object (CVSS 5.1, Concrete CMS)
- [CVE-2026-49462](https://cve.now/CVE-2026-49462.md): nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default (CVSS 5.3, nl.nl-portal:app)
- [CVE-2026-89773](https://cve.now/CVE-2026-89773.md): drm/amd/display: Skip Update HDCP Config In Transition State (no CVSS, Linux)
- [CVE-2026-89772](https://cve.now/CVE-2026-89772.md): btrfs: write-protect folios during data writeback (no CVSS, Linux)
- [CVE-2026-89771](https://cve.now/CVE-2026-89771.md): ring-buffer: Fix subbuf resize race with ring buffer readers (CVSS 7.8, Linux)
- [CVE-2026-89770](https://cve.now/CVE-2026-89770.md): iomap: don't free integrity payload that doesn't exist (no CVSS, Linux)
- [CVE-2026-89769](https://cve.now/CVE-2026-89769.md): clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp\_setup\_state error path (CVSS 7.4, Linux)
- [CVE-2026-89768](https://cve.now/CVE-2026-89768.md): fs: fix user path of nested backing files (no CVSS, Linux)
- [CVE-2026-89767](https://cve.now/CVE-2026-89767.md): ovl: fix double end\_creating() on the casefold-mismatch path (CVSS 7.8, Linux)
- [CVE-2026-89766](https://cve.now/CVE-2026-89766.md): pidfd: hold exec\_update\_lock around namespace ioctl (no CVSS, Linux)
- [CVE-2026-89765](https://cve.now/CVE-2026-89765.md): timers/itimer: Zero-init old itimerval before copy to userspace (no CVSS, Linux)
- [CVE-2026-89764](https://cve.now/CVE-2026-89764.md): rust: devres: fix race between concurrent revokers (CVSS 7.8, Linux)
- [CVE-2026-89763](https://cve.now/CVE-2026-89763.md): KEYS: trusted: Fix TPM teardown ordering (CVSS 7.8, Linux)
- [CVE-2026-89762](https://cve.now/CVE-2026-89762.md): apparmor: fix cred UAF caused by begin\_current\_label\_crit\_section() (CVSS 7.8, Linux)
- [CVE-2026-89761](https://cve.now/CVE-2026-89761.md): apparmor: fix out-of-bounds write when null terminating a label vec (CVSS 7.8, Linux)
- [CVE-2026-89760](https://cve.now/CVE-2026-89760.md): mm, swap: don't free a hibernation slot that is in the swap cache (CVSS 7.8, Linux)
- [CVE-2026-89759](https://cve.now/CVE-2026-89759.md): mm/kmemleak: avoid soft lockup when scanning task stacks (no CVSS, Linux)
- [CVE-2026-89758](https://cve.now/CVE-2026-89758.md): mm/mempolicy: skip non-present PMDs when queueing folios (CVSS 7.8, Linux)
- [CVE-2026-89757](https://cve.now/CVE-2026-89757.md): mm/mglru: fix and remove redundant unevictable folio handling (no CVSS, Linux)
- [CVE-2026-89756](https://cve.now/CVE-2026-89756.md): mm/migrate: report RCU-tasks quiescent states in migrate\_pages\_batch() (no CVSS, Linux)
- [CVE-2026-89755](https://cve.now/CVE-2026-89755.md): mm/migrate\_device: clear stale mapping after freeing swapcache (CVSS 7.8, Linux)
- [CVE-2026-89754](https://cve.now/CVE-2026-89754.md): mm/pagewalk: fix stale walk-\>action escaping walk\_pmd\_range() (CVSS 7.8, Linux)
- [CVE-2026-89753](https://cve.now/CVE-2026-89753.md): mm/vmscan: report RCU-tasks quiescent states in shrink\_lruvec() (no CVSS, Linux)
- [CVE-2026-89752](https://cve.now/CVE-2026-89752.md): mm: memcg: stop reclaim when a limit update is superseded (no CVSS, Linux)
- [CVE-2026-89751](https://cve.now/CVE-2026-89751.md): x86/tdx: Fix off-by-one in port I/O handling (no CVSS, Linux)
- [CVE-2026-89750](https://cve.now/CVE-2026-89750.md): tracing/user\_events: Clear copied tracing state before fork duplication (CVSS 7.8, Linux)
- [CVE-2026-89749](https://cve.now/CVE-2026-89749.md): tracing: Fix crash passing ERR\_PTR to kthread\_stop() (no CVSS, Linux)
- [CVE-2026-89748](https://cve.now/CVE-2026-89748.md): tracing: Fix retry exhaustion in simple ring buffer reader swap (CVSS 7.8, Linux)
- [CVE-2026-89747](https://cve.now/CVE-2026-89747.md): tracing: Fix use-after-free in trace\_pipe read on sub-buffer order change (CVSS 7.8, Linux)
- [CVE-2026-89746](https://cve.now/CVE-2026-89746.md): tracing: Fix use-after-free with same-name named triggers (CVSS 7.8, Linux)
- [CVE-2026-89745](https://cve.now/CVE-2026-89745.md): debugfs: Fix lockdown check for mmap\_prepare (no CVSS, Linux)
- [CVE-2026-89744](https://cve.now/CVE-2026-89744.md): device property: fix infinite loop in fwnode\_for\_each\_child\_node() (CVSS 8.4, Linux)
- [CVE-2026-89743](https://cve.now/CVE-2026-89743.md): misc: nsm: bound the device-reported response length (CVSS 7.7, Linux)
- [CVE-2026-89742](https://cve.now/CVE-2026-89742.md): rapidio: mport\_cdev: fix use-after-free in dma\_req\_free() (CVSS 7.8, Linux)
- [CVE-2026-89741](https://cve.now/CVE-2026-89741.md): Revert "media: v4l2-dev: fix error handling in \_\_video\_register\_device()" (CVSS 7.8, Linux)
- [CVE-2026-89740](https://cve.now/CVE-2026-89740.md): serial: imx: serialize imx\_uart\_ports\[\] lifetime (no CVSS, Linux)
- [CVE-2026-89739](https://cve.now/CVE-2026-89739.md): usb: dwc3: gadget: Fix use-after-free in dwc3\_gadget\_free\_endpoints due to race condition (no CVSS, Linux)
- [CVE-2026-89738](https://cve.now/CVE-2026-89738.md): usb: gadget: at91\_udc: drain polled-VBUS timer/work before udc is freed (CVSS 7.8, Linux)
- [CVE-2026-89737](https://cve.now/CVE-2026-89737.md): usb: typec: thunderbolt: Disable work before freeing tbt on remove (no CVSS, Linux)
- [CVE-2026-89736](https://cve.now/CVE-2026-89736.md): usb: gadget: u\_audio: Fix use-after-free on sound card disconnect (CVSS 7.8, Linux)
- [CVE-2026-89735](https://cve.now/CVE-2026-89735.md): usb: gadget: midi2: remove default configfs groups on teardown (no CVSS, Linux)
- [CVE-2026-89734](https://cve.now/CVE-2026-89734.md): usb: gadget: uvc: Fix null pointer dereference in uvcg\_video\_init() (no CVSS, Linux)
- [CVE-2026-89733](https://cve.now/CVE-2026-89733.md): usb: gadget: uvc: fix dangling pointers in uvc\_function\_bind() and uvc\_function\_unbind() (CVSS 7.8, Linux)
- [CVE-2026-89732](https://cve.now/CVE-2026-89732.md): usb: gadget: f\_fs: Prevent deadlock during ep0 read loop (no CVSS, Linux)
- [CVE-2026-89731](https://cve.now/CVE-2026-89731.md): cxl/ras: Fix cxl\_rch\_get\_aer\_info() out-of-bounds AER register read (CVSS 7.1, Linux)
- [CVE-2026-89730](https://cve.now/CVE-2026-89730.md): fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (no CVSS, Linux)
- [CVE-2026-89729](https://cve.now/CVE-2026-89729.md): HID: sensor-hub: Fix out-of-bounds write in sensor\_hub\_get\_feature (CVSS 8.8, Linux)
- [CVE-2026-89728](https://cve.now/CVE-2026-89728.md): i3c: renesas: Fix out-of-bounds access for newdevs mask (no CVSS, Linux)
- [CVE-2026-89727](https://cve.now/CVE-2026-89727.md): KVM: arm64: GICv2: Don't WARN on out-of-range GICV\_DIR INTID (no CVSS, Linux)
- [CVE-2026-89726](https://cve.now/CVE-2026-89726.md): lib/ucs2\_string.c: fix out-of-bounds read in ucs2\_strnlen() (no CVSS, Linux)
- [CVE-2026-89725](https://cve.now/CVE-2026-89725.md): media: cec: stm32: prevent out-of-bounds write on RX overflow (CVSS 8.8, Linux)
- [CVE-2026-89724](https://cve.now/CVE-2026-89724.md): media: vicodec: fix out-of-bounds write in FWHT encoder (CVSS 7.8, Linux)
- [CVE-2026-89723](https://cve.now/CVE-2026-89723.md): nilfs2: fix slab-out-of-bounds in nilfs\_direct\_propagate after truncation (CVSS 7.8, Linux)
- [CVE-2026-89722](https://cve.now/CVE-2026-89722.md): PCI/sysfs: Fix out-of-bounds read in pci\_write\_legacy\_io() (no CVSS, Linux)
- [CVE-2026-89721](https://cve.now/CVE-2026-89721.md): phy: rockchip-samsung-dcphy: fix out-of-range max\_register (no CVSS, Linux)
- [CVE-2026-89720](https://cve.now/CVE-2026-89720.md): ubifs: fix out-of-bounds read in signature length check (CVSS 7.7, Linux)
- [CVE-2026-89719](https://cve.now/CVE-2026-89719.md): zram: fix out-of-bounds access in read\_block\_state() (no CVSS, Linux)
- [CVE-2026-89718](https://cve.now/CVE-2026-89718.md): zram: fix out-of-bounds access in writeback\_store() (no CVSS, Linux)
- [CVE-2026-89717](https://cve.now/CVE-2026-89717.md): zram: set default primary compressor in zram\_destroy\_comps() (no CVSS, Linux)
- [CVE-2026-89716](https://cve.now/CVE-2026-89716.md): zram: validate deflate params (no CVSS, Linux)
- [CVE-2026-89715](https://cve.now/CVE-2026-89715.md): NFS/localio: fix ref leak on nfs\_uuid\_add\_file failure (no CVSS, Linux)
- [CVE-2026-89714](https://cve.now/CVE-2026-89714.md): NFS: fix delegation\_hash\_table leak when nfs4\_server\_common\_setup() fails (no CVSS, Linux)
- [CVE-2026-89713](https://cve.now/CVE-2026-89713.md): NFSD: check truncate permission under inode lock (CVSS 9.1, Linux)
- [CVE-2026-89712](https://cve.now/CVE-2026-89712.md): NFSD: restart ssc\_expire\_umount walk after dropping nfsd\_ssc\_lock (CVSS 9.8, Linux)
- [CVE-2026-89711](https://cve.now/CVE-2026-89711.md): NFSD: remove flawed WARN\_ON\_ONCE from nfsd\_mode\_check (CVSS 8.2, Linux)
- [CVE-2026-89710](https://cve.now/CVE-2026-89710.md): NFSv4.1: fix layout segment leak on the pnfs\_layout\_process() forget path (no CVSS, Linux)
- [CVE-2026-89709](https://cve.now/CVE-2026-89709.md): lockd, nfsd: RCU-protect nlmsvc\_ops dispatch (CVSS 8.1, Linux)
- [CVE-2026-89708](https://cve.now/CVE-2026-89708.md): nfsd: RCU-protect cl\_cb\_session to fix use-after-free on session teardown (CVSS 9.8, Linux)
- [CVE-2026-89707](https://cve.now/CVE-2026-89707.md): nfsd: release path refs on follow\_down() error (CVSS 7.5, Linux)
- [CVE-2026-89706](https://cve.now/CVE-2026-89706.md): nfsd: Reset write verifier when async COPY writeback fails (CVSS 7.5, Linux)
- [CVE-2026-89705](https://cve.now/CVE-2026-89705.md): nfsd: restore rq\_status\_counter to even on all nfsd\_dispatch() exit paths (CVSS 7.1, Linux)
- [CVE-2026-89704](https://cve.now/CVE-2026-89704.md): nfsd: sample writeback error cursor before async COPY loop (CVSS 7.5, Linux)
- [CVE-2026-89703](https://cve.now/CVE-2026-89703.md): nfsd: set SC\_STATUS\_FREED in nfsd4\_drop\_revoked\_stid for delegations (CVSS 9.8, Linux)
- [CVE-2026-89702](https://cve.now/CVE-2026-89702.md): nfsd: size fh\_verify server sockaddr slot by xpt\_locallen (CVSS 9.8, Linux)
- [CVE-2026-89701](https://cve.now/CVE-2026-89701.md): nfsd: validate nseconds in TIME\_DELEG decode paths (no CVSS, Linux)
- [CVE-2026-89700](https://cve.now/CVE-2026-89700.md): nfsd: validate sockaddr length per family in listener\_set (no CVSS, Linux)
- [CVE-2026-89699](https://cve.now/CVE-2026-89699.md): nfsd: validate symlink target length in NFSv4 CREATE (CVSS 7.5, Linux)
- [CVE-2026-89698](https://cve.now/CVE-2026-89698.md): nfsd: widen nfsd\_genl\_rqstp address fields to sockaddr\_storage (no CVSS, Linux)
- [CVE-2026-89697](https://cve.now/CVE-2026-89697.md): nfsd: add fh\_want\_write() for early-verified SETATTR in nfsd\_proc\_setattr() (CVSS 9.1, Linux)
- [CVE-2026-89696](https://cve.now/CVE-2026-89696.md): nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVSS 7.5, Linux)
- [CVE-2026-89695](https://cve.now/CVE-2026-89695.md): nfsd: cap decoded POSIX ACL count to bound sort cost (CVSS 7.5, Linux)
- [CVE-2026-89694](https://cve.now/CVE-2026-89694.md): nfsd: check client ownership when cancelling a copy-notify stateid (no CVSS, Linux)
- [CVE-2026-89693](https://cve.now/CVE-2026-89693.md): nfsd: check nfsd4\_acl\_to\_attr() return value in nfsd4\_create() (no CVSS, Linux)
- [CVE-2026-89692](https://cve.now/CVE-2026-89692.md): nfsd: clear CALLBACK\_RUNNING on failed delegation recall queue (CVSS 7.5, Linux)
- [CVE-2026-89691](https://cve.now/CVE-2026-89691.md): nfsd: clear opcnt on compound arg release to prevent OOB read (CVSS 7.1, Linux)
- [CVE-2026-89690](https://cve.now/CVE-2026-89690.md): nfsd: defer vfree of compound ops to fix rpc\_status UAF (CVSS 7.8, Linux)
- [CVE-2026-89689](https://cve.now/CVE-2026-89689.md): nfsd: don't free session slots that are still in use (CVSS 9.8, Linux)
- [CVE-2026-89688](https://cve.now/CVE-2026-89688.md): nfsd: drop the stateid, not the stateowner, on seqid\_op replay retry (CVSS 9.8, Linux)
- [CVE-2026-89687](https://cve.now/CVE-2026-89687.md): nfsd: ensure nfsd\_file\_do\_acquire() does not use a non-opened file (CVSS 7.5, Linux)
- [CVE-2026-89686](https://cve.now/CVE-2026-89686.md): nfsd: fix BUG\_ON in nfsd4\_alloc\_layout\_stateid on racing delegation revoke (CVSS 9.8, Linux)
- [CVE-2026-89685](https://cve.now/CVE-2026-89685.md): nfsd: fix clock domain mismatch in clients\_still\_reclaiming() (CVSS 7.5, Linux)
- [CVE-2026-89684](https://cve.now/CVE-2026-89684.md): nfsd: fix cpntf publish race in nfs4\_init\_cp\_state (CVSS 7.5, Linux)
- [CVE-2026-89683](https://cve.now/CVE-2026-89683.md): nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (no CVSS, Linux)
- [CVE-2026-89682](https://cve.now/CVE-2026-89682.md): nfsd: fix fcache\_disposal UAF by inlining dispose state into nfsd\_net (CVSS 8.1, Linux)
- [CVE-2026-89681](https://cve.now/CVE-2026-89681.md): nfsd: fix layout fence worker double-reference race (CVSS 9.8, Linux)
- [CVE-2026-89680](https://cve.now/CVE-2026-89680.md): nfsd: fix nfsd\_file leak on inter-server COPY setup failure (CVSS 7.5, Linux)
- [CVE-2026-89679](https://cve.now/CVE-2026-89679.md): nfsd: fix null dereference in nfsd4\_setattr for deleg timestamp attrs (CVSS 7.5, Linux)
- [CVE-2026-89678](https://cve.now/CVE-2026-89678.md): nfsd: fix partial-write detection in nfsd\_direct\_write (CVSS 7.5, Linux)
- [CVE-2026-89677](https://cve.now/CVE-2026-89677.md): nfsd: fix possible fh\_compose of wrong dentry in nfsd4\_create\_file() (CVSS 9.8, Linux)
- [CVE-2026-89676](https://cve.now/CVE-2026-89676.md): nfsd: fix stale s2s\_cp\_stateids IDR entry for async COPY (CVSS 9.8, Linux)
- [CVE-2026-89675](https://cve.now/CVE-2026-89675.md): nfsd: fix UAF in async copy cancel and shutdown (CVSS 9.8, Linux)
- [CVE-2026-89674](https://cve.now/CVE-2026-89674.md): nfsd: fix XDR length calculation in nfsd4\_ff\_encode\_layoutget (CVSS 9.8, Linux)
- [CVE-2026-89673](https://cve.now/CVE-2026-89673.md): nfsd: fix XDR padding calculation in ff\_encode\_getdeviceinfo (no CVSS, Linux)
- [CVE-2026-89672](https://cve.now/CVE-2026-89672.md): nfsd: gate nfs2 setacl by argp-\>mask (CVSS 9.1, Linux)
- [CVE-2026-89671](https://cve.now/CVE-2026-89671.md): nfsd: gate nfs3 setacl by argp-\>mask (CVSS 9.1, Linux)
- [CVE-2026-89670](https://cve.now/CVE-2026-89670.md): nfsd: hold rcu across localio cmpxchg retry (CVSS 7.8, Linux)
- [CVE-2026-89669](https://cve.now/CVE-2026-89669.md): nfsd: initialize copy-notify stateid before publishing it (CVSS 9.8, Linux)
- [CVE-2026-89668](https://cve.now/CVE-2026-89668.md): nfsd: move nfsd\_debugfs\_init() after nfsd4\_init\_slabs() in init\_nfsd() (CVSS 7.8, Linux)
- [CVE-2026-89667](https://cve.now/CVE-2026-89667.md): nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache (CVSS 8.1, Linux)
- [CVE-2026-89666](https://cve.now/CVE-2026-89666.md): nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops (no CVSS, Linux)
- [CVE-2026-89665](https://cve.now/CVE-2026-89665.md): nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (CVSS 8.2, Linux)
- [CVE-2026-89664](https://cve.now/CVE-2026-89664.md): nfsd: release OPEN-decoded posix ACLs via op\_release (CVSS 7.5, Linux)
- [CVE-2026-89663](https://cve.now/CVE-2026-89663.md): nfsd: revoke copy-notify stateids before dropping their reference (CVSS 8.8, Linux)
- [CVE-2026-89662](https://cve.now/CVE-2026-89662.md): NFSD: Prevent lock owner use-after-free during client teardown (CVSS 9.8, Linux)
- [CVE-2026-89661](https://cve.now/CVE-2026-89661.md): NFSD: Prevent post-shutdown use-after-free in unlock\_filesystem (no CVSS, Linux)
- [CVE-2026-89660](https://cve.now/CVE-2026-89660.md): NFSD: Prevent client use-after-free during admin state revocation (CVSS 9.8, Linux)
- [CVE-2026-89659](https://cve.now/CVE-2026-89659.md): NFSD: Prevent client use-after-free during delegation revoke (CVSS 9.8, Linux)
- [CVE-2026-89658](https://cve.now/CVE-2026-89658.md): NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (CVSS 9.8, Linux)
- [CVE-2026-89657](https://cve.now/CVE-2026-89657.md): libceph: validate OSD extent maps before cursor advance (CVSS 7.5, Linux)
- [CVE-2026-89656](https://cve.now/CVE-2026-89656.md): libceph: reject buckets with mismatched CRUSH ids (CVSS 9.8, Linux)
- [CVE-2026-89655](https://cve.now/CVE-2026-89655.md): ceph: fix UAF in \_\_kick\_flushing\_caps() on cf entry freed during unlock (CVSS 9.8, Linux)
- [CVE-2026-89654](https://cve.now/CVE-2026-89654.md): ceph: fix UAF in check\_new\_map() on session freed during unlock (CVSS 9.8, Linux)
- [CVE-2026-89653](https://cve.now/CVE-2026-89653.md): ceph: reject export\_targets ranks \>= CEPH\_MAX\_MDS in mdsmap decode (CVSS 9.8, Linux)
- [CVE-2026-89652](https://cve.now/CVE-2026-89652.md): ceph: bound copied dentry name length in NFS export get\_name (CVSS 9.8, Linux)
- [CVE-2026-89651](https://cve.now/CVE-2026-89651.md): ceph: bound MDSCapAuth path and fs\_name decode in handle\_session() (CVSS 9.8, Linux)
- [CVE-2026-89650](https://cve.now/CVE-2026-89650.md): ceph: bound num\_export\_targets array for mds info v2/v3 (CVSS 9.1, Linux)
- [CVE-2026-89649](https://cve.now/CVE-2026-89649.md): ceph: bound xattr value length in \_\_build\_xattrs() (CVSS 9.1, Linux)
- [CVE-2026-89648](https://cve.now/CVE-2026-89648.md): ceph: cap delegated inode count in ceph\_parse\_deleg\_inos() (CVSS 7.5, Linux)
- [CVE-2026-89647](https://cve.now/CVE-2026-89647.md): ceph: do not repeat ceph\_trim\_dentries() if no progress possible (CVSS 7.5, Linux)
- [CVE-2026-89646](https://cve.now/CVE-2026-89646.md): ceph: fix leaked inode reference on writeback abort at umount (CVSS 7.8, Linux)
- [CVE-2026-89645](https://cve.now/CVE-2026-89645.md): btrfs: drop recovered reloc root refs on recovery failure (no CVSS, Linux)
- [CVE-2026-89644](https://cve.now/CVE-2026-89644.md): btrfs: fix extent map leak in NOCOW direct I/O write (no CVSS, Linux)
- [CVE-2026-89643](https://cve.now/CVE-2026-89643.md): audit: avoid dropping live tree ref on fsnotify rule autoremove (CVSS 9.8, Linux)
- [CVE-2026-89642](https://cve.now/CVE-2026-89642.md): cifs: call pagecache\_isize\_extended() in cifs\_setsize() when extending (no CVSS, Linux)
- [CVE-2026-89641](https://cve.now/CVE-2026-89641.md): cifs: clear tcon after cifsFileInfo\_put() in cifs\_file\_set\_size() (CVSS 7.8, Linux)
- [CVE-2026-89640](https://cve.now/CVE-2026-89640.md): cifs: fix loff\_t underflow in cifs\_remap\_file\_range() when len == 0 (CVSS 7.1, Linux)
- [CVE-2026-89639](https://cve.now/CVE-2026-89639.md): cifs: use cifs\_invalidate\_cache() in cifs\_do\_truncate() for O\_TRUNC (CVSS 7.1, Linux)
- [CVE-2026-89638](https://cve.now/CVE-2026-89638.md): smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVSS 7.8, Linux)
- [CVE-2026-89637](https://cve.now/CVE-2026-89637.md): smb: client: fix UAF and buffer leak in cifs\_check\_trans2() for malformed secondary T2 (CVSS 9.8, Linux)
- [CVE-2026-89636](https://cve.now/CVE-2026-89636.md): smb: client: clear ce-\>tgthint in free\_tgts() (CVSS 9.8, Linux)
- [CVE-2026-89635](https://cve.now/CVE-2026-89635.md): ksmbd: only rebind the reopened file's own oplock on durable reconnect (CVSS 9.8, Linux)
- [CVE-2026-89634](https://cve.now/CVE-2026-89634.md): smb: client: fix ALIGN() overflow in symlink\_data() error context loop (CVSS 9.1, Linux)
- [CVE-2026-89633](https://cve.now/CVE-2026-89633.md): smb: client: fix OOB read/write from unvalidated DataOffset in coalesce\_t2() (CVSS 9.8, Linux)
- [CVE-2026-89632](https://cve.now/CVE-2026-89632.md): smb: client: fix use-before-check of ReparseDataLength in reparse\_buf\_ptr() (CVSS 8.2, Linux)
- [CVE-2026-89631](https://cve.now/CVE-2026-89631.md): smb: client: reject a tree connect response whose byte count is too small (CVSS 9.1, Linux)
- [CVE-2026-89630](https://cve.now/CVE-2026-89630.md): smb: client: restore the data\_offset bound in is\_valid\_oplock\_break() (CVSS 9.1, Linux)
- [CVE-2026-89629](https://cve.now/CVE-2026-89629.md): HID: corsair-void: Check size of status and firmware events before reading them (no CVSS, Linux)
- [CVE-2026-89628](https://cve.now/CVE-2026-89628.md): HID: picolcd: clamp eeprom debugfs read to bytes actually received (no CVSS, Linux)
- [CVE-2026-89627](https://cve.now/CVE-2026-89627.md): HID: roccat: free buffered reports when destroying device (no CVSS, Linux)
- [CVE-2026-89626](https://cve.now/CVE-2026-89626.md): HID: sensor: custom: Fix field sysfs group cleanup on failure (CVSS 8.8, Linux)
- [CVE-2026-89625](https://cve.now/CVE-2026-89625.md): HID: sony: fix UAF of ghl\_poke\_timer / ghl\_urb at driver unbind (no CVSS, Linux)
- [CVE-2026-89624](https://cve.now/CVE-2026-89624.md): HID: universal-pidff: stop the device when force-feedback init fails (CVSS 7.8, Linux)
- [CVE-2026-89623](https://cve.now/CVE-2026-89623.md): HID: mcp2221: stop device IO before hid\_hw\_stop (no CVSS, Linux)
- [CVE-2026-89622](https://cve.now/CVE-2026-89622.md): HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (CVSS 7.8, Linux)
- [CVE-2026-89621](https://cve.now/CVE-2026-89621.md): HID: mcp2221: validate report size in mcp2221\_raw\_event() (no CVSS, Linux)
- [CVE-2026-89620](https://cve.now/CVE-2026-89620.md): HID: intel-thc-hid: intel-quickspi: validate report size before copy (CVSS 7.8, Linux)
- [CVE-2026-89619](https://cve.now/CVE-2026-89619.md): HID: intel-thc-hid: intel-quickspi: bound GET\_REPORT response to the caller buffer (CVSS 7.8, Linux)
- [CVE-2026-89618](https://cve.now/CVE-2026-89618.md): eventfs: Initialize ei-\>children and ei-\>list in init\_ei() (no CVSS, Linux)
- [CVE-2026-89617](https://cve.now/CVE-2026-89617.md): fs/ntfs3: validate dirty page table on log replay (CVSS 7.8, Linux)
- [CVE-2026-89616](https://cve.now/CVE-2026-89616.md): fs/ntfs3: fix info-leak on partial LZNT decompress in ni\_read\_frame() (CVSS 7.5, Linux)
- [CVE-2026-89615](https://cve.now/CVE-2026-89615.md): fs/ntfs3: bound page\_lcns\[\] index by the log record (CVSS 8.4, Linux)
- [CVE-2026-89614](https://cve.now/CVE-2026-89614.md): ntfs: bound the free-cluster bitmap scan to the volume (CVSS 9.8, Linux)
- [CVE-2026-89613](https://cve.now/CVE-2026-89613.md): ntfs: reject invalid empty mapping pairs (CVSS 9.8, Linux)
- [CVE-2026-89612](https://cve.now/CVE-2026-89612.md): ntfs: reject invalid MFT LCNs from boot sector (CVSS 9.8, Linux)
- [CVE-2026-89611](https://cve.now/CVE-2026-89611.md): ntfs: validate non-resident attribute offsets (CVSS 9.8, Linux)
- [CVE-2026-89610](https://cve.now/CVE-2026-89610.md): ntfs: verify run length exceeding volume boundary (CVSS 9.8, Linux)
- [CVE-2026-89609](https://cve.now/CVE-2026-89609.md): ecryptfs: hold msg ctx list lock when cleaning daemon queue (CVSS 7.8, Linux)
- [CVE-2026-89608](https://cve.now/CVE-2026-89608.md): ecryptfs: pass packet set buffer size to parser (CVSS 7.1, Linux)
- [CVE-2026-89607](https://cve.now/CVE-2026-89607.md): ecryptfs: reject oversized encrypted\_key\_size in parse\_tag\_3\_packet (CVSS 7.8, Linux)
- [CVE-2026-89606](https://cve.now/CVE-2026-89606.md): ecryptfs: reject too-small tag 70 packets (CVSS 7.8, Linux)
- [CVE-2026-89605](https://cve.now/CVE-2026-89605.md): ecryptfs: release message context on send failure (CVSS 7.8, Linux)
- [CVE-2026-89604](https://cve.now/CVE-2026-89604.md): efivarfs: Rate limit statfs() handler (no CVSS, Linux)
- [CVE-2026-89602](https://cve.now/CVE-2026-89602.md): erofs: skip sufficiently large global buffers when resizing (CVSS 7.8, Linux)
- [CVE-2026-89601](https://cve.now/CVE-2026-89601.md): ext2: Fix lost inode updates for IS\_SYNC inodes (CVSS 8.8, Linux)
- [CVE-2026-89600](https://cve.now/CVE-2026-89600.md): fanotify: fix use-after-free of file range info (CVSS 7.8, Linux)
- [CVE-2026-89599](https://cve.now/CVE-2026-89599.md): fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (CVSS 8.4, Linux)
- [CVE-2026-89598](https://cve.now/CVE-2026-89598.md): fbdev: ssd1307fb: defer I2C transfers from damage callbacks (no CVSS, Linux)
- [CVE-2026-89597](https://cve.now/CVE-2026-89597.md): fbdev: uvesafb: unregister connector callback on init failure (CVSS 7.8, Linux)
- [CVE-2026-89596](https://cve.now/CVE-2026-89596.md): forcedeth: fix off-by-one when saving/restoring non-PCI config space (CVSS 7.1, Linux)
- [CVE-2026-89595](https://cve.now/CVE-2026-89595.md): fsnotify: Fix stale object mask after concurrent mark updates (no CVSS, Linux)
- [CVE-2026-89594](https://cve.now/CVE-2026-89594.md): hsi: omap\_ssi\_core: fix missing DMA mask setup for SSI controller device (CVSS 7.8, Linux)
- [CVE-2026-89593](https://cve.now/CVE-2026-89593.md): hugetlb: only adjust reservation during unmapping if mapcount is 0 (CVSS 7.1, Linux)
- [CVE-2026-89592](https://cve.now/CVE-2026-89592.md): accel/rocket: fix NULL dereference and integer overflow in rocket\_job\_push() (no CVSS, Linux)
- [CVE-2026-89591](https://cve.now/CVE-2026-89591.md): accel/rocket: initialize job domain before cleanup paths (no CVSS, Linux)
- [CVE-2026-89590](https://cve.now/CVE-2026-89590.md): accel/rocket: Fix error path handling in rocket\_job\_run() (no CVSS, Linux)
- [CVE-2026-89589](https://cve.now/CVE-2026-89589.md): acpi/apei/ghes: Use raw\_spinlock\_t for CXL CPER work locks (no CVSS, Linux)
- [CVE-2026-89588](https://cve.now/CVE-2026-89588.md): ACPI: APEI: GHES: fix ARM section length accounting after header (CVSS 8.4, Linux)
- [CVE-2026-89587](https://cve.now/CVE-2026-89587.md): ACPI: pfr\_update: fix stack buffer overflow in query\_capability() (CVSS 7.8, Linux)
- [CVE-2026-89586](https://cve.now/CVE-2026-89586.md): ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (CVSS 8.2, Linux)
- [CVE-2026-89585](https://cve.now/CVE-2026-89585.md): auxdisplay: charlcd: cancel backlight work on registration failure (CVSS 7.8, Linux)
- [CVE-2026-89584](https://cve.now/CVE-2026-89584.md): block: validate user space vectors during extraction (CVSS 7.8, Linux)
- [CVE-2026-89583](https://cve.now/CVE-2026-89583.md): Bluetooth: eir: Fix OOB read in eir\_get\_service\_data() (CVSS 8.1, Linux)
- [CVE-2026-89582](https://cve.now/CVE-2026-89582.md): bnx2x: fix double free in bnx2x\_init\_firmware() error path (no CVSS, Linux)
- [CVE-2026-89581](https://cve.now/CVE-2026-89581.md): bpf, x86: Fix per-CPU address resolution into an extended register (CVSS 7.8, Linux)
- [CVE-2026-89580](https://cve.now/CVE-2026-89580.md): bpf: Disable preemption in \_\_bpf\_get\_stack (CVSS 7.8, Linux)
- [CVE-2026-89579](https://cve.now/CVE-2026-89579.md): bpf: Harden bloom filter sizing and indexing on 32-bit kernels (CVSS 7.8, Linux)
- [CVE-2026-89578](https://cve.now/CVE-2026-89578.md): dm-io: clone the source bio instead of copying its biovec (no CVSS, Linux)
- [CVE-2026-89577](https://cve.now/CVE-2026-89577.md): dm-io: report non-retryable errors separatedly (no CVSS, Linux)
- [CVE-2026-89576](https://cve.now/CVE-2026-89576.md): dm-era: fix shadowed superblock leak on take-snap failure (no CVSS, Linux)
- [CVE-2026-89575](https://cve.now/CVE-2026-89575.md): dm raid1: reserve space for NUL-terminator in build\_constructor\_string() (no CVSS, Linux)
- [CVE-2026-89574](https://cve.now/CVE-2026-89574.md): dm array: validate array block headers on read (CVSS 7.8, Linux)
- [CVE-2026-89573](https://cve.now/CVE-2026-89573.md): dm array: reject an array block whose value size is not the caller's (CVSS 7.8, Linux)
- [CVE-2026-89572](https://cve.now/CVE-2026-89572.md): cpufreq: apple-soc: Fix OPP table cleanup (no CVSS, Linux)
- [CVE-2026-89571](https://cve.now/CVE-2026-89571.md): cxl/features: bound fwctl command payload to the input buffer (CVSS 7.1, Linux)
- [CVE-2026-54135](https://cve.now/CVE-2026-54135.md): AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server (CVSS 7.5, SimulPiscator AirSane)
- [CVE-2026-89570](https://cve.now/CVE-2026-89570.md): cxl/mce: Make the MCE notifier per-region (CVSS 7.8, Linux)
- [CVE-2026-89569](https://cve.now/CVE-2026-89569.md): Bluetooth: RFCOMM: serialize security confirmation handling (CVSS 8.8, Linux)
- [CVE-2026-89568](https://cve.now/CVE-2026-89568.md): kho: fix size calculation in kho\_preserved\_memory\_reserve() (no CVSS, Linux)
- [CVE-2026-89567](https://cve.now/CVE-2026-89567.md): jbd2: bound shrinker scans by examined checkpoint buffers (no CVSS, Linux)
- [CVE-2026-89566](https://cve.now/CVE-2026-89566.md): jbd2: check need\_resched() when skipping busy checkpoint buffers (no CVSS, Linux)
- [CVE-2026-89565](https://cve.now/CVE-2026-89565.md): ipip: fix skb leak in collect\_md mode when metadata\_dst allocation fails (no CVSS, Linux)
- [CVE-2026-89564](https://cve.now/CVE-2026-89564.md): ip: orphan prefetched skbs before multicast forwarding (CVSS 7.8, Linux)
- [CVE-2026-89563](https://cve.now/CVE-2026-89563.md): ip6\_tunnel: use skb\_cow\_head() in ip6\_tnl\_xmit() (CVSS 7.8, Linux)
- [CVE-2026-89562](https://cve.now/CVE-2026-89562.md): ip6\_gre: fix hardware header length for NBMA tunnels (CVSS 7.8, Linux)
- [CVE-2026-89561](https://cve.now/CVE-2026-89561.md): ipv6: rpl: fix NULL dereference of idev in ipv6\_rpl\_srh\_rcv() (CVSS 7.5, Linux)
- [CVE-2026-89560](https://cve.now/CVE-2026-89560.md): landlock: Require LANDLOCK\_ACCESS\_FS\_MAKE\_REG for whiteout creation (CVSS 8.4, Linux)
- [CVE-2026-89559](https://cve.now/CVE-2026-89559.md): libnvdimm/labels: Prevent integer overflow in \_\_nd\_label\_validate() (CVSS 7.8, Linux)
- [CVE-2026-89558](https://cve.now/CVE-2026-89558.md): md/raid10: fix still\_degraded being inverted in raid10\_sync\_request() (CVSS 9.8, Linux)
- [CVE-2026-89557](https://cve.now/CVE-2026-89557.md): md: do overflow check for sb-\>bblog\_shift in super\_1\_load() (CVSS 7.8, Linux)
- [CVE-2026-89556](https://cve.now/CVE-2026-89556.md): module: validate string table section types (no CVSS, Linux)
- [CVE-2026-89555](https://cve.now/CVE-2026-89555.md): mpls: reload header after pskb\_may\_pull() (CVSS 9.8, Linux)
- [CVE-2026-89554](https://cve.now/CVE-2026-89554.md): mptcp: fix uninitialized local\_id in syncookie MP\_JOIN reconstruction (CVSS 8.2, Linux)
- [CVE-2026-89553](https://cve.now/CVE-2026-89553.md): nouveau/gem: reserve the bo in the info ioctl around the vma lookup (CVSS 7.8, Linux)
- [CVE-2026-89552](https://cve.now/CVE-2026-89552.md): params: fix charp corruption on allocation failure (no CVSS, Linux)
- [CVE-2026-89551](https://cve.now/CVE-2026-89551.md): SUNRPC: xdr\_buf\_trim: clamp buf-\>len to avoid underflow (CVSS 9.8, Linux)
- [CVE-2026-89550](https://cve.now/CVE-2026-89550.md): SUNRPC: svcauth\_gss: enforce krb5 token minimum length (CVSS 9.8, Linux)
- [CVE-2026-89549](https://cve.now/CVE-2026-89549.md): sunrpc: route to a populated pool in svc\_pool\_for\_cpu() (CVSS 7.5, Linux)
- [CVE-2026-89548](https://cve.now/CVE-2026-89548.md): SUNRPC: always drain cache\_cleaner before destroying a cache\_detail (CVSS 7.8, Linux)
- [CVE-2026-89547](https://cve.now/CVE-2026-89547.md): SUNRPC: Check svc pool percpu counter allocation (CVSS 8.1, Linux)
- [CVE-2026-89546](https://cve.now/CVE-2026-89546.md): SUNRPC: close backchannel before destroying callback service (CVSS 9.8, Linux)
- [CVE-2026-89545](https://cve.now/CVE-2026-89545.md): sunrpc: defer rq\_argp and rq\_resp free until after RCU grace period (CVSS 7.8, Linux)
- [CVE-2026-89544](https://cve.now/CVE-2026-89544.md): SUNRPC: fix gssx\_dec\_option\_array error path bugs (CVSS 7.5, Linux)
- [CVE-2026-89543](https://cve.now/CVE-2026-89543.md): sunrpc: fix use-after-free in \_\_rpc\_clnt\_handle\_event and \_\_rpc\_clnt\_remove\_pipedir (no CVSS, Linux)
- [CVE-2026-89542](https://cve.now/CVE-2026-89542.md): SUNRPC: harden gss\_krb5\_unwrap\_v2 against short tokens (CVSS 9.8, Linux)
- [CVE-2026-89541](https://cve.now/CVE-2026-89541.md): SUNRPC: harden gss\_unwrap\_resp\_priv length checks (CVSS 9.8, Linux)
- [CVE-2026-89540](https://cve.now/CVE-2026-89540.md): sunrpc: init gssp\_lock before publishing proc entry (CVSS 7.8, Linux)
- [CVE-2026-89539](https://cve.now/CVE-2026-89539.md): SUNRPC: reject duplicate CREDS\_VALUE options (no CVSS, Linux)
- [CVE-2026-89538](https://cve.now/CVE-2026-89538.md): SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVSS 9.8, Linux)
- [CVE-2026-89537](https://cve.now/CVE-2026-89537.md): SUNRPC: Reject short RFC 4121 MIC tokens in gss\_krb5\_verify\_mic\_v2 (CVSS 9.1, Linux)
- [CVE-2026-89536](https://cve.now/CVE-2026-89536.md): SUNRPC: wait for in-flight client TLS handshake callback (CVSS 9.8, Linux)
- [CVE-2026-89535](https://cve.now/CVE-2026-89535.md): svcrdma: Reorder rpcrdma\_rn\_unregister before rdma\_destroy\_id (CVSS 8.1, Linux)
- [CVE-2026-89534](https://cve.now/CVE-2026-89534.md): svcrdma: Clear sc\_cm\_id when ADDR\_CHANGE replacement fails (CVSS 8.8, Linux)
- [CVE-2026-89533](https://cve.now/CVE-2026-89533.md): svcrdma: Fix offset arithmetic in read\_chunk\_range (CVSS 9.8, Linux)
- [CVE-2026-89532](https://cve.now/CVE-2026-89532.md): svcrdma: Fix pcl\_for\_each\_segment for empty chunks (CVSS 9.1, Linux)
- [CVE-2026-89531](https://cve.now/CVE-2026-89531.md): svcrdma: Reject connection when transport allocation fails (no CVSS, Linux)
- [CVE-2026-89530](https://cve.now/CVE-2026-89530.md): svcrdma: Reject inline replies that overflow the pull-up buffer (CVSS 9.8, Linux)
- [CVE-2026-89529](https://cve.now/CVE-2026-89529.md): svcrdma: Reject oversized Read segments at decode time (no CVSS, Linux)
- [CVE-2026-89528](https://cve.now/CVE-2026-89528.md): svcrdma: Reject Read lists that exceed the page budget (CVSS 7.5, Linux)
- [CVE-2026-89527](https://cve.now/CVE-2026-89527.md): svcrdma: Use svc\_xprt\_put to free listener on create failure (no CVSS, Linux)
- [CVE-2026-89526](https://cve.now/CVE-2026-89526.md): svcrdma: Validate Read chunk positions before reconstruction (CVSS 9.8, Linux)
- [CVE-2026-89525](https://cve.now/CVE-2026-89525.md): udf: reject VAT indexes equal to the entry count (no CVSS, Linux)
- [CVE-2026-89524](https://cve.now/CVE-2026-89524.md): wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (CVSS 8.1, Linux)
- [CVE-2026-89523](https://cve.now/CVE-2026-89523.md): wifi: mt76: mt7925: cancel pending mlo\_pm\_work (CVSS 7.8, Linux)
- [CVE-2026-89522](https://cve.now/CVE-2026-89522.md): media: staging/ipu7: fix async notifier UAF on probe error path (CVSS 7.8, Linux)
- [CVE-2026-89521](https://cve.now/CVE-2026-89521.md): sched/core: Handle pick\_task() releasing the rq lock (CVSS 7.3, Linux)
- [CVE-2026-89520](https://cve.now/CVE-2026-89520.md): sched/core: Make core-sched flips wait for in-flight selections (CVSS 7.8, Linux)
- [CVE-2026-89519](https://cve.now/CVE-2026-89519.md): sched\_ext: Replace SCX\_RQ\_BAL\_KEEP with a dispatch verdict return (no CVSS, Linux)
- [CVE-2026-89518](https://cve.now/CVE-2026-89518.md): sched\_ext: Fix this\_rq() assumptions in dispatch kfuncs (no CVSS, Linux)
- [CVE-2026-89517](https://cve.now/CVE-2026-89517.md): sched\_ext: Fix rq-\>core\_pick corruption under core scheduling (no CVSS, Linux)
- [CVE-2026-89516](https://cve.now/CVE-2026-89516.md): sched\_ext: Don't BUG\_ON a destroyed DSQ in process\_deferred\_reenq\_users (no CVSS, Linux)
- [CVE-2026-89515](https://cve.now/CVE-2026-89515.md): scsi: core: Fill in DMA padding bytes in scsi\_alloc\_sgtables() (no CVSS, Linux)
- [CVE-2026-89514](https://cve.now/CVE-2026-89514.md): scsi: fnic: Use GFP\_ATOMIC for VLAN alloc under spinlock (no CVSS, Linux)
- [CVE-2026-89513](https://cve.now/CVE-2026-89513.md): RISC-V: KVM: Fix PMU event info array size overflow (CVSS 8.8, Linux)
- [CVE-2026-89512](https://cve.now/CVE-2026-89512.md): remoteproc: scp: Fix device reference leak on failed lookup (no CVSS, Linux)
- [CVE-2026-89511](https://cve.now/CVE-2026-89511.md): qede: Fix NULL pointer dereference in TPA fragment processing (CVSS 7.5, Linux)
- [CVE-2026-89510](https://cve.now/CVE-2026-89510.md): RDMA/cxgb4: Cancel reg\_work before freeing device on remove (CVSS 7.8, Linux)
- [CVE-2026-89509](https://cve.now/CVE-2026-89509.md): RDMA/ionic: Embed counter driver data in rdma\_counter allocation (no CVSS, Linux)
- [CVE-2026-89508](https://cve.now/CVE-2026-89508.md): RDMA/ucma: Lock the handler in ucma\_set\_ib\_path() (CVSS 7.8, Linux)
- [CVE-2026-89507](https://cve.now/CVE-2026-89507.md): RDMA/ucma: Lock the handler in ucma\_write\_cm\_event() (CVSS 7.8, Linux)
- [CVE-2026-89506](https://cve.now/CVE-2026-89506.md): RDMA/uverbs: Add UVERBS\_ATTR\_UHW to UVERBS\_METHOD\_REG\_MR (no CVSS, Linux)
- [CVE-2026-89505](https://cve.now/CVE-2026-89505.md): RDMA/uverbs: Guard legacy bundles without method\_elm (no CVSS, Linux)
- [CVE-2026-89504](https://cve.now/CVE-2026-89504.md): regulator: as3722\_get\_regulator\_dt\_data: fix premature of\_node\_put leaving dangling of\_node pointer (CVSS 8.4, Linux)
- [CVE-2026-89503](https://cve.now/CVE-2026-89503.md): ring-buffer: Fix subbuf resize race with ring\_buffer\_alloc\_read\_page() (CVSS 7.8, Linux)
- [CVE-2026-89502](https://cve.now/CVE-2026-89502.md): ring-buffer: Free cpu\_buffer::free\_page with subbuf\_order (no CVSS, Linux)
- [CVE-2026-89501](https://cve.now/CVE-2026-89501.md): ring-buffer: Hold cpu\_buffer::lock when resizing a subbuf (CVSS 7.8, Linux)
- [CVE-2026-89500](https://cve.now/CVE-2026-89500.md): ring-buffer: Make cpu\_buffer::free\_page a buffer\_data\_read\_page (CVSS 7.8, Linux)
- [CVE-2026-89499](https://cve.now/CVE-2026-89499.md): ring-buffer: Stop remote reader update when page swap fails (CVSS 7.8, Linux)
- [CVE-2026-89498](https://cve.now/CVE-2026-89498.md): orangefs: fix double-free of trailer\_buf on readdir copy failure (no CVSS, Linux)
- [CVE-2026-89497](https://cve.now/CVE-2026-89497.md): orangefs: skip leading spaces before parsing client debug masks (CVSS 7.8, Linux)
- [CVE-2026-89496](https://cve.now/CVE-2026-89496.md): ocfs2: always run deallocs on copy-on-write completion (no CVSS, Linux)
- [CVE-2026-89495](https://cve.now/CVE-2026-89495.md): ocfs2: bound namelen in dlm\_migrate\_request\_handler (CVSS 9.8, Linux)
- [CVE-2026-89494](https://cve.now/CVE-2026-89494.md): ocfs2: validate lengths in dlm\_mig\_lockres\_handler (CVSS 9.8, Linux)
- [CVE-2026-89493](https://cve.now/CVE-2026-89493.md): ocfs2: validate rl\_used against rl\_count in refcount block validator (CVSS 8.8, Linux)
- [CVE-2026-89492](https://cve.now/CVE-2026-89492.md): ocfs2: validate directory-index entry counts when reading metadata (CVSS 9.8, Linux)
- [CVE-2026-89491](https://cve.now/CVE-2026-89491.md): ocfs2: cluster: don't sleep while holding o2hb\_live\_lock in o2hb\_region\_pin() (no CVSS, Linux)
- [CVE-2026-89490](https://cve.now/CVE-2026-89490.md): ocfs2: fix readdir position truncation on 32-bit kernels (no CVSS, Linux)
- [CVE-2026-89489](https://cve.now/CVE-2026-89489.md): openrisc: fix arbitrary kernel memory access via or1k\_atomic syscall (CVSS 7.8, Linux)
- [CVE-2026-89488](https://cve.now/CVE-2026-89488.md): openvswitch: Fix CT limit teardown use-after-free (CVSS 7.8, Linux)
- [CVE-2026-89487](https://cve.now/CVE-2026-89487.md): openvswitch: only skb\_tx\_error() a packet we are about to drop (CVSS 7.8, Linux)
- [CVE-2026-89486](https://cve.now/CVE-2026-89486.md): ipmi: Fix use-after-free of cmd\_rcvr in \_ipmi\_destroy\_user() (CVSS 7.8, Linux)
- [CVE-2026-89485](https://cve.now/CVE-2026-89485.md): lockd: pin next file across nlm\_inspect\_file lock-drop (CVSS 9.8, Linux)
- [CVE-2026-89484](https://cve.now/CVE-2026-89484.md): lockd: fix NULL dereference on lockowner allocation failure (no CVSS, Linux)
- [CVE-2026-89483](https://cve.now/CVE-2026-89483.md): nvme: zero the discard fallback page (CVSS 7.5, Linux)
- [CVE-2026-89482](https://cve.now/CVE-2026-89482.md): nvme-tcp: do not accept C2HData based on blk\_rq\_payload\_bytes() alone (CVSS 9.8, Linux)
- [CVE-2026-89481](https://cve.now/CVE-2026-89481.md): nvme-tcp: fix host memory disclosure on R2T for a read command (CVSS 7.5, Linux)
- [CVE-2026-89480](https://cve.now/CVE-2026-89480.md): nvme-tcp: reject a read that transferred too few bytes (CVSS 7.5, Linux)
- [CVE-2026-89479](https://cve.now/CVE-2026-89479.md): sctp: stop processing a packet once its association is deleted (CVSS 9.8, Linux)
- [CVE-2026-89478](https://cve.now/CVE-2026-89478.md): sctp: drop a chunk if its transport was removed (CVSS 9.8, Linux)
- [CVE-2026-89477](https://cve.now/CVE-2026-89477.md): sctp: fix NULL deref on untransmitted RECONF completion (CVSS 7.5, Linux)
- [CVE-2026-89476](https://cve.now/CVE-2026-89476.md): sctp: fix stream-\>outcnt underflow on duplicate RECONF responses (CVSS 7.5, Linux)
- [CVE-2026-89475](https://cve.now/CVE-2026-89475.md): power: supply: bq24257: fix use-after-free on remove (no CVSS, Linux)
- [CVE-2026-89474](https://cve.now/CVE-2026-89474.md): power: supply: bq256xx: drain usb\_work before freeing the charger (no CVSS, Linux)
- [CVE-2026-89473](https://cve.now/CVE-2026-89473.md): power: supply: bq25890: Fix power\_supply reference leak (no CVSS, Linux)
- [CVE-2026-89472](https://cve.now/CVE-2026-89472.md): power: supply: charger-manager: register regulators before exposing sysfs (CVSS 7.8, Linux)
- [CVE-2026-89471](https://cve.now/CVE-2026-89471.md): power: supply: cros\_usbpd-charger: bound the EC-reported port count (CVSS 8.4, Linux)
- [CVE-2026-89470](https://cve.now/CVE-2026-89470.md): power: supply: cros\_usbpd: Limit port counts to EC\_USB\_PD\_MAX\_PORTS (CVSS 8.4, Linux)
- [CVE-2026-89469](https://cve.now/CVE-2026-89469.md): power: supply: lp8727: fix use-after-free in lp8727\_release\_irq() (CVSS 8.4, Linux)
- [CVE-2026-89468](https://cve.now/CVE-2026-89468.md): power: supply: lp8788-charger: fix use-after-free on remove (no CVSS, Linux)
- [CVE-2026-89467](https://cve.now/CVE-2026-89467.md): power: supply: qcom\_battmgr: fix use-after-free (no CVSS, Linux)
- [CVE-2026-89466](https://cve.now/CVE-2026-89466.md): power: supply: qcom\_battmgr: terminate the strings from firmware (CVSS 7.7, Linux)
- [CVE-2026-89465](https://cve.now/CVE-2026-89465.md): power: supply: rt9455: quiesce delayed work before teardown (CVSS 8.4, Linux)
- [CVE-2026-89464](https://cve.now/CVE-2026-89464.md): power: supply: twl4030\_charger: cancel workers via devm (no CVSS, Linux)
- [CVE-2026-89463](https://cve.now/CVE-2026-89463.md): power: supply: ucs1002: fix use-after-free on remove (no CVSS, Linux)
- [CVE-2026-89462](https://cve.now/CVE-2026-89462.md): power: supply: max17040: propagate register read errors (no CVSS, Linux)
- [CVE-2026-89461](https://cve.now/CVE-2026-89461.md): power: supply: max17040: synchronize work cancellation on suspend (no CVSS, Linux)
- [CVE-2026-89460](https://cve.now/CVE-2026-89460.md): s390/cpum\_cf: Handle CPU hotplug via prepare/dead callbacks (no CVSS, Linux)
- [CVE-2026-89459](https://cve.now/CVE-2026-89459.md): s390/percpu: Fix MVIY\_PERCPU() with older binutils (CVSS 7.0, Linux)
- [CVE-2026-89458](https://cve.now/CVE-2026-89458.md): s390/dasd: Do not complete a failed ESE read as successful (no CVSS, Linux)
- [CVE-2026-89457](https://cve.now/CVE-2026-89457.md): s390/dasd: Guard sysfs discipline callbacks against unallocated private data (no CVSS, Linux)
- [CVE-2026-89456](https://cve.now/CVE-2026-89456.md): s390/dasd: Propagate partial completion length across ERP recovery (CVSS 7.0, Linux)
- [CVE-2026-89455](https://cve.now/CVE-2026-89455.md): PCI: plda: Fix use-after-free of event IRQs during teardown (no CVSS, Linux)
- [CVE-2026-89454](https://cve.now/CVE-2026-89454.md): PCI: plda: Fix IRQ domain leaks in the error paths of plda\_init\_interrupts() (no CVSS, Linux)
- [CVE-2026-89453](https://cve.now/CVE-2026-89453.md): iommu/amd: Put PCI device after handling PPR faults (no CVSS, Linux)
- [CVE-2026-89452](https://cve.now/CVE-2026-89452.md): iommu/msm: Unwind probe state on registration failure (CVSS 8.4, Linux)
- [CVE-2026-89451](https://cve.now/CVE-2026-89451.md): iommu/sva: Set handle-\>dev before the SVA handle is visible (no CVSS, Linux)
- [CVE-2026-89450](https://cve.now/CVE-2026-89450.md): iommu/tegra241-cmdqv: Reject a vSID wider than the SID\_MATCH field (CVSS 8.8, Linux)
- [CVE-2026-89449](https://cve.now/CVE-2026-89449.md): iommu: Fix dev\_iommu memory leak when device\_add fails in iommu\_mock\_device\_add (no CVSS, Linux)
- [CVE-2026-89448](https://cve.now/CVE-2026-89448.md): iommu/vt-d: Force requesting ACS when tboot is enabled (CVSS 9.3, Linux)
- [CVE-2026-89447](https://cve.now/CVE-2026-89447.md): iommufd: Avoid locking internal accesses during unmap (no CVSS, Linux)
- [CVE-2026-89446](https://cve.now/CVE-2026-89446.md): iommufd: Release current IOAS on xa\_store() failure (no CVSS, Linux)
- [CVE-2026-89445](https://cve.now/CVE-2026-89445.md): iommufd: Fix UAF in selftest IOPF reporting (CVSS 8.8, Linux)
- [CVE-2026-89444](https://cve.now/CVE-2026-89444.md): platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (no CVSS, Linux)
- [CVE-2026-89443](https://cve.now/CVE-2026-89443.md): platform/x86: ISST: Validate level in perf mask ioctls (CVSS 7.1, Linux)
- [CVE-2026-89442](https://cve.now/CVE-2026-89442.md): platform/x86: ISST: Validate socket ID in clos\_assoc ioctl (CVSS 7.8, Linux)
- [CVE-2026-89441](https://cve.now/CVE-2026-89441.md): mmc: via-sdmmc: cancel card-detect work on remove (CVSS 7.8, Linux)
- [CVE-2026-89440](https://cve.now/CVE-2026-89440.md): mmc: via-sdmmc: stop card-detect handling on probe failure (CVSS 7.8, Linux)
- [CVE-2026-89439](https://cve.now/CVE-2026-89439.md): platform/x86: ISST: Add a NULL check for sst\_inst\[\] (no CVSS, Linux)
- [CVE-2026-89438](https://cve.now/CVE-2026-89438.md): platform/x86: ISST: Validate logical CPU id and clos id (no CVSS, Linux)
- [CVE-2026-89437](https://cve.now/CVE-2026-89437.md): platform/x86: int1092: Fix potential memory leak in sar\_probe() (no CVSS, Linux)
- [CVE-2026-89436](https://cve.now/CVE-2026-89436.md): platform/x86: panasonic-laptop: Fix sentinel write past pcc-\>sinf\[\] (CVSS 7.8, Linux)
- [CVE-2026-81018](https://cve.now/CVE-2026-81018.md): platform/x86: think-lmi: Free system certificate signatures (no CVSS, Linux)
- [CVE-2026-81017](https://cve.now/CVE-2026-81017.md): platform/chrome: sensorhub: Bound the EC-reported sensor number (CVSS 8.4, Linux)
- [CVE-2026-81016](https://cve.now/CVE-2026-81016.md): platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (CVSS 7.7, Linux)
- [CVE-2026-81015](https://cve.now/CVE-2026-81015.md): platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails (CVSS 7.8, Linux)
- [CVE-2026-81014](https://cve.now/CVE-2026-81014.md): platform/x86: hp-bioscfg: fix heap OOB read in sk\_store() and kek\_store() (no CVSS, Linux)
- [CVE-2026-81013](https://cve.now/CVE-2026-81013.md): platform/x86: hp-bioscfg: fix heap OOB read on empty password write (no CVSS, Linux)
- [CVE-2026-81012](https://cve.now/CVE-2026-81012.md): platform/x86: hp-bioscfg: fix off-by-one write in hp\_get\_string\_from\_buffer() (CVSS 8.4, Linux)
- [CVE-2026-81011](https://cve.now/CVE-2026-81011.md): platform/x86: hp-bioscfg: pass validated element count to package parsers (CVSS 7.1, Linux)
- [CVE-2026-81010](https://cve.now/CVE-2026-81010.md): io\_uring/waitid: honor task\_work cancellation (CVSS 7.8, Linux)
- [CVE-2026-81009](https://cve.now/CVE-2026-81009.md): io\_uring/query: cap user size passed to copy\_struct\_to\_user (no CVSS, Linux)
- [CVE-2026-81008](https://cve.now/CVE-2026-81008.md): interconnect: Fix use after free in icc\_get() and of\_icc\_get\_by\_index() (CVSS 7.8, Linux)
- [CVE-2026-81007](https://cve.now/CVE-2026-81007.md): ipmi: ipmb: validate write message length (CVSS 7.1, Linux)
- [CVE-2026-81006](https://cve.now/CVE-2026-81006.md): ipmi: Remove all sysfs files on registration failure (CVSS 7.8, Linux)
- [CVE-2026-81005](https://cve.now/CVE-2026-81005.md): ipmi: si: Fix NULL pointer dereference after failed registration (no CVSS, Linux)
- [CVE-2026-81004](https://cve.now/CVE-2026-81004.md): ipmi:msghandler: Cancel work cleanly on an error (CVSS 8.4, Linux)
- [CVE-2026-81003](https://cve.now/CVE-2026-81003.md): net/iucv: filter frames in afiucv\_hs\_rcv() by ingress device (CVSS 8.1, Linux)
- [CVE-2026-81002](https://cve.now/CVE-2026-81002.md): xdp: fix zero-copy frame layout (CVSS 9.8, Linux)
- [CVE-2026-81001](https://cve.now/CVE-2026-81001.md): slip: fix use-after-free in sl\_sync() (CVSS 7.8, Linux)
- [CVE-2026-81000](https://cve.now/CVE-2026-81000.md): net: tun: bound receive headroom (CVSS 7.8, Linux)
- [CVE-2026-80999](https://cve.now/CVE-2026-80999.md): net: dsa: realtek: use gpiod\_set\_value\_cansleep for reset GPIO (no CVSS, Linux)
- [CVE-2026-80998](https://cve.now/CVE-2026-80998.md): net: bnxt: ring the doorbell when SW USO exits early (CVSS 7.5, Linux)
- [CVE-2026-80997](https://cve.now/CVE-2026-80997.md): net: ipa: fix stalled modem TX queue after runtime resume (CVSS 7.5, Linux)
- [CVE-2026-80996](https://cve.now/CVE-2026-80996.md): net: l2tp: do not propagate multicast notification errors (no CVSS, Linux)
- [CVE-2026-80995](https://cve.now/CVE-2026-80995.md): net: mctp: hold a reference to the route device in mctp\_route\_lookup() (CVSS 7.8, Linux)
- [CVE-2026-80994](https://cve.now/CVE-2026-80994.md): net: openvswitch: fix flow mask use-after-free on flow deletion (CVSS 7.8, Linux)
- [CVE-2026-80993](https://cve.now/CVE-2026-80993.md): net: phylink: correctly validate returned PCS in phylink\_inband\_caps (no CVSS, Linux)
- [CVE-2026-80992](https://cve.now/CVE-2026-80992.md): net: ravb: avoid dereferencing an invalid PTP clock (CVSS 7.8, Linux)
- [CVE-2026-80991](https://cve.now/CVE-2026-80991.md): net: ravb: serialize PTP clock teardown (CVSS 7.8, Linux)
- [CVE-2026-80990](https://cve.now/CVE-2026-80990.md): net: thunderbolt: Release the Rx HopID that was handed out on mismatch (no CVSS, Linux)
- [CVE-2026-80989](https://cve.now/CVE-2026-80989.md): net: thunderbolt: Mark the connection down when bringing it up fails (CVSS 8.8, Linux)
- [CVE-2026-80988](https://cve.now/CVE-2026-80988.md): NTB: ntb\_transport: Fail TX enqueue when the QP link is down (no CVSS, Linux)
- [CVE-2026-80987](https://cve.now/CVE-2026-80987.md): NTB: ntb\_transport: Reject oversized TX buffers (CVSS 7.5, Linux)
- [CVE-2026-80986](https://cve.now/CVE-2026-80986.md): net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (CVSS 9.8, Linux)
- [CVE-2026-80985](https://cve.now/CVE-2026-80985.md): net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVSS 8.2, Linux)
- [CVE-2026-80984](https://cve.now/CVE-2026-80984.md): net/smc: do not dereference an unset send buffer on the SMC-D teardown path (no CVSS, Linux)
- [CVE-2026-80983](https://cve.now/CVE-2026-80983.md): net/smc: fix socket refcount leak in smc\_switch\_conns() (no CVSS, Linux)
- [CVE-2026-80982](https://cve.now/CVE-2026-80982.md): net/smc: fix use-after-free in smc\_rx\_pipe\_buf\_release() (CVSS 7.8, Linux)
- [CVE-2026-80981](https://cve.now/CVE-2026-80981.md): net/smc: fix use-after-free of the LLC qentry in smc\_llc\_srv\_add\_link() (CVSS 9.8, Linux)
- [CVE-2026-80980](https://cve.now/CVE-2026-80980.md): net/smc: stop killed, freed and out\_of\_sync sharing a byte (CVSS 9.8, Linux)
- [CVE-2026-80979](https://cve.now/CVE-2026-80979.md): net/smc: unregister the connection before draining the rx tasklet (CVSS 7.8, Linux)
- [CVE-2026-80978](https://cve.now/CVE-2026-80978.md): net: cap advertised IP tunnel headroom (CVSS 7.8, Linux)
- [CVE-2026-80977](https://cve.now/CVE-2026-80977.md): net: skbuff: don't touch shared zerocopy state in skb\_tx\_error() (CVSS 7.8, Linux)
- [CVE-2026-80976](https://cve.now/CVE-2026-80976.md): seg6: reset IP6CB after IPv6 decapsulation (CVSS 9.8, Linux)
- [CVE-2026-80975](https://cve.now/CVE-2026-80975.md): mfd: qnap-mcu: keep the reply buffer alive past a command timeout (CVSS 7.8, Linux)
- [CVE-2026-80974](https://cve.now/CVE-2026-80974.md): mfd: sm501: Fix potential memory leaks during remove (no CVSS, Linux)
- [CVE-2026-80973](https://cve.now/CVE-2026-80973.md): ALSA: 6fire: bound the MIDI event length from the device (no CVSS, Linux)
- [CVE-2026-80972](https://cve.now/CVE-2026-80972.md): ALSA: aloop: Check card index validity at probe (no CVSS, Linux)
- [CVE-2026-80971](https://cve.now/CVE-2026-80971.md): ALSA: bcd2000: clear the URB pointers on disconnect (CVSS 7.8, Linux)
- [CVE-2026-80970](https://cve.now/CVE-2026-80970.md): ALSA: FCP: do not copy out an uninitialised init response (no CVSS, Linux)
- [CVE-2026-80969](https://cve.now/CVE-2026-80969.md): ALSA: mpu401: Check card index validity at probe (no CVSS, Linux)
- [CVE-2026-80968](https://cve.now/CVE-2026-80968.md): ALSA: mts64: Check card index validity at probe (no CVSS, Linux)
- [CVE-2026-80967](https://cve.now/CVE-2026-80967.md): ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (CVSS 8.4, Linux)
- [CVE-2026-80966](https://cve.now/CVE-2026-80966.md): ALSA: portman2x4: Check card index validity at probe (no CVSS, Linux)
- [CVE-2026-80965](https://cve.now/CVE-2026-80965.md): ALSA: serial-u16550: Check card index validity at probe (no CVSS, Linux)
- [CVE-2026-80964](https://cve.now/CVE-2026-80964.md): ALSA: virmidi: Check card index validity at probe (no CVSS, Linux)
- [CVE-2026-80963](https://cve.now/CVE-2026-80963.md): dm-stats: fix a crash if allocation of per-cpu data fails (no CVSS, Linux)
- [CVE-2026-80962](https://cve.now/CVE-2026-80962.md): dm-pcache: validate geometry fields from on-disk cache\_info (CVSS 7.8, Linux)
- [CVE-2026-80961](https://cve.now/CVE-2026-80961.md): dm-pcache: validate kset key\_num and intra-segment bounds (CVSS 7.8, Linux)
- [CVE-2026-80960](https://cve.now/CVE-2026-80960.md): dm-pcache: validate on-media seg\_num against the cache device size (no CVSS, Linux)
- [CVE-2026-80959](https://cve.now/CVE-2026-80959.md): dm-pcache: bound the persisted tail-position offset (CVSS 7.8, Linux)
- [CVE-2026-80958](https://cve.now/CVE-2026-80958.md): dm-pcache: clamp the tail kset read to the segment data region (CVSS 7.1, Linux)
- [CVE-2026-80957](https://cve.now/CVE-2026-80957.md): dm-pcache: detect a cycle in the last-kset chain during replay (no CVSS, Linux)
- [CVE-2026-80956](https://cve.now/CVE-2026-80956.md): dm-pcache: only hand out initialized cache segments (no CVSS, Linux)
- [CVE-2026-80955](https://cve.now/CVE-2026-80955.md): dm-pcache: fix use-after-free and invalid seg operations in kset\_replay() (CVSS 7.8, Linux)
- [CVE-2026-80954](https://cve.now/CVE-2026-80954.md): i3c: Fix unlocked dereference of dev-\>desc in i3c\_device\_get\_supported\_xfer\_mode() (CVSS 7.8, Linux)
- [CVE-2026-80953](https://cve.now/CVE-2026-80953.md): i3c: master: adi: initialize the lock before enabling interrupts (CVSS 8.4, Linux)
- [CVE-2026-80952](https://cve.now/CVE-2026-80952.md): i3c: master: Fix info leak and UAF in device unregister path (CVSS 7.8, Linux)
- [CVE-2026-80951](https://cve.now/CVE-2026-80951.md): i3c: master: svc: bound IBI payload to the requested max\_payload\_len (no CVSS, Linux)
- [CVE-2026-80950](https://cve.now/CVE-2026-80950.md): i3c: renesas: Check that the transfer is valid before accessing it (CVSS 7.8, Linux)
- [CVE-2026-80949](https://cve.now/CVE-2026-80949.md): wifi: brcmfmac: Fix memory leak in brcmf\_sdio\_read\_control() (no CVSS, Linux)
- [CVE-2026-80948](https://cve.now/CVE-2026-80948.md): wifi: iwlwifi: dvm: fix memory leak in iwl\_op\_mode\_dvm\_start() (no CVSS, Linux)
- [CVE-2026-80947](https://cve.now/CVE-2026-80947.md): wifi: rtl8xxxu: fix use-after-free from rx\_urb\_wq on stop (CVSS 7.8, Linux)
- [CVE-2026-80946](https://cve.now/CVE-2026-80946.md): fuse: copy request headers via a stack buffer for io-uring (no CVSS, Linux)
- [CVE-2026-80945](https://cve.now/CVE-2026-80945.md): crypto: iaa - unmap dst before software fallback on decompress (CVSS 9.1, Linux)
- [CVE-2026-80944](https://cve.now/CVE-2026-80944.md): wifi: mwifiex: Detach sync cmd buffer on interrupted wait (CVSS 7.8, Linux)
- [CVE-2026-80943](https://cve.now/CVE-2026-80943.md): wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (CVSS 7.6, Linux)
- [CVE-2026-80942](https://cve.now/CVE-2026-80942.md): wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du\_init\_sw\_vars() (no CVSS, Linux)
- [CVE-2026-80941](https://cve.now/CVE-2026-80941.md): wifi: rtw88: Fix potential memory leak in rtw\_txq\_push\_skb() (no CVSS, Linux)
- [CVE-2026-80940](https://cve.now/CVE-2026-80940.md): wifi: rtw88: pci: fix resource leak on failed NAPI setup (no CVSS, Linux)
- [CVE-2026-80939](https://cve.now/CVE-2026-80939.md): wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot (no CVSS, Linux)
- [CVE-2026-80938](https://cve.now/CVE-2026-80938.md): wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (no CVSS, Linux)
- [CVE-2026-80937](https://cve.now/CVE-2026-80937.md): wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (CVSS 8.8, Linux)
- [CVE-2026-80936](https://cve.now/CVE-2026-80936.md): wifi: mt76: mt7925: cancel mlo\_pm\_work on stop (CVSS 7.8, Linux)
- [CVE-2026-80935](https://cve.now/CVE-2026-80935.md): wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (CVSS 8.8, Linux)
- [CVE-2026-80934](https://cve.now/CVE-2026-80934.md): wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames (no CVSS, Linux)
- [CVE-2026-80933](https://cve.now/CVE-2026-80933.md): wifi: mt76: mt7996: validate default EEPROM firmware size (CVSS 7.8, Linux)
- [CVE-2026-80932](https://cve.now/CVE-2026-80932.md): vsock/virtio: flush works in dependency order (CVSS 8.4, Linux)
- [CVE-2026-80931](https://cve.now/CVE-2026-80931.md): w1: ds28e17: reject an oversize length on an I2C block read (CVSS 7.8, Linux)
- [CVE-2026-80930](https://cve.now/CVE-2026-80930.md): tpm: tpm\_i2c\_nuvoton: disable IRQ on wait timeout (no CVSS, Linux)
- [CVE-2026-80929](https://cve.now/CVE-2026-80929.md): sysctl: move the "cad\_pid" entry from pid\_table\[\] to kern\_reboot\_table\[\] (CVSS 7.8, Linux)
- [CVE-2026-80928](https://cve.now/CVE-2026-80928.md): smack: fix cred UAF in smack\_file\_send\_sigiotask() (CVSS 7.8, Linux)
- [CVE-2026-80927](https://cve.now/CVE-2026-80927.md): timekeeping: Check the return value of tk\_get\_aux\_ts64 in \_\_do\_adjtimex() (no CVSS, Linux)
- [CVE-2026-81915](https://cve.now/CVE-2026-81915.md): In Concrete CMS below 9.5.3, Page Type update omits object-level authorization (CVSS 5.1, Concrete CMS)
- [CVE-2026-80926](https://cve.now/CVE-2026-80926.md): ksmbd: fix use-after-free in oplock break notification (CVSS 9.8, Linux)
- [CVE-2026-77490](https://cve.now/CVE-2026-77490.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2026-68526](https://cve.now/CVE-2026-68526.md): Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller (CVSS 5.3, Concrete CMS)
- [CVE-2026-81913](https://cve.now/CVE-2026-81913.md): Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. (CVSS 5.3, Concrete CMS)
- [CVE-2026-49463](https://cve.now/CVE-2026-49463.md): NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries (CVSS 6.5, nl.nl-portal:besluiten · nl.nl-portal:documenten-api)
- [CVE-2026-81912](https://cve.now/CVE-2026-81912.md): Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature (CVSS 5.7, Concrete CMS)
- [CVE-2026-81911](https://cve.now/CVE-2026-81911.md): Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save\_template via Unescaped Summary Description (CVSS 5.8, Concrete CMS)
- [CVE-2026-53952](https://cve.now/CVE-2026-53952.md): GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw (CVSS 9.8, GetSimpleCMS-CE · GetSimpleCMS)
- [CVE-2026-78546](https://cve.now/CVE-2026-78546.md): Out-of-Bounds Read (CVSS 4.8, Citirx Workspace app for Windows)
- [CVE-2026-78547](https://cve.now/CVE-2026-78547.md): Out-of-Bounds Write (CVSS 4.4, Citrix Workspace app for Windows)
- [CVE-2026-89332](https://cve.now/CVE-2026-89332.md): Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration (CVSS 5.5, AWS Kiro IDE)
- [CVE-2026-89329](https://cve.now/CVE-2026-89329.md): Device-mapper-multipath: local denial of service via blocking ipc send operations (CVSS 6.2, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-54072](https://cve.now/CVE-2026-54072.md): Authorizer: Unvalidated redirect\_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL (CVSS 9.3, authorizerdev authorizer · github.com/authorizerdev/authori…)
- [CVE-2026-62088](https://cve.now/CVE-2026-62088.md): WordPress ElasticPress plugin \<= 5.3.4 - Sensitive Data Exposure vulnerability (CVSS 5.3, 10up ElasticPress)
- [CVE-2026-81910](https://cve.now/CVE-2026-81910.md): Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values (CVSS 5.9, Concrete CMS)
- [CVE-2026-62089](https://cve.now/CVE-2026-62089.md): WordPress Master Addons for Elementor plugin \<= 3.2.2 - Broken Access Control vulnerability (CVSS 7.1, Pixar Labs Master Addons for Elementor)
- [CVE-2026-62139](https://cve.now/CVE-2026-62139.md): WordPress Site Kit by Google plugin \<= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Site Kit by Google)
- [CVE-2026-62138](https://cve.now/CVE-2026-62138.md): WordPress Visual Composer Website Builder plugin \<= 45.16.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Visual Composer Website Builder)
- [CVE-2026-62137](https://cve.now/CVE-2026-62137.md): WordPress bbPress plugin \<= 2.6.14 - Sensitive Data Exposure vulnerability (CVSS 5.3, John James Jacoby bbPress)
- [CVE-2026-62136](https://cve.now/CVE-2026-62136.md): WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin \<= 2.3.21 - Broken Access Control vulnerability (CVSS 5.3, wpdesk Flexible Quantity – Measurement Price Calculator for…)
- [CVE-2026-62135](https://cve.now/CVE-2026-62135.md): WordPress Booktics plugin \<= 1.0.24 - Broken Access Control vulnerability (CVSS 5.3, Arraytics Booktics)
- [CVE-2026-62134](https://cve.now/CVE-2026-62134.md): WordPress Starter Templates plugin \<= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Brainstorm Force Starter Templates)
- [CVE-2026-62133](https://cve.now/CVE-2026-62133.md): WordPress RTMKit plugin \<= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, rometheme RTMKit)
- [CVE-2026-62132](https://cve.now/CVE-2026-62132.md): WordPress Masteriyo - LMS plugin \<= 3.4.0 - Broken Access Control vulnerability (CVSS 5.3, Masteriyo - LMS)
- [CVE-2026-62114](https://cve.now/CVE-2026-62114.md): WordPress Passster plugin \<= 4.3.13 - Broken Access Control vulnerability (CVSS 5.3, WP Chill Passster)
- [CVE-2026-62113](https://cve.now/CVE-2026-62113.md): WordPress Slim SEO plugin \<= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Anh Tran Slim SEO)
- [CVE-2026-62112](https://cve.now/CVE-2026-62112.md): WordPress Amelia plugin \<= 2.4.9 - SQL Injection vulnerability (CVSS 7.6, Melograno Venture Studio Amelia)
- [CVE-2026-62111](https://cve.now/CVE-2026-62111.md): WordPress Simple Payment plugin \<= 2.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ido Kobelkowsky Simple Payment)
- [CVE-2026-62110](https://cve.now/CVE-2026-62110.md): WordPress Bold Page Builder plugin \<= 5.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2026-62109](https://cve.now/CVE-2026-62109.md): WordPress Sky Addons for Elementor plugin \<= 3.8.4 - SQL Injection vulnerability (CVSS 7.6, wowDevs Sky Addons for Elementor)
- [CVE-2026-62107](https://cve.now/CVE-2026-62107.md): WordPress Masteriyo - LMS plugin \<= 3.4.0 - PHP Object Injection vulnerability (CVSS 8.8, Masteriyo - LMS)
- [CVE-2026-62106](https://cve.now/CVE-2026-62106.md): WordPress SMS Alert Order Notifications plugin \<= 3.9.9 - Privilege Escalation vulnerability (CVSS 8.8, Cozy Vision Technologies Pvt. SMS Alert Order Notifications)
- [CVE-2026-62105](https://cve.now/CVE-2026-62105.md): WordPress ThemeREX Addons plugin \< 2.45.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Addons)
- [CVE-2026-62103](https://cve.now/CVE-2026-62103.md): WordPress Everest Forms plugin \<= 3.6.0 - PHP Object Injection vulnerability (CVSS 9.8, wpeverest Everest Forms)
- [CVE-2026-62102](https://cve.now/CVE-2026-62102.md): WordPress Gato GraphQL plugin \<= 19.2.3 - Privilege Escalation vulnerability (CVSS 8.8, Gato GraphQL)
- [CVE-2026-27378](https://cve.now/CVE-2026-27378.md): WordPress Deposits and Partial Payments for WooCommerce plugin \<= 3.1.0 - Broken Access Control vulnerability (CVSS 5.3, magepeopleteam Deposits and Partial Payments for WooCommerce)
- [CVE-2026-62140](https://cve.now/CVE-2026-62140.md): WordPress Quiz And Survey Master plugin \<= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, ExpressTech Systems Quiz And Survey Master)
- [CVE-2026-82617](https://cve.now/CVE-2026-82617.md): Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns (CVSS 10.0, Apache Software Foundation Apache OpenNLP)
- [CVE-2026-81909](https://cve.now/CVE-2026-81909.md): Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks (CVSS 5.9, Concrete CMS)
- [CVE-2026-67211](https://cve.now/CVE-2026-67211.md): Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer (CVSS 7.5, Apache Software Foundation Apache OpenNLP)
- [CVE-2026-18495](https://cve.now/CVE-2026-18495.md): Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough (CVSS 6.1, Red Hat Hardened Images · Red Hat Ceph Storage +1)
- [CVE-2026-89099](https://cve.now/CVE-2026-89099.md): Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption (CVSS 7.7, MongoDB Server)
- [CVE-2026-68528](https://cve.now/CVE-2026-68528.md): Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title (CVSS 6.0, Concrete CMS)
- [CVE-2026-7298](https://cve.now/CVE-2026-7298.md): Reflected XSS in IdeaSoft's Smart E-Commerce (CVSS 6.1, IdeaSoft Software Industry and Trade Smart E-Commerce)
- [CVE-2026-87910](https://cve.now/CVE-2026-87910.md): tarfile hardlink fallback ignores custom extraction filter rejection via None (CVSS 5.7, Python Software Foundation CPython · libpython +2)
- [CVE-2026-18122](https://cve.now/CVE-2026-18122.md): Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization (CVSS 6.0, Concrete CMS)
- [CVE-2026-81908](https://cve.now/CVE-2026-81908.md): Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups (CVSS 6.0, Concrete CMS)
- [CVE-2026-82535](https://cve.now/CVE-2026-82535.md): Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php (CVSS 5.3, chamilo-lms)
- [CVE-2026-9160](https://cve.now/CVE-2026-9160.md): CSTI in Arma Digital's Website Template (CVSS 4.3, Arma Digital Media Website Template)
- [CVE-2026-89090](https://cve.now/CVE-2026-89090.md): Denial of service in the event stream header decoder in AWS SDK for Go v2 (CVSS 5.9, AWS SDK for Go · github.com/aws/aws-sdk-go-v2/aws/proto… +11)
- [CVE-2026-72710](https://cve.now/CVE-2026-72710.md): SPIP \< 4.4.18 RCE via editer\_objet.php Job Queue Injection (CVSS 9.3, SPIP)
- [CVE-2026-72709](https://cve.now/CVE-2026-72709.md): SPIP \< 4.4.18 Missing Authorization via ecrire/action/ (CVSS 9.3, SPIP)
- [CVE-2026-72708](https://cve.now/CVE-2026-72708.md): SPIP \< 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html (CVSS 8.7, SPIP)
- [CVE-2026-18061](https://cve.now/CVE-2026-18061.md): Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin (CVSS 5.9, AWS Advanced JDBC Wrapper)
- [CVE-2026-54047](https://cve.now/CVE-2026-54047.md): Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation (CVSS 9.2, LaciSynchroni server)
- [CVE-2026-89066](https://cve.now/CVE-2026-89066.md): OS command injection in the task synthesis component in projen (CVSS 7.8, AWS projen)
- [CVE-2026-89065](https://cve.now/CVE-2026-89065.md): Relative path traversal in the generated file manifest cleanup component in projen (CVSS 7.1, AWS projen)
- [CVE-2026-7863](https://cve.now/CVE-2026-7863.md): OS Command Injection in TUBITAK BILGEM's Pardus Software (CVSS 8.4, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-89013](https://cve.now/CVE-2026-89013.md): Dolibarr 23.0.4 \< 24.0.1 Authorization Bypass via hashp Parameter in document.php (CVSS 8.7, Dolibarr)
- [CVE-2026-70341](https://cve.now/CVE-2026-70341.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.5, Microsoft Edge)
- [CVE-2026-68497](https://cve.now/CVE-2026-68497.md): jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service (CVSS 7.5, FasterXML jackson-databind · tools.jackson.core:jackson-… +1)
- [CVE-2026-89012](https://cve.now/CVE-2026-89012.md): Dolibarr 24.0.0 \< 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter (CVSS 7.1, Dolibarr)
- [CVE-2026-8304](https://cve.now/CVE-2026-8304.md): Information Disclosure in TUBITAK BILGEM's Pardus About (CVSS 5.5, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-15439](https://cve.now/CVE-2026-15439.md): GamiPress \<= 7.9.7 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, rubengc GamiPress – Gamification plugin to reward points, b…)
- [CVE-2026-89265](https://cve.now/CVE-2026-89265.md): MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint (CVSS 4.3, moxi624 MoguBlog)
- [CVE-2026-89264](https://cve.now/CVE-2026-89264.md): MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity (CVSS 4.3, moxi624 MoguBlog)
- [CVE-2026-89263](https://cve.now/CVE-2026-89263.md): MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint (CVSS 5.3, moxi624 MoguBlog)
- [CVE-2026-89262](https://cve.now/CVE-2026-89262.md): MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check (CVSS 7.5, moxi624 MoguBlog)
- [CVE-2026-89261](https://cve.now/CVE-2026-89261.md): MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints (CVSS 6.5, moxi624 MoguBlog)
- [CVE-2026-89260](https://cve.now/CVE-2026-89260.md): MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint (CVSS 7.5, moxi624 MoguBlog)
- [CVE-2026-3869](https://cve.now/CVE-2026-3869.md): CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and (CVSS 9.2, Schneider Electric Modicon M580)
- [CVE-2026-81861](https://cve.now/CVE-2026-81861.md): CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized acc (CVSS 5.9, Schneider Electric SCADAPack)
- [CVE-2026-89010](https://cve.now/CVE-2026-89010.md): WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync\_server (CVSS 9.3, WAVLINK Technology WN535M1 · WAVLINK Technology WN535M3)
- [CVE-2026-89009](https://cve.now/CVE-2026-89009.md): WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync\_server (CVSS 8.8, WAVLINK Technology WN535M1 · WAVLINK Technology WN535M3)
- [CVE-2026-85083](https://cve.now/CVE-2026-85083.md): CareCam Pro IP Cameras Use of Hard-coded Credentials (CVSS 6.8, CareCam ANJIA AJL33PC0801 Firmware)
- [CVE-2026-38056](https://cve.now/CVE-2026-38056.md): ST Engineering iDirect iQ-Series Terminals Missing Authorization (CVSS 8.8, ST Engineering iDirect Evolution iQ‑Series terminals · S… +1)
- [CVE-2026-38058](https://cve.now/CVE-2026-38058.md): ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVSS 8.1, ST Engineering iDirect Evolution iQ‑Series terminals · S… +1)
- [CVE-2026-8301](https://cve.now/CVE-2026-8301.md): OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair (CVSS 7.8, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-85979](https://cve.now/CVE-2026-85979.md): Command Injection in Puppet Enterprise (CVSS 8.6, Perforce Software Puppet Enterprise)
- [CVE-2026-87988](https://cve.now/CVE-2026-87988.md): An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as un (CVSS 10.0, mistralai mistral-vibe)
- [CVE-2026-87987](https://cve.now/CVE-2026-87987.md): An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable (CVSS 10.0, mistralai mistral-vibe)
- [CVE-2026-87986](https://cve.now/CVE-2026-87986.md): An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's (CVSS 10.0, mistralai mistral-vibe)
- [CVE-2026-87985](https://cve.now/CVE-2026-87985.md): An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted argumen (CVSS 10.0, mistralai mistral-vibe)
- [CVE-2026-87984](https://cve.now/CVE-2026-87984.md): An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside (CVSS 9.3, mistralai mistral-vibe)
- [CVE-2026-87983](https://cve.now/CVE-2026-87983.md): An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using (CVSS 9.2, mistralai mistral-vibe)
- [CVE-2026-82578](https://cve.now/CVE-2026-82578.md): NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference (CVSS 7.5, NextGen Healthcare Mirth Connect)
- [CVE-2026-78224](https://cve.now/CVE-2026-78224.md): NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference (CVSS 8.2, NextGen Healthcare Mirth Connect)
- [CVE-2026-82583](https://cve.now/CVE-2026-82583.md): NextGen Healthcare Mirth Connect SQL Injection (CVSS 8.3, NextGen Healthcare Mirth Connect)
- [CVE-2026-8303](https://cve.now/CVE-2026-8303.md): Privilege Escalation in TUBITAK BILGEM's Pardus-software (CVSS 7.8, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-87020](https://cve.now/CVE-2026-87020.md): Orthanc DICOM Server Integer Overflow or Wraparound (CVSS 8.1, Orthanc DICOM Server)
- [CVE-2026-15710](https://cve.now/CVE-2026-15710.md): Netskope Client Endpoint DLP Kernel Driver Information Leakage (CVSS 6.8, Netskope Endpoint DLP)
- [CVE-2026-57843](https://cve.now/CVE-2026-57843.md): NetBSD mm\_open() PK\_KMEM Flag Kernel Pointer Information Disclosure (CVSS 6.8, The NetBSD Foundation NetBSD)
- [CVE-2026-57842](https://cve.now/CVE-2026-57842.md): NetBSD COMPAT\_NETBSD32 Double Free / Use-After-Free via recvmsg() msg\_iovlen (CVSS 7.3, The NetBSD Foundation NetBSD)
- [CVE-2026-71416](https://cve.now/CVE-2026-71416.md): Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) (CVSS 8.8, headroomlabs-ai headroom · headroom-ai)
- [CVE-2026-89298](https://cve.now/CVE-2026-89298.md): Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get (CVSS 4.9, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-89212](https://cve.now/CVE-2026-89212.md): XML External Entity in Akana API Platform (CVSS 9.2, Perforce Akana)
- [CVE-2026-11765](https://cve.now/CVE-2026-11765.md): Argument Injection in TUBITAK BILGEM's Pardus Pen (CVSS 3.3, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-80462](https://cve.now/CVE-2026-80462.md): Privilege Escalation in Progress Chef Automate (CVSS 10.0, Progress Software Chef Automate)
- [CVE-2026-84390](https://cve.now/CVE-2026-84390.md): A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7 (CVSS 9.6, Fortinet FortiMonitorOnSight)
- [CVE-2026-86793](https://cve.now/CVE-2026-86793.md): CVE-2026-86793 (CVSS 9.8, SGLang)
- [CVE-2024-12145](https://cve.now/CVE-2024-12145.md): BuddyPress \<= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion (CVSS 4.3, BuddyPress)
- [CVE-2026-87776](https://cve.now/CVE-2026-87776.md): compression vulnerable to Denial of Service via memory leak on premature response close (CVSS 7.5, compression)
- [CVE-2026-89259](https://cve.now/CVE-2026-89259.md): Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS (CVSS 9.3, gohugoio hugo)
- [CVE-2026-89258](https://cve.now/CVE-2026-89258.md): Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get (CVSS 9.3, gohugoio hugo)
- [CVE-2026-89257](https://cve.now/CVE-2026-89257.md): AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check (CVSS 5.3, WWBN AVideo)
- [CVE-2026-89256](https://cve.now/CVE-2026-89256.md): AVideo Bookmark Plugin Stored XSS via Chapter Names (CVSS 9.3, WWBN AVideo)
- [CVE-2026-89255](https://cve.now/CVE-2026-89255.md): AVideo LoginControl Stored XSS via PGP Public Key (CVSS 9.3, WWBN AVideo)
- [CVE-2026-89254](https://cve.now/CVE-2026-89254.md): AVideo CustomizeUser Stored XSS via field\_name Parameter (CVSS 9.3, WWBN AVideo)
- [CVE-2026-89253](https://cve.now/CVE-2026-89253.md): AVideo Stored XSS via donationLink in watch page button (CVSS 9.3, WWBN AVideo)
- [CVE-2026-89252](https://cve.now/CVE-2026-89252.md): AVideo Missing Authorization in addLiveLink.php LiveLink Update (CVSS 7.1, WWBN AVideo)
- [CVE-2026-89251](https://cve.now/CVE-2026-89251.md): AVideo Missing Authorization via AD\_Server log.php Wallet Credit (CVSS 7.1, WWBN AVideo)
- [CVE-2026-89250](https://cve.now/CVE-2026-89250.md): WWBN AVideo Unauthenticated File Read via getRecordedFile.php (CVSS 8.7, WWBN AVideo)
- [CVE-2026-89249](https://cve.now/CVE-2026-89249.md): AVideo YPTWallet Stored XSS via CryptoWallet Configuration (CVSS 9.3, WWBN AVideo)
- [CVE-2026-89248](https://cve.now/CVE-2026-89248.md): AVideo WebRTC Plugin Information Disclosure via status.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-89247](https://cve.now/CVE-2026-89247.md): WWBN AVideo XML Injection via plugin/AD\_Server/VMAP.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-89246](https://cve.now/CVE-2026-89246.md): WWBN AVideo CSV Formula Injection via myComments.download.php (CVSS 5.1, WWBN AVideo)
- [CVE-2026-89245](https://cve.now/CVE-2026-89245.md): WWBN AVideo Cross-Site Request Forgery via playlistRemove.php (CVSS 7.1, WWBN AVideo)
- [CVE-2026-89244](https://cve.now/CVE-2026-89244.md): WWBN AVideo Reflected XSS via Gallery Category getBackURL (CVSS 5.3, WWBN AVideo)
- [CVE-2026-89243](https://cve.now/CVE-2026-89243.md): WWBN AVideo Stored XSS via UserGroups setGroup\_name (CVSS 9.2, WWBN AVideo)
- [CVE-2026-89242](https://cve.now/CVE-2026-89242.md): WWBN AVideo Unauthenticated SSRF via login.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-89241](https://cve.now/CVE-2026-89241.md): WWBN AVideo Reflected XSS via confirmLivePassword.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-89240](https://cve.now/CVE-2026-89240.md): WWBN AVideo Reflected XSS via confirmLivePassword.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-89239](https://cve.now/CVE-2026-89239.md): WWBN AVideo Reflected XSS via Referer Header Comment Breakout (CVSS 5.3, WWBN AVideo)
- [CVE-2026-89148](https://cve.now/CVE-2026-89148.md): AVideo Open Redirect via playlistSort.php Referer Header (CVSS 5.1, WWBN AVideo)
- [CVE-2026-86813](https://cve.now/CVE-2026-86813.md): MetForm \< 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To (CVSS 4.8, MetForm)
- [CVE-2026-86809](https://cve.now/CVE-2026-86809.md): Persian Elementor \< 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass (CVSS 5.3, Persian Elementor)
- [CVE-2026-85116](https://cve.now/CVE-2026-85116.md): Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation (CVSS 6.5, Simple CAPTCHA with Cloudflare Turnstile)
- [CVE-2026-82215](https://cve.now/CVE-2026-82215.md): WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook (CVSS 5.9, Payment Gateway PayPay for WooCommerce)
- [CVE-2026-82213](https://cve.now/CVE-2026-82213.md): Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR (CVSS 5.3, Nexi XPay Build)
- [CVE-2026-89147](https://cve.now/CVE-2026-89147.md): Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read (CVSS 7.5, Net-SNMP)
- [CVE-2026-89146](https://cve.now/CVE-2026-89146.md): libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses (CVSS 7.5, libp2p-rendezvous)
- [CVE-2026-77159](https://cve.now/CVE-2026-77159.md): Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-87123](https://cve.now/CVE-2026-87123.md): hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping (CVSS 5.9, hbs)
- [CVE-2026-17037](https://cve.now/CVE-2026-17037.md): Kirki \<= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter (CVSS 7.2, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-87859](https://cve.now/CVE-2026-87859.md): morgan vulnerable to Log Injection via unescaped double quote in quoted log fields (CVSS 5.3, morgan)
- [CVE-2026-47839](https://cve.now/CVE-2026-47839.md): Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin (CVSS 9.2, Cloud Foundry Foundation UAA · Cloud Foundry Foundation cf-…)
- [CVE-2026-80469](https://cve.now/CVE-2026-80469.md): CVE-2026-80469 (CVSS 8.3, SICK AG Sentio Creator Extension 'Device Manager')
- [CVE-2026-19486](https://cve.now/CVE-2026-19486.md): SSRF in Gemini Enterprise Agent Platform App Builder (CVSS 8.7, Google Cloud Gemini Enterprise Agent Platform App Builder)
- [CVE-2026-87727](https://cve.now/CVE-2026-87727.md): a-blog cms Ver. (CVSS 6.5, appleple a-blog cms)
- [CVE-2025-15679](https://cve.now/CVE-2025-15679.md): BMC root account active without password on BullSequana XH3406 and XH3515 (CVSS 7.3, BullSequana XH3406 · BullSequana XH3515)
- [CVE-2026-6640](https://cve.now/CVE-2026-6640.md): Media Library Assistant \<= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla\_link\_attributes Parameter (CVSS 6.4, dglingren Media Library Assistant)
- [CVE-2026-6642](https://cve.now/CVE-2026-6642.md): Media Library Assistant \<= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import (CVSS 6.4, dglingren Media Library Assistant)
- [CVE-2026-6641](https://cve.now/CVE-2026-6641.md): Media Library Assistant \<= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla\_link\_href' Shortcode Parameter (CVSS 6.4, dglingren Media Library Assistant)
- [CVE-2026-89179](https://cve.now/CVE-2026-89179.md): Howyar｜WeenyGenius - Missing Support for Integrity Check (CVSS 5.3, Howyar WeenyGenius)
- [CVE-2026-89178](https://cve.now/CVE-2026-89178.md): Howyar｜WeenyGenius - Origin Validation Error (CVSS 8.7, Howyar WeenyGenius)
- [CVE-2026-89177](https://cve.now/CVE-2026-89177.md): Howyar｜WeenyGenius - Use of Insecure Protocol (CVSS 8.7, Howyar WeenyGenius)
- [CVE-2026-89176](https://cve.now/CVE-2026-89176.md): Howyar｜WeenyGenius - Missing Authentication (CVSS 8.7, Howyar WeenyGenius)
- [CVE-2026-89175](https://cve.now/CVE-2026-89175.md): Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication (CVSS 6.9, Kingdom Communication Associated EH3040 · Kingdom Commun… +2)
- [CVE-2026-89174](https://cve.now/CVE-2026-89174.md): Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection (CVSS 8.7, Kingdom Communication Associated EH3040 · Kingdom Commun… +2)
- [CVE-2026-89173](https://cve.now/CVE-2026-89173.md): Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure (CVSS 6.9, Kingdom Communication Associated EH3040 · Kingdom Commun… +2)
- [CVE-2026-73785](https://cve.now/CVE-2026-73785.md): HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability (CVSS 7.5, Hewlett Packard Enterprise HPE IceWall products)
- [CVE-2026-87908](https://cve.now/CVE-2026-87908.md): multiparty vulnerable to Denial of Service via unbounded part-header accumulation (CVSS 7.5, multiparty)
- [CVE-2026-73784](https://cve.now/CVE-2026-73784.md): HPE IceWall products, Remote Bypass of Security Restrictions (CVSS 8.8, Hewlett Packard Enterprise HPE IceWall products)
- [CVE-2026-13326](https://cve.now/CVE-2026-13326.md): Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module (CVSS 6.9, qt)
- [CVE-2026-86815](https://cve.now/CVE-2026-86815.md): BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes (CVSS 5.5, BackWPup)
- [CVE-2026-86812](https://cve.now/CVE-2026-86812.md): WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API (CVSS 6.5, WPCafe)
- [CVE-2026-86782](https://cve.now/CVE-2026-86782.md): Visualizer \< 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR (CVSS 5.5, Visualizer)
- [CVE-2026-86781](https://cve.now/CVE-2026-86781.md): SSL Zen \< 4.7.40 - Subscriber+ TLS Private Key Disclosure (CVSS 5.3, SSL Zen — SSL Certificate Installer & HTTPS Redirects)
- [CVE-2026-86780](https://cve.now/CVE-2026-86780.md): Featured Image with URL \< 1.0.6 - Contributor+ Stored XSS via Image Alt Text (CVSS 6.8, Featured Image with URL)
- [CVE-2026-86779](https://cve.now/CVE-2026-86779.md): Visualizer \< 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart (CVSS 2.7, Visualizer)
- [CVE-2026-85678](https://cve.now/CVE-2026-85678.md): AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript (CVSS 6.8, AI Builder)
- [CVE-2026-85677](https://cve.now/CVE-2026-85677.md): Gutenverse News \< 3.3.3 - Unauthenticated Stored XSS via Comment Content (CVSS 8.8, Gutenverse News)
- [CVE-2026-82305](https://cve.now/CVE-2026-82305.md): YITH WooCommerce Wishlist \< 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change\_wishlist\_title (CVSS 5.3, YITH WooCommerce Wishlist)
- [CVE-2026-74925](https://cve.now/CVE-2026-74925.md): MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator (CVSS 7.2, MultiVendorX)
- [CVE-2026-14566](https://cve.now/CVE-2026-14566.md): Advanced Customized Prompts \<= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering (CVSS 4.3, advanced-customized-prompts)
- [CVE-2026-14565](https://cve.now/CVE-2026-14565.md): Advanced Customized Prompts \<= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration (CVSS 5.4, advanced-customized-prompts)
- [CVE-2026-14563](https://cve.now/CVE-2026-14563.md): Advanced Customized Prompts \<= 1.0.1 - Unauthenticated Account Takeover (CVSS 9.8, advanced-customized-prompts)
- [CVE-2026-14562](https://cve.now/CVE-2026-14562.md): Teddy Bear Customize Addon \<= 1.0.5 - Unauthenticated Order Data Disclosure (CVSS 5.3, teddy-bear-customize-addon)
- [CVE-2026-14560](https://cve.now/CVE-2026-14560.md): Teddy Bear Customize Addon \<= 1.0.5 - Unauthenticated Arbitrary File Upload (CVSS 10.0, teddy-bear-customize-addon)
- [CVE-2026-14559](https://cve.now/CVE-2026-14559.md): Teddy Bear Customize Addon \<= 1.0.5 - Unauthenticated Account Takeover (CVSS 9.8, teddy-bear-customize-addon)
- [CVE-2025-15695](https://cve.now/CVE-2025-15695.md): GTranslate \< 3.0.10 - Admin+ Stored XSS (CVSS 3.5, Translate WordPress with GTranslate)
- [CVE-2026-83546](https://cve.now/CVE-2026-83546.md): CoolClock \< 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute (CVSS 6.8, CoolClock)
- [CVE-2026-83545](https://cve.now/CVE-2026-83545.md): CoolClock \< 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON (CVSS 6.8, CoolClock)
- [CVE-2026-89169](https://cve.now/CVE-2026-89169.md): live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. (CVSS 4.1, Debian live-boot)
- [CVE-2026-89060](https://cve.now/CVE-2026-89060.md): Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references (CVSS 7.7, multicluster-observability-addon · Red Hat Advanced Cluster…)
- [CVE-2026-89162](https://cve.now/CVE-2026-89162.md): In PCRE2 before 10.48, pcre2\_serialize\_encode might disclose two bytes to an adversary, typically in a situation where the access available (CVSS 2.9, PCRE2)
- [CVE-2026-89161](https://cve.now/CVE-2026-89161.md): In PCRE2 before 10.48, pcre2\_jit\_match mishandles a previously copied subject being passed in as a context. (CVSS 7.4, PCRE2)
- [CVE-2026-89160](https://cve.now/CVE-2026-89160.md): PCRE2 before 10.48 has a pcre2\_match out-of-bounds read during the PCRE2\_MATCH\_INVALID\_UTF matching of an invalid UTF subject. (CVSS 3.7, PCRE2)
- [CVE-2026-89158](https://cve.now/CVE-2026-89158.md): PCRE2 before 10.48, on 32-bit platforms, has a pcre2\_compile\_32 integer overflow and resultant out-of-bounds write. (CVSS 6.5, PCRE2)
- [CVE-2026-89157](https://cve.now/CVE-2026-89157.md): PCRE2 before 10.48, on 32-bit platforms, has a pcre2\_pattern\_convert out-of-bounds write when an attacker can provide a large pattern. (CVSS 5.7, PCRE2)
- [CVE-2026-89156](https://cve.now/CVE-2026-89156.md): PCRE2 before 10.48 has a pcre2\_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. (CVSS 2.9, PCRE2)
- [CVE-2026-78172](https://cve.now/CVE-2026-78172.md): Themify – WooCommerce Product Filter \<= 1.5.5 - Reflected Cross-Site Scripting (CVSS 6.1, themifyme Themify – WooCommerce Product Filter)
- [CVE-2026-7438](https://cve.now/CVE-2026-7438.md): Bold Timeline Lite \<= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, boldthemes Bold Timeline Lite)
- [CVE-2026-19991](https://cve.now/CVE-2026-19991.md): UsersWP \<= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-18562](https://cve.now/CVE-2026-18562.md): HUSKY \<= 1.4.3 - Reflected Cross-Site Scripting (CVSS 6.1, realmag777 HUSKY – Products Filter for WooCommerce Professi…)
- [CVE-2026-19985](https://cve.now/CVE-2026-19985.md): Relevanssi \<= 4.28.1 - Reflected Cross-Site Scripting (CVSS 6.1, comesio Relevanssi – A Better Search)
- [CVE-2026-11446](https://cve.now/CVE-2026-11446.md): Booktics – Booking Calendar for Appointments and Service Businesses \<= 1.0.23 - Missing Authorization (CVSS 5.3, arraytics Booktics – Appointment Booking Calendar for Servi…)
- [CVE-2026-81754](https://cve.now/CVE-2026-81754.md): Vigilant \<= 2.10.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, fernandot Vigilant – 100% Free Security Suite: Firewall, 2F…)
- [CVE-2026-8778](https://cve.now/CVE-2026-8778.md): MIPL Grouped Checkout Fields for WooCommerce \<= 1.2.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, mulika MIPL Grouped Checkout Fields for WooCommerce. Custom…)
- [CVE-2026-84960](https://cve.now/CVE-2026-84960.md): WP-Members Membership Plugin \<= 3.5.6 - Reflected Cross-Site Scripting (CVSS 6.1, cbutlerjr WP-Members Membership Plugin)
- [CVE-2026-18561](https://cve.now/CVE-2026-18561.md): Unlimited Elements For Elementor \<= 2.0.16 - Unauthenticated SQL Injection (CVSS 7.5, unitecms Unlimited Elements For Elementor)
- [CVE-2026-18964](https://cve.now/CVE-2026-18964.md): Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \<= 3.5.9 - Reflected Cross-Site Scripting (CVSS 6.1, premio Floating Chat Widget: Contact Chat Icons, Telegram C…)
- [CVE-2026-81825](https://cve.now/CVE-2026-81825.md): Simple Ajax Chat \<= 20260811 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, specialk Simple Ajax Chat – Add a Fast, Secure Chat Box)
- [CVE-2026-11496](https://cve.now/CVE-2026-11496.md): Woo PDF Invoice Builder \<= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure (CVSS 6.5, edgarrojas PDF Builder for WooCommerce. Create invoices,pac…)
- [CVE-2026-12215](https://cve.now/CVE-2026-12215.md): OTP Login & Register Woocommerce \<= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force (CVSS 5.3, xootix OTP Login & Register Woocommerce)
- [CVE-2026-77150](https://cve.now/CVE-2026-77150.md): Unlimited Elements For Elementor \<= 2.0.16 - Reflected Cross-Site Scripting (CVSS 6.1, unitecms Unlimited Elements For Elementor)
- [CVE-2026-15462](https://cve.now/CVE-2026-15462.md): Sticky Chat Widget \<= 1.4.2 - Unauthenticated SQL Injection (CVSS 7.5, gingerplugins Sticky Chat Widget – Floating Chat Icons, Con…)
- [CVE-2026-18579](https://cve.now/CVE-2026-18579.md): WP Photo Album Plus \<= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, opajaap WP Photo Album Plus)
- [CVE-2026-88260](https://cve.now/CVE-2026-88260.md): Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzco (CVSS 8.7, Brainzcompany Zenius EMS)
- [CVE-2026-89151](https://cve.now/CVE-2026-89151.md): Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature. (CVSS 3.5, Forgejo)
- [CVE-2026-78135](https://cve.now/CVE-2026-78135.md): libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. (CVSS 5.6, strongSwan)
- [CVE-2026-78134](https://cve.now/CVE-2026-78134.md): strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatche (CVSS 7.1, strongSwan)
- [CVE-2026-78133](https://cve.now/CVE-2026-78133.md): libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling. (CVSS 7.5, strongSwan)
- [CVE-2026-78132](https://cve.now/CVE-2026-78132.md): strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax. (CVSS 7.5, strongSwan)
- [CVE-2026-88914](https://cve.now/CVE-2026-88914.md): Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser (CVSS 4.4, Red Hat Enterprise Linux)
- [CVE-2026-78131](https://cve.now/CVE-2026-78131.md): strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parse (CVSS 3.7, strongSwan)
- [CVE-2026-78130](https://cve.now/CVE-2026-78130.md): strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser. (CVSS 7.5, strongSwan)
- [CVE-2026-78129](https://cve.now/CVE-2026-78129.md): strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. (CVSS 5.9, strongSwan)
- [CVE-2026-78127](https://cve.now/CVE-2026-78127.md): libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser. (CVSS 3.7, strongSwan)
- [CVE-2026-78126](https://cve.now/CVE-2026-78126.md): strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin. (CVSS 5.9, strongSwan)
- [CVE-2026-78124](https://cve.now/CVE-2026-78124.md): strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after i (CVSS 3.7, strongSwan)
- [CVE-2026-78123](https://cve.now/CVE-2026-78123.md): strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. (CVSS 5.9, strongSwan)
- [CVE-2026-89092](https://cve.now/CVE-2026-89092.md): Stack overflow in nscd due to unbounded alloca use (CVSS 4.2, The GNU C Library glibc)
- [CVE-2026-89145](https://cve.now/CVE-2026-89145.md): Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory (CVSS 2.4, flextype)
- [CVE-2025-69904](https://cve.now/CVE-2025-69904.md): Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipul (CVSS 4.9)
- [CVE-2026-52630](https://cve.now/CVE-2026-52630.md): SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the (CVSS 9.8)
- [CVE-2026-71641](https://cve.now/CVE-2026-71641.md): An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a den (CVSS 7.5)
- [CVE-2026-71644](https://cve.now/CVE-2026-71644.md): An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe tr (CVSS 9.8)
- [CVE-2026-71646](https://cve.now/CVE-2026-71646.md): An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial (CVSS 7.5)
- [CVE-2026-78807](https://cve.now/CVE-2026-78807.md): An issue in wpa\_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA c (CVSS 7.1)
- [CVE-2026-79035](https://cve.now/CVE-2026-79035.md): A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to (CVSS 6.1)
- [CVE-2026-79362](https://cve.now/CVE-2026-79362.md): Certain Woltlab products are affected by RCE via Cache Poisoning. (CVSS 8.8)
- [CVE-2026-79393](https://cve.now/CVE-2026-79393.md): A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera (CVSS 7.5)
- [CVE-2026-79394](https://cve.now/CVE-2026-79394.md): An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT (CVSS 7.5)
- [CVE-2026-79395](https://cve.now/CVE-2026-79395.md): An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongma (CVSS 9.8)
- [CVE-2026-79396](https://cve.now/CVE-2026-79396.md): Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credenti (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.