CVEs published September 17, 2026
1,031 CVEs were published on September 17, 2026: 84 critical, 342 high. 1 is now in CISA KEV.
- Published
- 1,031
- Critical
- 84
- High
- 342
- Medium
- 143
- Low
- 30
- Unrated
- 432
- Now in CISA KEV
- 1
- Fix available
- 901
Most affected products
- Linux
- 598
- patriksimek vm2 · vm2
- 30
- Dell OpenManage Server Administrator Managed Node (Patch… +2
- 21
- Google Chrome
- 16
- Qualcomm Snapdragon
- 15
- team-alembic ash_authentication
- 13
- MidnightBSD mport
- 12
- cubecart
- 7
- Acer System Monitoring
- 5
- AsyncHttpClient async-http-client · org.asynchttpclient:asy…
- 4
Critical 84
- CVE-2026-69843Microsoft Fabric Elevation of Privilege VulnerabilityMicrosoft Fabric
- CVE-2026-85878Azure Database for PostgreSQL Elevation of Privilege VulnerabilityMicrosoft Azure HorizonDB
- CVE-2026-62874Azure Billing Elevation of Privilege VulnerabilityMicrosoft Azure Billing
- CVE-2026-85889Azure AI Foundry Elevation of Privilege VulnerabilityMicrosoft Azure AI Foundry
- CVE-2026-70200Azure Logic Apps Elevation of Privilege VulnerabilityMicrosoft Azure Logic Apps
- CVE-2026-87701Azure Cosmos DB Elevation of Privilege VulnerabilityMicrosoft Azure Cosmos DB
- CVE-2026-83944Azure Logic Apps Elevation of Privilege VulnerabilityMicrosoft Azure Logic Apps
- CVE-2026-85885Microsoft 365 Copilot Elevation of Privilege VulnerabilityMicrosoft 365 Copilot
- CVE-2026-69399Azure Arc Elevation of Privilege VulnerabilityMicrosoft Azure ARC
- CVE-2026-77903Microsoft Dataverse Elevation of Privilege VulnerabilityMicrosoft Dataverse
- CVE-2026-69865Microsoft Container Registry Elevation of Privilege VulnerabilityMicrosoft Azure Container Registry
- CVE-2026-70009Azure Arc Elevation of Privilege VulnerabilityMicrosoft Azure ARC
- CVE-2026-54734Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extractionprebid-server-java
- CVE-2026-76949Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementteam-alembic ash_authentication
- CVE-2026-54767WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.phpLabRedesCefetRJ WeGIA
- CVE-2026-54670WeGIA: Unauthenticated Auth Bypass + Local File InclusionLabRedesCefetRJ WeGIA
- CVE-2026-73639Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8Imager-File-PNG · Imager
- CVE-2026-93373Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandboxGoogle Chrome
- CVE-2026-93372Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside tGoogle Chrome
- CVE-2026-93374Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary codeGoogle Chrome
- CVE-2026-93393Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamMongoDB C Driver
- CVE-2026-54501Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviorswebrecorder browsertrix
- CVE-2026-54237Wavelog: Unauthenticated Remote Code Executionwavelog
- CVE-2026-45140Chamilo LMS CStudio upload flow allows unauthenticated remote code executionchamilo-lms · chamilo/chamilo-lms
- CVE-2026-45143Chamilo LMS: Student-to-admin stored XSS in private messages via v-htmlchamilo-lms
- CVE-2026-54460OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeoveropen-reception appointment-booking-software
- CVE-2026-54752NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Requestnetbox-community devicetype-library
- CVE-2026-54627SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)HappySeaFox sail
- CVE-2026-54626SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)HappySeaFox sail
- CVE-2026-54618Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the userjimprosser obsidian-web-mcp
- CVE-2026-54617GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandlerGravitLauncher Launcher · pro.gravit.launcher:launchserver-…
- CVE-2026-47252Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)julien040 anyquery · github.com/julien040/anyquery/plugi… +4
- CVE-2026-54053Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaultsbrufdev many-notes
- CVE-2026-92489xfrm: Fix skb double-free in xfrm_dev_direct_output()Linux
- CVE-2026-90414IB/isert: reject PDUs declaring more data than was receivedLinux
- CVE-2026-90413IB/isert: reject login PDUs declaring more data than was receivedLinux
- CVE-2026-90235sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCELinux
- CVE-2026-90230nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()Linux
- CVE-2026-90173smb: smbdirect: free completion queues with ib_free_cq()Linux
- CVE-2026-90151NFSv4: remove callback IDR entry on client allocation failureLinux
- CVE-2026-90110inetpeer: randomize RB-tree node comparison using SipHashLinux
- CVE-2026-90104NFSv4.1: zero referring call lists before decodingLinux
- CVE-2026-86863pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication modepgadmin.org pgAdmin
- CVE-2026-91039dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverteam-alembic ash_authentication
- CVE-2026-76834b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Keyb2evolution CMS
- CVE-2026-79752CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectioncakephp · cakephp/database +1
- CVE-2026-63472Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verificationvendurehq vendure · @vendure/core
- CVE-2026-88952OAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-92960vm2 before 3.11.6 Process-wide State Exposure via os and dnspatriksimek vm2 · vm2
- CVE-2026-92957vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefixpatriksimek vm2 · vm2
- CVE-2026-92956vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreamingpatriksimek vm2 · vm2
- CVE-2026-92955vm2 before 3.11.8 Sandbox Escape via NodeVMpatriksimek vm2 · vm2
- CVE-2026-92954vm2 3.10.0 through 3.11.7 Denial of Service via Host Promisepatriksimek vm2 · vm2
- CVE-2026-92953vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArraypatriksimek vm2 · vm2
- CVE-2026-92951vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolverpatriksimek vm2 · vm2
- CVE-2026-92950vm2 before 3.11.7 Sandbox Escape via CLI requirepatriksimek vm2 · vm2
- CVE-2026-92948vm2 3.9.6 through 3.11.5 Sandbox Escape via node:testpatriksimek vm2 · vm2
- CVE-2026-92947vm2 before 3.11.7 Memory Disclosure via Buffer Poolpatriksimek vm2 · vm2
- CVE-2026-92946vm2 before 3.11.7 Remote Code Execution via require.externalpatriksimek vm2 · vm2
- CVE-2026-92944vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protectorpatriksimek vm2 · vm2
- CVE-2026-92941vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulationpatriksimek vm2 · vm2
- CVE-2026-92940vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgentpatriksimek vm2 · vm2
- CVE-2026-92939vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEnginepatriksimek vm2 · vm2
- CVE-2026-92938vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlitepatriksimek vm2 · vm2
- CVE-2026-92937vm2 3.11.6 Remote Code Execution via Promise call/applypatriksimek vm2 · vm2
- CVE-2026-92935vm2 NodeVM Remote Code Execution via Array-Shaped Requirepatriksimek vm2 · vm2
- CVE-2026-92934vm2 before 3.11.8 Sandbox Escape RCE via AggregateErrorpatriksimek vm2 · vm2
- CVE-2026-62108WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerabilityminiOrange Headless Single Sign On
- CVE-2026-62104WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerabilitysuperweby Migratico Lite
- CVE-2026-62101WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerabilityChris Åkerfeldt Wendel EduAdmin Booking
- CVE-2026-85500`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-86533Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenixteam-alembic ash_authentication · team-alembic ash_authenti…
- CVE-2026-82761Magic link single-use tokens replayable via TOCTOU race in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-92860rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validationrcourtman Pulse
- CVE-2026-90823FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /uFatPipe Networks MPVPN · FatPipe Networks WARP +1
- CVE-2026-90822FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerabiliFatPipe Networks MPVPN · FatPipe Networks WARP +1
- CVE-2026-92913AVideo Weak PRNG Activation Code Authentication BypassWWBN AVideo
- CVE-2026-15688Password Authentication Bypass Vulnerability in GX Works3 and Motion Control SettingMitsubishi Electric GX Works3 · Mitsubishi Electric Motion…
- CVE-2026-88795wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API TokenwpShopGermany IT-RECHT KANZLEI
- CVE-2026-86710Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' ParameterLogin with QR
- CVE-2026-86709The Pressengine <= 1.0 - Unauthenticated Authentication BypassThe Pressengine
- CVE-2026-86707Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' ParameterPrivate Feed Key
- CVE-2026-87796Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Uploadsh1zen Multi Uploader for Gravity Forms
- CVE-2025-55787In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.
High 342
- CVE-2026-93453SOGo before 5.12.11 Password Reset Token Interception via Origin HeaderAlinto SOGo
- CVE-2026-93452snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compressxerial snappy-java
- CVE-2026-93450go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshalgo-openapi swag
- CVE-2026-85887M365 Copilot Information Disclosure VulnerabilityMicrosoft 365 Copilot
- CVE-2026-83946Azure Portal Spoofing VulnerabilityMicrosoft Azure Portal
- CVE-2026-87886Local privilege escalation due to insecure file permissions.Acronis Backup plugin for cPanel & WHM · Acronis Backup… +1
- CVE-2026-85917Azure AI Foundry Elevation of Privilege VulnerabilityMicrosoft Azure AI Foundry
- CVE-2026-78501Microsoft 365 Copilot Business Chat Information Disclosure VulnerabilityMicrosoft 365 Copilot's Business Chat
- CVE-2026-68791Azure Machine Learning Information Disclosure VulnerabilityMicrosoft Azure Machine Learning
- CVE-2026-93436vLLM through 0.29.0 Memory Exhaustion via Rejected Requestsvllm-project vllm · vllm
- CVE-2026-93435redis-parser through 3.0.0 Denial of Service via Unbounded RecursionNodeRedis redis-parser
- CVE-2026-54647CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.phpcubecart
- CVE-2026-54646CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.phpcubecart
- CVE-2026-54519AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletionvmDeshpande ai-agent-automation
- CVE-2026-86688Session id is not renewed on authentication in ash_authentication, allowing session fixationteam-alembic ash_authentication
- CVE-2026-54520AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directoryvmDeshpande ai-agent-automation
- CVE-2026-54671WeGIA: Authorization Bypass via Empty Resource Array in InternoControleLabRedesCefetRJ WeGIA
- CVE-2026-54634Hamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory DisclosureHamlib
- CVE-2026-54608MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-upMythicalLTD MythicalDash
- CVE-2026-54506Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio fieldgivanz Vvveb
- CVE-2026-54612Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-globalgivanz Vvveb
- CVE-2026-54507Vvveb oEmbedProxy vulnerable to server-side request forgerygivanz Vvveb
- CVE-2026-50158yutu: Arbitrary File Write via MCP `caption-download` Tooleat-pray-ai yutu · github.com/eat-pray-ai/yutu
- CVE-2026-53534JabRef CAYW Sublime Text integration permits operating-system command injectionjabref
- CVE-2026-53557SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Executiondataease SQLBot
- CVE-2026-53554SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processingdataease SQLBot
- CVE-2026-54343Frappe LMS: Path Traversal in SCORM File Servingfrappe lms
- CVE-2026-93426SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Namessignoz
- CVE-2026-93377Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary coGoogle Chrome
- CVE-2026-93381Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to pGoogle Chrome
- CVE-2026-93382Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via Google Chrome
- CVE-2026-93375Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execGoogle Chrome
- CVE-2026-77615Paella Player: Stored XSS via caption cue textopencast · polimediaupv paella-player +2
- CVE-2026-15815CVE-2026-15815 CVE RecordGrafana OSS · Grafana Enterprise
- CVE-2026-54597ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameteritflow-org itflow
- CVE-2026-54596ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltrationitflow-org itflow
- CVE-2026-86049Jupyter Server: 5xx request logging leaks token-bearing Referer header valuesjupyter-server jupyter_server · jupyter-server
- CVE-2026-48977OpenSlide: Arbitrary memory write with crafted Ventana BIF fileopenslide
- CVE-2026-68523Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of servicefulgur-rs fulgur · fulgur
- CVE-2026-54354MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query TranslationMapServer
- CVE-2026-76154CVE-2026-76154 CVE RecordGrafana OSS · Grafana Enterprise
- CVE-2026-54339Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discoverLeslieLeung glean
- CVE-2026-54510Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hookmurtaza-nasir speakr
- CVE-2026-68537Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of servicefulgur-rs fulgur · fulgur
- CVE-2026-50277dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoSDataDog dd-trace-cpp
- CVE-2026-50275Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoSDataDog dd-trace-php
- CVE-2026-54916NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theftnetbox-community devicetype-library
- CVE-2026-50125MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory ExhaustionStacklokLabs mkp · github.com/StacklokLabs/mkp
- CVE-2026-50285Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callbackpomerium · github.com/pomerium/pomerium
- CVE-2026-54692SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)HappySeaFox sail
- CVE-2026-54716Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targetsvalhalla
- CVE-2026-45720Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session tokensiderolabs omni · github.com/siderolabs/omni
- CVE-2026-45726Omni: Reader-level users can retrieve imported cluster CA keys via ResourceServicesiderolabs omni · github.com/siderolabs/omni
- CVE-2026-93337NetworkManager-l2tp Privilege Escalation via pppd Plugin Injectionnm-l2tp NetworkManager-l2tp
- CVE-2026-92943Improper validation of certificate with host mismatch in AWS IoT Device SDK for PythonAWSIoTPythonSDK
- CVE-2026-90997Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatchKeycloak · Red Hat Build of Keycloak
- CVE-2026-19477Stack-based Buffer Overflow Vulnerability in Linux (uldaq)MCC Universal Library for Linux
- CVE-2026-92230Apache Karaf: Improper release of ClassLoader references via static ThreadLocal cachingApache Software Foundation Apache Karaf
- CVE-2026-54253TS3 Manager: Reflected XSS via /api/download port parameter steals operator sessionjoni1802 ts3-manager
- CVE-2026-54504MCP Documentation Server: Web UI API binds to all interfaces without authentication by defaultandrea9293 mcp-documentation-server · @andrea9293/mcp-docum…
- CVE-2026-54524Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Reportfrappe hrms
- CVE-2026-52851Traccar: Authenticated Blind SQL Injection in DELETE /api/permissionstraccar
- CVE-2026-54571ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of serviceESP32Async ESPAsyncWebServer
- CVE-2026-54239FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelopewpengine faustjs
- CVE-2026-55062uniget: Path Traversal in Hook Files - Directory Escape Vulnerabilityuniget-org cli · gitlab.com/uniget-org/cli
- CVE-2026-52727lxc-ci: Pacman keyring stored in archlinux image with a private keylxc-ci
- CVE-2026-54451Elixir protobuf: Unbounded recursion depth in embedded-message decodingelixir-protobuf protobuf
- CVE-2026-52836OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of serviceOpenDDS
- CVE-2026-54446NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP ModeLabs64 NetLicensing-MCP · netlicensing-mcp
- CVE-2026-44236rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_maxalanxz rabbitmq-c
- CVE-2026-54580mport index decompression can leave partial or corrupt index data after zstd failuresMidnightBSD mport
- CVE-2026-54583mport package bundle downloads allow unsafe destination filenamesMidnightBSD mport
- CVE-2026-54581mport bootstrap index fetch can continue after hash verification failureMidnightBSD mport
- CVE-2026-28326SolarWinds Access Rights Manager Unauthenticated Remote Code Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2026-93296MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legendsmisp
- CVE-2026-93292SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builderssignoz
- CVE-2026-93295MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Executionmisp
- CVE-2026-93203batman-adv: bla: avoid CRC corruption due to parallel claim addLinux
- CVE-2026-93201dm-pcache: validate seg_id fields from persistent memoryLinux
- CVE-2026-93196nvdimm: virtio_pmem: refcount requests for token lifetimeLinux
- CVE-2026-93192drm/v3d: Clear queue->active_job when v3d_fence_create() failsLinux
- CVE-2026-93190platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap countLinux
- CVE-2026-93189HID: core: quiesce input in hid_hw_stop() to prevent use-after-freeLinux
- CVE-2026-93178drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookupLinux
- CVE-2026-93177drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookupLinux
- CVE-2026-93176drm/amd/display: Fix dangling pointer in plane reset functionLinux
- CVE-2026-93175drm/amd/display: Fix dangling pointer in CRTC reset functionLinux
- CVE-2026-93170dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlersLinux
- CVE-2026-93165platform/chrome: sensorhub: Fix memory overread in ring handlerLinux
- CVE-2026-93154RDMA/irdma: Add refcounting to user ring MRsLinux
- CVE-2026-93151nvmet-rdma: fix response resource leak on queue teardownLinux
- CVE-2026-93148bpf: Reject MEM_ALLOC BTF accesses past object boundsLinux
- CVE-2026-93147s390/bpf: Replace ly instruction with llgfLinux
- CVE-2026-93144bpf: Reject writes through untrusted BTF pointersLinux
- CVE-2026-93138bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinuxLinux
- CVE-2026-93137bpf: Fix use-after-free on mm_struct in bpf_find_vma()Linux
- CVE-2026-93127bpf: Drop scalar id on sign-extending narrowing stack fillsLinux
- CVE-2026-93125bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 maxLinux
- CVE-2026-93122usb: gadget: uac: validate rate list length before storingLinux
- CVE-2026-93121usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error pathsLinux
- CVE-2026-93116platform/x86: asus-wmi: fix resource leaks on probe failureLinux
- CVE-2026-93112bpf: Require a BPF cpumask for bpf_cpumask_populate()Linux
- CVE-2026-93111bpf: Mark tracing_multi trampolines as ftrace managedLinux
- CVE-2026-93107RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error stateLinux
- CVE-2026-93105esp: do not unref managed frag pages in esp_ssg_unref()Linux
- CVE-2026-93095hfsplus: validate thread record before delete key rebuildLinux
- CVE-2026-93079cxl/features: Reject Get Feature count larger than the output bufferLinux
- CVE-2026-93074dax/fsdev: use __va(phys) for kaddr in direct_accessLinux
- CVE-2026-93070media: ipu6: Do not free aux device pdata after initLinux
- CVE-2026-93063wifi: iwlwifi: mei: check SAP message length before reading itLinux
- CVE-2026-93054uio: Fix stale info pointer in failed registration pathLinux
- CVE-2026-93046software node: Fix software_node_get_reference_args() with index -1Linux
- CVE-2026-93045bpf: Reject arena frees below the arena baseLinux
- CVE-2026-93042dmaengine: dw-edma: Terminate all descriptors without callbacksLinux
- CVE-2026-93039ASoC: meson: Keep link pointers valid on realloc failureLinux
- CVE-2026-93037RDMA/hfi1: Propagate sdma_txinit_ahg() errorsLinux
- CVE-2026-92525RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]Linux
- CVE-2026-92522ACPI: processor: validate MADT IOAPIC entry boundsLinux
- CVE-2026-92518riscv, bpf: Fix kernel stack corruption in tailcall with CFILinux
- CVE-2026-92511RDMA/core: Fix potential use after free in ib_destroy_cq_user()Linux
- CVE-2026-92510RDMA/core: Fix potential use after free in ib_destroy_srq_user()Linux
- CVE-2026-92508RDMA/core: Fix potential use after free in ib_free_cq()Linux
- CVE-2026-92507RDMA/core: Fix potential use after free in ib_dealloc_pd_user()Linux
- CVE-2026-92504thermal: intel: int3400: clean up ODVP on probe failuresLinux
- CVE-2026-92488RDMA/erdma: complete object teardown when the destroy command failsLinux
- CVE-2026-92485bpf: Fix WARNING in bpf_tracing_link_releaseLinux
- CVE-2026-90435RDMA/mlx5: Fix integer overflow of user QP buffer sizeLinux
- CVE-2026-90429iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)initLinux
- CVE-2026-90427iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()Linux
- CVE-2026-90425iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSIDLinux
- CVE-2026-90423RDMA/rxe: Fix UAF in ODP init error-handling pathLinux
- CVE-2026-90419nilfs2: prevent out-of-bounds read in super root block parsingLinux
- CVE-2026-90408wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()Linux
- CVE-2026-90407wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()Linux
- CVE-2026-90403wifi: rtlwifi: pci: fix error path in rtl_pci_probe()Linux
- CVE-2026-90402bus: mhi: host: Fix controller cleanup on EDL sysfs failureLinux
- CVE-2026-90401md: remove REQ_NOWAIT support from raid1/10/456Linux
- CVE-2026-90399wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()Linux
- CVE-2026-90398wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()Linux
- CVE-2026-90392bpf: Fix potential UAF when reading bpf link infoLinux
- CVE-2026-90388iommu/dma: Check atomic pool allocation result directlyLinux
- CVE-2026-90387swiotlb: Preserve allocation virtual address for dynamic poolsLinux
- CVE-2026-90383misc: sgi-gru: remove interrupt-context page-table walksLinux
- CVE-2026-90381wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()Linux
- CVE-2026-90380wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_completeLinux
- CVE-2026-90379wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crashLinux
- CVE-2026-90372wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nssLinux
- CVE-2026-90371wifi: mt76: fix RXDMAD_C buffer recycling raceLinux
- CVE-2026-90367wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SERLinux
- CVE-2026-90358bpf, x86: Fix trampoline stack size for 128-bit argumentsLinux
- CVE-2026-90357wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreementLinux
- CVE-2026-90353wifi: mt76: mt7915: fix ext PHY use-after-free on register error pathLinux
- CVE-2026-90347arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entryLinux
- CVE-2026-90343wifi: cfg80211: stop PMSR before P2P and NAN teardownLinux
- CVE-2026-90341firmware: coreboot: Validate table boundsLinux
- CVE-2026-90332PCI: dwc: ep: Flush cached MSI write before unmapping the iATULinux
- CVE-2026-90329HID: synchronize input before cleaning up a failed probeLinux
- CVE-2026-90326blk-cgroup: fix race between policy activation and blkg destructionLinux
- CVE-2026-90325blk-cgroup: skip dying blkg in blkcg_activate_policy()Linux
- CVE-2026-90324ublk: check import_ubuf() return valueLinux
- CVE-2026-90321ocfs2: validate inline xattrs during inode block validationLinux
- CVE-2026-90320ocfs2: validate external xattr entries when reading metadataLinux
- CVE-2026-90317bpf: Invalidate RCU pointers after final spin unlockLinux
- CVE-2026-90316drm/omap: dsi: Do not copy isr tableLinux
- CVE-2026-90312bpf: Check load-acquire src ptr type before the loadLinux
- CVE-2026-90309RDMA/erdma: Hold CQ references when processing EQ eventsLinux
- CVE-2026-90308RDMA/erdma: Hold QP references for AE and CM processingLinux
- CVE-2026-90301ocfs2: o2hb: quiesce negotiate handlers and timeout workLinux
- CVE-2026-90294IB/isert: delay the final Login Response until the session is registeredLinux
- CVE-2026-90293IB/isert: post the full-feature receive buffers after session registrationLinux
- CVE-2026-90292RDMA/siw: Fix use-after-free in siw_accept()Linux
- CVE-2026-90291module/dups: Fix use-after-free in kmod_dup_req lifetime handlingLinux
- CVE-2026-90289drm/amd/display: Resize MST HDCP per-connector arrays to 32Linux
- CVE-2026-90288phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failureLinux
- CVE-2026-90286drm/amdgpu/gfx6: Use PFP on the compute queues tooLinux
- CVE-2026-90268scsi: sd: Fix error handling in sd_probe() after large pool creation failureLinux
- CVE-2026-90260btrfs: zoned: don't clobber the extent buffer when zeroing it outLinux
- CVE-2026-90256Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_indLinux
- CVE-2026-90255Bluetooth: hci_conn: fix the SCO setup context lifetimeLinux
- CVE-2026-90246apparmor: fix integer overflow in verify_tags() bounds checkLinux
- CVE-2026-90244iommu/dma: Restore locking around msi_page_listLinux
- CVE-2026-90243iommu/vt-d: Clear Present bit before tearing down copied context entryLinux
- CVE-2026-90241iommu/vt-d: Tear down scalable-mode context on probe failureLinux
- CVE-2026-90240iommu/vt-d: Flush context cache with correct SID when tearing down aliasesLinux
- CVE-2026-90237netfilter: nft_ct: move custom expectation support to helperLinux
- CVE-2026-90234NFS: Return a delegation the client fails to recordLinux
- CVE-2026-90231apparmor: fix unconfined user namespace restriction forced stackLinux
- CVE-2026-90229nvme-apple: Destroy the admin queue on removalLinux
- CVE-2026-90228nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()Linux
- CVE-2026-90227nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()Linux
- CVE-2026-90225nfc: llcp: read llcp_sock->local under the socket lock in getsockoptLinux
- CVE-2026-90224nfc: nci: fix double completion race in nci_data_exchange_completeLinux
- CVE-2026-90223nfc: llcp: bound SNL TLV parsing to the skb and add length checksLinux
- CVE-2026-90217bpf: Compare iterator types during state pruningLinux
- CVE-2026-90210bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failureLinux
- CVE-2026-90207ALSA: seq: midi: Serialize input teardown with event_inputLinux
- CVE-2026-90205ocfs2: validate orphan slot during inode readLinux
- CVE-2026-90204ocfs2: validate DIO orphan slot during inode readLinux
- CVE-2026-90203Squashfs: check block offset is not negativeLinux
- CVE-2026-90199fs/ntfs3: reject out-of-range evcn in mi_enum_attr()Linux
- CVE-2026-90191mailbox: riscv-sbi-mpxy: validate RPMI notification lengthsLinux
- CVE-2026-90177bpf: Check pointer type for all atomic RMW pathsLinux
- CVE-2026-90176ksmbd: Do not skip lock checks for single-byte rangesLinux
- CVE-2026-90174ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()Linux
- CVE-2026-90172smb: smbdirect: destroy QP before mem pools on accept failureLinux
- CVE-2026-90162ksmbd: defer publishing granted locks to prevent UAF/double-free raceLinux
- CVE-2026-90161erofs: fix interlaced ztailpacking pclustersLinux
- CVE-2026-90153ksmbd: bound smb_check_perm_dacl() ACE walks by DACL sizeLinux
- CVE-2026-90149NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data serversLinux
- CVE-2026-90146bpf, xdp: move offload check into dev_xdp_install()Linux
- CVE-2026-90145hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failedLinux
- CVE-2026-90143net: kcm: Hold RCU read lock while running BPF parserLinux
- CVE-2026-90142virtio_net: Fix resize of the RX ringLinux
- CVE-2026-90141ipvs: fix integer overflow in ftp helper port/address parsingLinux
- CVE-2026-90137platform/x86: hp-bioscfg: fix password encoding bounds checkLinux
- CVE-2026-90133ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()Linux
- CVE-2026-90132ntfs: reject unprivileged writes to reserved $LX* xattrsLinux
- CVE-2026-90131ntfs: serialize resident iomap reads with mrec_lockLinux
- CVE-2026-90120irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsingLinux
- CVE-2026-90118ntfs: fix off-by-one page overflow in ntfs_decompress()Linux
- CVE-2026-90111ip6mr: do not clone dst in ip6mr_cache_report()Linux
- CVE-2026-90103NFSv4.2: fix LAYOUTSTATS send buffer exhaustionLinux
- CVE-2026-90102NFSv4/pnfs: key the data server cache on the NFS versionLinux
- CVE-2026-90093Bluetooth: L2CAP: access chan->conn safely in get/setsockoptLinux
- CVE-2026-90092Bluetooth: L2CAP: reject accept queue add unless BT_LISTENLinux
- CVE-2026-90091Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chanLinux
- CVE-2026-90089Bluetooth: btnxpuart: Validate the FW dump header lengthLinux
- CVE-2026-90071net/sched: sch_teql: restore skb->dev on the slave failure pathLinux
- CVE-2026-90069crypto: acomp - allocate async request context when cloningLinux
- CVE-2026-90067libceph: validate banner payload lengthLinux
- CVE-2026-90062netfilter: nf_tables: move hardware offload step after building the chain blobLinux
- CVE-2026-90059net: stmmac: restore NET_IP_ALIGN in the RX DMA offsetLinux
- CVE-2026-90057slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()Linux
- CVE-2026-90051tcp: reject non zerocopy devmem txLinux
- CVE-2026-92980HortusFox-Web < 6.1 Remote Code Execution via Import/Exportdanielbrendel hortusfox-web
- CVE-2026-85721AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-89036Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameterappwrite
- CVE-2026-85719AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTPAsyncHttpClient async-http-client
- CVE-2026-69197Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionUmbraco-CMS · Umbraco.Cms
- CVE-2026-81515Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)SteeltoeOSS security-advisories · Steeltoe.Discovery.Eureka
- CVE-2026-81516Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)SteeltoeOSS security-advisories · Steeltoe.Discovery.Consul
- CVE-2026-85715ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustionmattiasw ExifReader · exifreader
- CVE-2026-86864pgAdmin 4: Argument and connection-string injection via the database field in the Backup toolpgadmin.org pgAdmin
- CVE-2026-56795Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability.Dell Driver Pack For Windows OS · Dell Driver Pack For L… +2
- CVE-2026-86040libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoSjs-libp2p · @libp2p floodsub
- CVE-2026-86039libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addressesjs-libp2p · @libp2p/peer-store
- CVE-2026-86038libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer IDjs-libp2p · @libp2p/gossipsub
- CVE-2026-93015BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds WriteBlueKitchen BTstack
- CVE-2026-93014RosarioSIS before 12.9 Path Traversal in File Deletion via filename ParameterRosarioSIS
- CVE-2026-26950Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability.Dell SmartFabric Manager
- CVE-2026-87742Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message bufferingRed Hat build of Quarkus 3.27.5.SP2 · Red Hat build of Q… +2
- CVE-2026-63459Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptionsvendurehq vendure · @vendure/dashboard
- CVE-2026-63460Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backendsvendurehq vendure · @vendure/core
- CVE-2026-80356Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulDell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-71538@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windowscyclonedx-node-npm · @cyclonedx/cyclonedx-npm
- CVE-2026-81446Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-81445Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-85077Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responsessanic-org sanic
- CVE-2026-77614Opencast: Session fixation in login enables account takeover via crafted linkopencast
- CVE-2026-92987roxmltree through 0.21.1 Denial of Service via Quadratic ParsingRazrFalcon roxmltree
- CVE-2026-92986SiYuan before 3.8.4 Cross-Site Scripting via Document Titlesiyuan-note siyuan
- CVE-2026-92985SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labelssiyuan-note siyuan
- CVE-2026-92984HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifierhubzero-cms
- CVE-2026-92983InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID MismatchInternLM lmdeploy
- CVE-2026-81442Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-92961vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypasspatriksimek vm2 · vm2
- CVE-2026-92959vm2 before 3.11.8 allowAsync Bypass via Promise Thenablepatriksimek vm2 · vm2
- CVE-2026-92958vm2 before 3.11.7 Denylist Bypass via fs/promisespatriksimek vm2 · vm2
- CVE-2026-92952vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypasspatriksimek vm2 · vm2
- CVE-2026-92942vm2 before 3.11.7 Timeout Bypass via FinalizationRegistrypatriksimek vm2 · vm2
- CVE-2026-92972SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpointsgl-project sglang
- CVE-2026-92971InternLM LMDeploy through 0.17.0 Assertion Denial of ServiceInternLM lmdeploy
- CVE-2026-92970HUBzero CMS through 2.2.32 Path Traversal via File Uploadhubzero-cms
- CVE-2026-89418Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)protobuf-javascript
- CVE-2026-14850Weak password recovery mechanism for forgotten password in MobiAPParcMobiAPParc
- CVE-2026-90887WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityWP Inventory Manager
- CVE-2026-78295WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerabilityXagio SEO
- CVE-2026-66631WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerabilityMoreconvert Team MC Woocommerce Wishlist
- CVE-2026-66630WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerabilityPublishPress Series
- CVE-2026-66628WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerabilityWP Lab WP-Lister Lite for eBay
- CVE-2026-66626WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerabilitySonal S Sinha SKT Addons for Elementor
- CVE-2026-66625WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerabilityWCVendors WC Vendors Marketplace
- CVE-2026-66624WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerabilityLudwig You WPMasterToolKit
- CVE-2026-66619WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerabilityTribulant Software Newsletters
- CVE-2026-66618WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerabilityFlipper Code WP Maps
- CVE-2026-66580WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerabilityRexTheme Product Feed Manager
- CVE-2026-66571WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerabilityGabe Livan Asset CleanUp: Page Speed Booster
- CVE-2026-90986WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerabilityCODEPRESS IT Solutions Visitor Traffic Real Time Statistics…
- CVE-2026-81632Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixteam-alembic ash_authentication_phoenix · team-alembic ash_…
- CVE-2026-80218Sign-in token minted for one resource accepted by another in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-82685Confirmation token accepted on any record in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-82760Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-inteam-alembic ash_authentication
- CVE-2026-92919admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filenamecjbi admin3
- CVE-2026-92918admin3 through 3.0.0 Session Token Disclosure via Audit Logcjbi admin3
- CVE-2026-81481Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-81480Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-92925Redis: redis: out-of-bounds read via crafted cluster bus packetsRed Hat Enterprise Linux · Pen Drive Powered by Red Hat… +2
- CVE-2026-81440Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-81478Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-92917Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_rgetgrav grav
- CVE-2026-92916Grav through 2.0.21 Unauthenticated Information Disclosure via Clockworkgetgrav grav
- CVE-2026-92914AVideo LoginControl PGP Second Factor Authentication BypassWWBN AVideo
- CVE-2026-92912AVideo Cryptographically Weak PRNG via uniqid Stream KeyWWBN AVideo
- CVE-2026-81477Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-81476Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS CommDell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-81475Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-92903Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL StringsSnowflake CLI
- CVE-2026-81474Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-66269Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-78425SAML Audience Confusion Allows Cross-SP AuthenticationSUSE github.com/neuvector/neuvector
- CVE-2026-78428Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrentlySUSE neuvector
- CVE-2026-50610Improper Access control Vulnerability in NitroSense and PredatorSense SoftwareAcer System Monitoring
- CVE-2026-50609Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense SoftwareAcer System Monitoring
- CVE-2026-50605Privilege Escalation Vulnerability in NitroSense and PredatorSense SoftwareAcer Agent Serivce
- CVE-2026-86320Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)Red Hat Enterprise Linux
- CVE-2026-87963Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username ParameterYo
- CVE-2026-86801To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload HandlerTo Do List Member
- CVE-2026-91014Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector EndpointRealtyna Organic IDX plugin + WPL Real Estate
- CVE-2026-88904PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege EscalationPuppyFW
- CVE-2026-88792Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary UpdateDictionary
- CVE-2026-87786Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout CoordinatesDewa Kirim
- CVE-2026-85130WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent LogsWPLP Cookie Consent
- CVE-2026-85128Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role RequestChoose User Role at Registration
- CVE-2025-15697Dictionary <= 1.0 - Reflected XSS via Multiple ParametersDictionary
- CVE-2026-87935Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Actionichurakov Paid Downloads
- CVE-2026-25294Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2026-25290Integer Overflow or Wraparound in OOBMQualcomm Snapdragon
- CVE-2026-25284Buffer Over-read in OOBMQualcomm Snapdragon
- CVE-2026-25283Stack-based Buffer Overflow in OOBMQualcomm Snapdragon
- CVE-2026-25282Out-of-bounds Read in OOBMQualcomm Snapdragon
- CVE-2026-25281Allocation of Resources Without Limits or Throttling in OOBMQualcomm Snapdragon
- CVE-2026-25280Out-of-bounds Write in DSP ServiceQualcomm Snapdragon
- CVE-2026-25278Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNXQualcomm Snapdragon
- CVE-2026-25275Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2026-24081Buffer Over-read in BT ControllerQualcomm Snapdragon
- CVE-2026-24075Buffer Over-read in Qualcomm IPCQualcomm Snapdragon
- CVE-2026-24074Out-of-bounds Write in VideoQualcomm Snapdragon
- CVE-2026-24073Out-of-bounds Write in VideoQualcomm Snapdragon
- CVE-2025-59607Untrusted Pointer Dereference in Windows ComputeQualcomm Snapdragon
- CVE-2026-92838GeoVision GV-Remote E-Map dll hijacking vulnerabilityGeoVision GV-Remote E-map
- CVE-2026-81546The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity documCanva Affinity
- CVE-2026-52483The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow auth
Medium, low and unrated 605
- CVE-2026-93309O-RAN-SC SMO OAM VES Collector allocation of resourcesO-RAN-SC SMO OAM
- CVE-2026-18441LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' ParameterAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-2585Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameterthemefusecom Brizy – Page Builder
- CVE-2026-93454Aureus ERP through 1.6.0 Stored XSS via Payment Term NoteWebkul Aureus ERP
- CVE-2026-93451snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methodsxerial snappy-java · org.xerial.snappy:snappy-java
- CVE-2026-93308O-RAN-SC SMO OAM VES Collector allocation of resourcesO-RAN-SC SMO OAM
- CVE-2026-55946Microsoft Copilot Information Disclosure VulnerabilityMicrosoft Copilot
- CVE-2026-54645CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypasscubecart
- CVE-2026-54643CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.phpcubecart
- CVE-2026-54642CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.phpcubecart
- CVE-2026-54644CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message Systemcubecart
- CVE-2026-54648CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletioncubecart
- CVE-2026-54613Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parametergivanz Vvveb
- CVE-2026-93307O-RAN-SC SMO OAM VES Collector memory allocationO-RAN-SC SMO OAM
- CVE-2026-53555Stored XSS via SVG Uploaddataease SQLBot
- CVE-2026-53556SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Readdataease SQLBot
- CVE-2026-54633PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)podofo
- CVE-2026-50291OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)AcademySoftwareFoundation OpenImageIO
- CVE-2026-14311Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeovermelograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-16582Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypassmelograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-16750Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposurestylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-73638Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifdImager
- CVE-2026-93386UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spGoogle Chrome
- CVE-2026-93385Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTGoogle Chrome
- CVE-2026-93378Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-93376Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read meGoogle Chrome
- CVE-2026-93383Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTGoogle Chrome
- CVE-2026-93384Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engGoogle Chrome
- CVE-2026-93380Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and Google Chrome
- CVE-2026-93379Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTMLGoogle Chrome
- CVE-2026-93387Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafteGoogle Chrome
- CVE-2026-77281Caddy: rewrite placeholder re-expansioncaddyserver caddy · github.com/caddyserver/caddy/v2
- CVE-2026-93395Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()MongoDB C Driver
- CVE-2026-54907Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permissionfuomag9 caddy-proxy-manager
- CVE-2026-93394libmongoc SCRAM client nonce-validation bypassMongoDB C Driver
- CVE-2026-54604OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1openslide
- CVE-2026-54355MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`MapServer
- CVE-2026-67071HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or TransferHCLSoftware HCL DevOps Deploy / HCL Launch
- CVE-2026-54565rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pagesedwardkim rhwp
- CVE-2026-54521FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)M66B FairEmail
- CVE-2026-50022Metacat acts as unintended proxy to backend Apache SOLR engineNCEAS metacat
- CVE-2026-54918NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CInetbox-community devicetype-library
- CVE-2026-54594OmniBlocks: Spamming in Discussions tab possible via disc.ymlOmniBlocks monorepo
- CVE-2026-54495Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clustersopen-feature-operator · github.com/open-feature/open-featur…
- CVE-2026-45723Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematicsiderolabs omni · github.com/siderolabs/omni
- CVE-2026-92757Malformed connection string may disable field level encryptionMongoDB Entity Framework Core Provider
- CVE-2026-92758Logs may collect sensitive informationMongoDB Entity Framework Core Provider
- CVE-2026-92993Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injectionDromara mayfly-go
- CVE-2026-92756Combining encryption settings may disable encryptionMongoDB Entity Framework Core Provider
- CVE-2026-52852Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycletraccar
- CVE-2026-92992Dromara mayfly-go AI Assistant ai.go authorizationDromara mayfly-go
- CVE-2026-54649punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-ToPunchIn-App punchin-email
- CVE-2026-49292Kiwi TCMS: The /init-db/ page renders and responds to requests after first usekiwitcms Kiwi · kiwitcms
- CVE-2026-55061uniget: EDITOR Command Injection in uniget CLIuniget-org cli · gitlab.com/uniget-org/cli
- CVE-2026-92927SourceCodester Drug Recommendation System drug_recommendor.sql information disclosureSourceCodester Drug Recommendation System
- CVE-2026-89038Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivityVerizon Cloud for Android
- CVE-2026-92926code-projects Matrimonial System partner_preference.php writepartnerprefs sql injectioncode-projects Matrimonial System
- CVE-2026-54676Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabledErudika scoold
- CVE-2026-54677Scoold: Authenticated user can post replies and comments to private-space questions without space membershipErudika scoold
- CVE-2026-54551WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)h44z wg-portal
- CVE-2026-44235rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds readalanxz rabbitmq-c
- CVE-2026-54546CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guarddfpc-coe CloudTAK · @tak-ps/cloudtak
- CVE-2026-54579mport mirror-selection ping accepts insufficiently validated ICMP repliesMidnightBSD mport
- CVE-2026-54576mport package installation has symlink TOCTOU in chown and chmod handlingMidnightBSD mport
- CVE-2026-54587mport directory asset installation is vulnerable to symlink and path traversal racesMidnightBSD mport
- CVE-2026-54575mport package fetch and clean paths are vulnerable to TOCTOU filesystem racesMidnightBSD mport
- CVE-2026-8674Assertion failure in the DNS stub resolver with a long search domainThe GNU C Library glibc
- CVE-2026-54578mport verify can compare stale checksum data after hashing failuresMidnightBSD mport
- CVE-2026-54586mport permits repository and package mirror fetches over insecure transportMidnightBSD mport
- CVE-2026-54585mport sample file handling can write outside the configured rootMidnightBSD mport
- CVE-2026-54582mport package installation can overwrite existing unmanaged or differently owned filesMidnightBSD mport
- CVE-2026-54577mport audit can inspect the wrong package when options are presentMidnightBSD mport
- CVE-2026-85716AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verifiedAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-93204batman-adv: dat: atomically update mac addressesLinux
- CVE-2026-93202i3c: master: Fix recursive locking during device registrationLinux
- CVE-2026-93200i3c: master: Fix use-after-free of master->thisLinux
- CVE-2026-93199i3c: master: Do not treat master device as a duplicate targetLinux
- CVE-2026-93198dm-pcache: validate the persisted dirty_tail chain at loadLinux
- CVE-2026-93197memcg: move LRU size accounting on reparenting instead of copying itLinux
- CVE-2026-93195drm/bridge: synopsys: dw-dp: Support unregistering the AUX channelLinux
- CVE-2026-93194drm/rockchip: dw_dp: Release core resourcesLinux
- CVE-2026-93193drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanupLinux
- CVE-2026-93191smack: fix incorrect task context in smack_msg_queue_msgrcvLinux
- CVE-2026-93188HID: roccat: bound device-supplied profile indexLinux
- CVE-2026-93187ASoC: SOF: ipc4-topology: Return error for invalid number of formatsLinux
- CVE-2026-93186cxl/mbox: Clamp mailbox output allocation to the payload sizeLinux
- CVE-2026-93185ASoC: rt700-sdw: always drain jack work on removeLinux
- CVE-2026-93184ASoC: fsl_audmix: rework runtime PM handling in probeLinux
- CVE-2026-93183drm/lima: call drm_mm_init() with a valid allocation rangeLinux
- CVE-2026-93182sched/fair: Fix overflow in update_tg_cfs_runnable()Linux
- CVE-2026-93181perf/x86/intel/uncore: Fix uncore_box ref/unref orderingLinux
- CVE-2026-93180drm/panthor: Fix NPD issue on partial unmap of an evicted BOLinux
- CVE-2026-93179drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB readLinux
- CVE-2026-93174bpf: Copy per-CPU map value padding in copy_map_value_long()Linux
- CVE-2026-93173bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooksLinux
- CVE-2026-93172mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplugLinux
- CVE-2026-93171leds: lp5860: Fix a potential double-unlockLinux
- CVE-2026-93169dmaengine: zynqmp_dma: fix race between runtime PM and device removalLinux
- CVE-2026-93168dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeoutLinux
- CVE-2026-93167csky: Fix a4/a5 restoration in syscall trace pathLinux
- CVE-2026-93166wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()Linux
- CVE-2026-93164uprobes/x86: Move optimized uprobe from nop5 to nop10Linux
- CVE-2026-93163hwrng: core - fix rng list on registration errorLinux
- CVE-2026-93162crypto: qat - cancel work on re-enable SR-IOV timeoutLinux
- CVE-2026-93161crypto: qat - clear AES key schedule from stackLinux
- CVE-2026-93160crypto: atmel-ecc - reject hardware ECDH without a public keyLinux
- CVE-2026-93159crypto: atmel-sha204a - fix heap info leak on I2C transfer failureLinux
- CVE-2026-93158crypto: sa2ul - stop probe if context pool creation failsLinux
- CVE-2026-93157hwrng: xilinx-trng - propagate timeout before any data is readLinux
- CVE-2026-93156crypto: rk3288 - fail ahash requests on HASH idle timeoutLinux
- CVE-2026-93155crypto: keembay - Fix AEAD unregister count in error pathLinux
- CVE-2026-93153RDMA/bng_re: return a timeout when firmware responses stallLinux
- CVE-2026-93152nvme-apple: Use acquire/release for queue enabled stateLinux
- CVE-2026-93150cgroup/cpuset: Make nr_deadline_tasks an atomic_tLinux
- CVE-2026-93149wifi: mac80211_hwsim: avoid NULL skb in stop queue drainLinux
- CVE-2026-93146time/namespace: Validate nanosecond field in proc_timens_set_offset()Linux
- CVE-2026-93145clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()Linux
- CVE-2026-93143staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()Linux
- CVE-2026-93142thermal/drivers/rcar: Fix error checking in probe()Linux
- CVE-2026-93141usb: gadget: r8a66597: avoid double free of ep0_req in probe error pathLinux
- CVE-2026-93140udf: Mark LVID buffer as uptodate before marking it dirtyLinux
- CVE-2026-93139drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCCLinux
- CVE-2026-93136bus: mhi: ep: Fix device refcount leak in the error path of MHI device creationLinux
- CVE-2026-93135bpf: Reject programs with inlined helpers if JIT is not availableLinux
- CVE-2026-93134printk: Fix possible console use-after-freeLinux
- CVE-2026-93133ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()Linux
- CVE-2026-93132ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handlingLinux
- CVE-2026-93131platform/x86: dell-privacy: Fix race conditionLinux
- CVE-2026-93130platform/x86: dell-wmi-base: Fix resource leak on module load failureLinux
- CVE-2026-93129platform/x86: dell-wmi-base: Fix handling of ultra performance keyLinux
- CVE-2026-93128platform/x86: lg-laptop: Fix LED resource handlingLinux
- CVE-2026-93126remoteproc: qcom_q6v5_adsp: Fix reference leak for device nodeLinux
- CVE-2026-93124platform/x86: asus-wireless: Fail probe when there is no ACPI matchLinux
- CVE-2026-93123serial: qcom-geni: do not advance stale DMA completionsLinux
- CVE-2026-93120usb: gadget: configfs: fix out-of-bounds read of qw_signLinux
- CVE-2026-93119usb: ljca: bound bank_num in ljca_enumerate_gpio()Linux
- CVE-2026-93118usb: gadget: aspeed_udc: check endpoint DMA allocationLinux
- CVE-2026-93117usb: fix UAF when probe runs concurrent to dyn ID removalLinux
- CVE-2026-93115platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULLLinux
- CVE-2026-93114platform/surface: acpi-notify: Check ACPI companion before useLinux
- CVE-2026-93113clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLKLinux
- CVE-2026-93110RDMA/core: Wait for RCU callbacks before unloading ib_coreLinux
- CVE-2026-93109RDMA/mlx5: Drain RCU callbacks during module teardownLinux
- CVE-2026-93108RDMA/ipoib: Drain RCU callbacks during module teardownLinux
- CVE-2026-93106crash_dump: release keyring reference at the correct timeLinux
- CVE-2026-93104RDMA/rvt: Return NULL after port allocation failureLinux
- CVE-2026-93103RDMA/hfi1: Preserve unit 0 on allocation failureLinux
- CVE-2026-93102RDMA/hfi1: Free RX data on late probe failureLinux
- CVE-2026-93101media: v4l2-async: Unregister sub-device if asc_list is emptyLinux
- CVE-2026-93100fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()Linux
- CVE-2026-93099fs/resctrl: Fix UAF from worker threads when domains are removedLinux
- CVE-2026-93098rpmsg: glink: fix deadlock in endpoint destroy during driver detachLinux
- CVE-2026-93097cxl/mbox: Break poison list loop on an empty payloadLinux
- CVE-2026-93096cxl/features: Serialize multi-part Get/Set Feature transfersLinux
- CVE-2026-93094wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollbackLinux
- CVE-2026-93093firmware: arm_scmi: Publish channel state before callbacksLinux
- CVE-2026-93092firmware: arm_scmi: Unregister device notifier before IDR teardownLinux
- CVE-2026-93091firmware: arm_scmi: Quiesce notifications before teardownLinux
- CVE-2026-93090firmware: arm_scmi: Clean up channels on setup failureLinux
- CVE-2026-93089firmware: arm_scmi: Free transport channel on IDR failureLinux
- CVE-2026-93086firmware: arm_scmi: Avoid IDR updates while cleaning channelsLinux
- CVE-2026-93085firmware: arm_scmi: Reject out of range DT protocol IDsLinux
- CVE-2026-93084firmware: arm_scmi: Drop handle on protocol bind failuresLinux
- CVE-2026-93083firmware: arm_scmi: Unwind TX receiver mailbox setup failureLinux
- CVE-2026-93082firmware: arm_scmi: Unwind P2A receiver mailbox setup failureLinux
- CVE-2026-93081firmware: arm_scmi: Fix SCMI device destroy lifetimesLinux
- CVE-2026-93080firmware: arm_scmi: Fix transport device teardown lookupLinux
- CVE-2026-93078cxl/features: Reject Set Features output buffer smaller than the headerLinux
- CVE-2026-93077cxl/features: Clamp Get Feature output size to the remaining bufferLinux
- CVE-2026-93076dax/fsdev: clear vmemmap_shift when binding static pgmapLinux
- CVE-2026-93075dax/fsdev: clear pgmap ops and owner on unbindLinux
- CVE-2026-93073dax: read holder_ops once in dax_holder_notify_failure()Linux
- CVE-2026-93072irqchip/renesas-irqc: Fix generic interrupt chip leak on removeLinux
- CVE-2026-93071media: bcm2835-unicam: Fix asc leaked in error/remove pathLinux
- CVE-2026-93069OPP: Fix cleanup orderingLinux
- CVE-2026-93068drm/amd/display: Fix DM I2C teardown raceLinux
- CVE-2026-93067drm/bridge: tc358767: clamp the reported AUX read size to the requestLinux
- CVE-2026-93066x86/mm/pat: Take cpa_lock around large-page collapseLinux
- CVE-2026-93065wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logsLinux
- CVE-2026-93064wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiserLinux
- CVE-2026-93062wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragmentsLinux
- CVE-2026-93061gpu: host1x: Avoid stack over-read in debug output helpersLinux
- CVE-2026-93060drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()Linux
- CVE-2026-93059drm/msm: Fix task_struct reference leak in recover_workerLinux
- CVE-2026-93058drm/msm: Only fini scheduler after successful initLinux
- CVE-2026-93057scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR contextLinux
- CVE-2026-93056usb: gadget: f_uac1_legacy: remove broken string configfs attributesLinux
- CVE-2026-93055UDF symlink pathComponent header OOB readLinux
- CVE-2026-93053speakup: keyhelp: guard letter_offsets possible out-of-range indexingLinux
- CVE-2026-93052misc: bcm-vk: Use acquire/release for msgq_initedLinux
- CVE-2026-93051misc: ad525x_dpot: use driver core groups for sysfs filesLinux
- CVE-2026-93050ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on removeLinux
- CVE-2026-93049mtd: mtdswap: Avoid freeing registered blktrans device twiceLinux
- CVE-2026-93048mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()Linux
- CVE-2026-93047drm/v3d: Associate BOs with every job that accesses themLinux
- CVE-2026-93044bpf: Disallow interpreter fallback for arena-related insnsLinux
- CVE-2026-93043bpf: Disallow interpreter fallback for gotox insnLinux
- CVE-2026-93041dmaengine: dw-edma: Serialize abort state updatesLinux
- CVE-2026-93040dmaengine: dw-edma: Serialize channel state checksLinux
- CVE-2026-93038iio: dac: ad5686: missing NULL check on match dataLinux
- CVE-2026-92524irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()Linux
- CVE-2026-92523RDMA/nldev: validate dynamic counter attribute lengthLinux
- CVE-2026-92521ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_rootLinux
- CVE-2026-92520bpf: Zero queue and stack outputs on lock failureLinux
- CVE-2026-92519riscv, bpf: Fix memory leak in bpf_jit_freeLinux
- CVE-2026-92517bpf, riscv: Fix extable handling for arena load_acquireLinux
- CVE-2026-92516bpf: Fix offset warn check for bpf_res_spin_lockLinux
- CVE-2026-92515bpf: Preserve unique-field state across nested structsLinux
- CVE-2026-92514RDMA/erdma: Fix CEQ tasklet use-after-free on removalLinux
- CVE-2026-92513RDMA/mana_ib: drain QP references after partial table insertionLinux
- CVE-2026-92512RDMA/core: Fix use after free in ib_query_qp()Linux
- CVE-2026-92509RDMA/core: Fix potential use after free in counter_release()Linux
- CVE-2026-92506firmware: arm_scmi: Fix requested device removal raceLinux
- CVE-2026-92505iommu/amd: Fix undefined behavior in devid_write debugfs functionLinux
- CVE-2026-92503ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()Linux
- CVE-2026-92502ext4: clear stale xarray tags on folios skipped during writebackLinux
- CVE-2026-92501ext4: drain in-flight DIO before buffered write fallbackLinux
- CVE-2026-92500ext4: use fsdata to track inline data write state and fix raceLinux
- CVE-2026-92499ext4: validate readdir offset before accessing direntLinux
- CVE-2026-92498wifi: ath6kl: avoid buffer overreads in WMI event handlersLinux
- CVE-2026-92497wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()Linux
- CVE-2026-92496wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()Linux
- CVE-2026-92495RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmapLinux
- CVE-2026-92494ext4: fix buffer_head leak in ext4_init_orphan_infoLinux
- CVE-2026-92493cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not activeLinux
- CVE-2026-92492cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacksLinux
- CVE-2026-92491firmware: arm_scmi: Roll back partial protocol table registrationLinux
- CVE-2026-92490firmware: arm_scmi: Unrequest devices if driver registration failsLinux
- CVE-2026-92487exfat: fix valid_size extension over a shared writable mappingLinux
- CVE-2026-92486bpf: Fix CFI mismatch in task work callbackLinux
- CVE-2026-92484cxl/region: Fix use-after-free in find_pos_and_ways() error pathLinux
- CVE-2026-92483liveupdate: Remember FLB retrieve() statusLinux
- CVE-2026-92482pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chipLinux
- CVE-2026-92481pinctrl: mediatek: free EINT resources on unbindLinux
- CVE-2026-92480scsi: ufs: core: Validate string descriptorsLinux
- CVE-2026-92479scsi: ufs: Avoid NULL CQE dereference when reporting invalid tagsLinux
- CVE-2026-92478scsi: ufs: core: Validate connected lane countsLinux
- CVE-2026-92477scsi: ufs: debugfs: Reserve space for a string terminatorLinux
- CVE-2026-92476crypto: keembay - Initialize completion before requesting IRQLinux
- CVE-2026-90434isofs: release zisofs block pointer buffer headLinux
- CVE-2026-90433spi: oc-tiny: switch to managed controller allocationLinux
- CVE-2026-90432sched_ext: Abort directly from the hardlockup handlerLinux
- CVE-2026-90431remoteproc: Prevent crash handling to race with rproc_del()Linux
- CVE-2026-90430iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initializedLinux
- CVE-2026-90428iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfsLinux
- CVE-2026-90426iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFsLinux
- CVE-2026-90424iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure pathLinux
- CVE-2026-90422clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error pathLinux
- CVE-2026-90421PCI: Fix UAF when probe runs concurrent to dyn ID removalLinux
- CVE-2026-90420nilfs2: fix infinite loop in nilfs_clean_segments()Linux
- CVE-2026-90418nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatchLinux
- CVE-2026-90417RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()Linux
- CVE-2026-90416RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfsLinux
- CVE-2026-90415RDMA/cxgb4: free STAG index when TPT entry write failsLinux
- CVE-2026-90412nvmet: fix return status of RMI log page on allocation failureLinux
- CVE-2026-90411nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_requestLinux
- CVE-2026-90410spi: davinci: switch to managed controller allocationLinux
- CVE-2026-90409drm/panthor: Add vm_bind region with kbo range overlap checkLinux
- CVE-2026-90406media: qcom: iris: handle runtime PM resume failure in core deinitLinux
- CVE-2026-90405media: stm32: dcmi: fix some error handling bugs in probe()Linux
- CVE-2026-90404platform/chrome: cros_ec_debugfs: Unregister panic notifierLinux
- CVE-2026-90400md: recheck spare changes before starting syncLinux
- CVE-2026-90397firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is publishedLinux
- CVE-2026-90396block: fix dio leak on metadata mapping errorLinux
- CVE-2026-90395power: supply: isp1704_charger: cancel work on removeLinux
- CVE-2026-90394power: supply: sc2731_charger: cancel work on removeLinux
- CVE-2026-90393bpf: Fix potential UAF in bpf_netns_link_update_progLinux
- CVE-2026-90391lib/test_hmm: fail dmirror_fault() when the mirrored mm is goneLinux
- CVE-2026-90390md/bitmap: resume array on backlog_store() error pathLinux
- CVE-2026-90389md: scope memalloc_noio to allocation critical sectionsLinux
- CVE-2026-90386i3c: dw: avoid shift-out-of-bounds when DAA assigns no devicesLinux
- CVE-2026-90385md/raid1: create serial pool adding rdev to array with serialize_policy=1Linux
- CVE-2026-90384iomap: release the folio batch on iomap callback failuresLinux
- CVE-2026-90382wifi: mt76: mt76x02: do not WARN on invalid rx descriptor lengthLinux
- CVE-2026-90378wifi: mt76: mt792x: Fix memory leak in SDIO TX pathLinux
- CVE-2026-90377wifi: mt76: fix RX data queuing of RRO 3.0Linux
- CVE-2026-90376wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXPLinux
- CVE-2026-90375wifi: mt76: fix non-AQL packet accounting for MLO stationsLinux
- CVE-2026-90374wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]Linux
- CVE-2026-90373wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clearLinux
- CVE-2026-90370wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_configLinux
- CVE-2026-90369wifi: mt76: fix out-of-bounds access in mmio copy helpersLinux
- CVE-2026-90368wifi: mt76: mt7915: unwind state on add_interface failureLinux
- CVE-2026-90366wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLVLinux
- CVE-2026-90365wifi: mt76: cancel reset and rc work on device unregisterLinux
- CVE-2026-90364ACPI: processor: Unregister cpufreq notifier on init failureLinux
- CVE-2026-90363drm/msm: don't tear down KMS twice when KMS init failsLinux
- CVE-2026-90362drm/msm/dsi: Drop dev_pm_opp_set_rate(0)Linux
- CVE-2026-90361wifi: ath11k: fix leak in ath11k_service_ready_ext_event()Linux
- CVE-2026-90360regulator: core: use system_freezable_wq for init complete workLinux
- CVE-2026-90359bpf: Reject >8 byte return values on return-reading trampoline pathsLinux
- CVE-2026-90356wifi: mt76: mt7996: free vif links after clearing wcid entries on full resetLinux
- CVE-2026-90355wifi: mt76: mt7996: clear stale link state on full resetLinux
- CVE-2026-90354wifi: mt76: mt7915: fix double hif2 init on the non-WED pathLinux
- CVE-2026-90352wifi: mt76: mt7915: release hif2 reference on probe IRQ failureLinux
- CVE-2026-90351wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failedLinux
- CVE-2026-90350wifi: mt76: reject out-of-range link ids in mt76_vif_link()Linux
- CVE-2026-90349wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()Linux
- CVE-2026-90348wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdumpLinux
- CVE-2026-90346wifi: nl80211: clean up color-change beacon data on errorsLinux
- CVE-2026-90345wifi: brcmfmac: fix P2P action frame handling without device vifLinux
- CVE-2026-90344wifi: mac80211: disconnect on CSA to channel 0Linux
- CVE-2026-90342bpf: Fix mmap_lock deadlock on arena lock failureLinux
- CVE-2026-90340pinctrl: generic: free maps on pinctrl_generic_to_map() failureLinux
- CVE-2026-90339powerpc/syscall: Fix syscall skip handling for seccomp and ptraceLinux
- CVE-2026-90338serial: amba-pl011: keep console clock enabled for atomic writesLinux
- CVE-2026-90337serial: core: do fallible allocations before the console can be registeredLinux
- CVE-2026-90336serial: core: clear freed pointers on uart_register_driver() failureLinux
- CVE-2026-90335tty: skip cdev_del() when no cdev is registeredLinux
- CVE-2026-90334tty: clear cdev pointer after cdev_add() failureLinux
- CVE-2026-90333dm-integrity: replace forgeable discard filler with a keyed sector markerLinux
- CVE-2026-90331HID: asus: refactor the two workqueues and init sequenceLinux
- CVE-2026-90330HID: logitech-hidpp: Fix FF device cleanup on init failureLinux
- CVE-2026-90328HID: steam: Reject short readsLinux
- CVE-2026-90327phonet: pep: do not write beyond optlen in getsockoptLinux
- CVE-2026-90323ublk: validate auto buf reg before taking uring_cmdLinux
- CVE-2026-90322ocfs2/cluster: keep heartbeat local node stableLinux
- CVE-2026-90319rapidio: clear mport->net when rio_add_net() failsLinux
- CVE-2026-90318fat: release buffer head after rebuilding parentLinux
- CVE-2026-90315PCI/sysfs: Add lockdown checks to legacy I/O and memory handlersLinux
- CVE-2026-90314remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()Linux
- CVE-2026-90313bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failedLinux
- CVE-2026-90311thermal: hwmon: Remove hwmon class device along with its parentLinux
- CVE-2026-90307RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQLinux
- CVE-2026-90306ARM: 9481/2: breakpoint: CFI breakpoints only on demandLinux
- CVE-2026-90305ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORKLinux
- CVE-2026-90304ARM: 9484/1: enable interrupts when unhandled user faults are triggeredLinux
- CVE-2026-90303ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faultsLinux
- CVE-2026-90302ocfs2: synchronize heartbeat callbacks with o2net teardownLinux
- CVE-2026-90300bpf: Clear buf on error in __bpf_get_task_stackLinux
- CVE-2026-90299bpf: Fix sleepable check for tracing/lsm progLinux
- CVE-2026-90298drm/sun4i: tcon: Drop TCON TOP device referenceLinux
- CVE-2026-90297drm/sun4i: crtc: Propagate layer initialization errorLinux
- CVE-2026-90296cpufreq: imx6q: fix devres accumulation across driver rebindLinux
- CVE-2026-90295cpufreq: imx6q: fix out-of-bounds write when probed more than onceLinux
- CVE-2026-90290arm64: hibernate: Restore DAIF state on errorLinux
- CVE-2026-90287phy: sunplus: fix error handling in sp_uphy_init()Linux
- CVE-2026-90285scsi: qla2xxx: Remove redundant VPD flash read in sysfs read pathLinux
- CVE-2026-90284firmware_loader: do not queue completed sysfs fallback requestsLinux
- CVE-2026-90283hugetlbfs: release subpool on fill_super failureLinux
- CVE-2026-90282phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspendLinux
- CVE-2026-90281phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspendLinux
- CVE-2026-90280phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspendLinux
- CVE-2026-90279md/raid5: round bitmap stripes with sector divisionLinux
- CVE-2026-90278md: wait for behind writes before destroying bitmapLinux
- CVE-2026-90277md/md-llbitmap: prevent create failure bitmap UAFLinux
- CVE-2026-90276md/md-llbitmap: stop daemon timer rearm on destroyLinux
- CVE-2026-90275md/raid1: don't set array_frozen in raid1_takeover()Linux
- CVE-2026-90274coresight: etm4x: fix underflow for usage of (nrseqstate - 1)Linux
- CVE-2026-90273coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enableLinux
- CVE-2026-90272perf: arm_pmuv3: Zero initialize hw_id branch stack fieldLinux
- CVE-2026-90271arm_mpam: Fix a NULL pointer dereference on unbinding after an error interruptLinux
- CVE-2026-90270arm_mpam: Disable driver unbind to avoid UAFLinux
- CVE-2026-90269bpf: Reject load-acquire from pointers requiring fault protectionLinux
- CVE-2026-90267scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() failsLinux
- CVE-2026-90266btrfs: zoned: don't force read-only on transient -EAGAIN from reloc mergeLinux
- CVE-2026-90265btrfs: defrag: fix deadlock between defrag and delalloc space reservationLinux
- CVE-2026-90264btrfs: always wait for ordered extents to avoid OE racesLinux
- CVE-2026-90263btrfs: check if root is readonly when setting posix aclLinux
- CVE-2026-90262btrfs: retry verity reads for not-uptodate Merkle foliosLinux
- CVE-2026-90261btrfs: zoned: flush active metadata block group at btree_writepages() startLinux
- CVE-2026-90259btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()Linux
- CVE-2026-90258pinctrl: airoha: add missed IRQ resource helpersLinux
- CVE-2026-90257Bluetooth: virtio_bt: avoid OOB read of build info stringLinux
- CVE-2026-90254Bluetooth: hci_sync: free the advertising instance on the failure and cancel pathsLinux
- CVE-2026-90253Bluetooth: MGMT: free the mesh send cancel command when it is cancelledLinux
- CVE-2026-90252Bluetooth: MGMT: free the HCI command when it is cancelledLinux
- CVE-2026-90251Bluetooth: MSFT: validate evt_prefix_len against the response lengthLinux
- CVE-2026-90250bpf, cgroup: Fix storage null-ptr-deref after replacing progLinux
- CVE-2026-90249iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writesLinux
- CVE-2026-90248net/sched: cls_api: fix teardown of an adopted proto on insert-race lossLinux
- CVE-2026-90247bpf: Fix mmap_lock leak in irq_work pathLinux
- CVE-2026-90245fbdev: kyro: Validate overlay viewport coordinatesLinux
- CVE-2026-90242iommu/vt-d: Fix iopf_refcount leak on RID domain replacementLinux
- CVE-2026-90239media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()Linux
- CVE-2026-90238media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error pathLinux
- CVE-2026-90236NFSD: Release the export reference when reaping open stateidsLinux
- CVE-2026-90233nvme-pci: release descriptor pools on probe failureLinux
- CVE-2026-90232amt: Don't support cross-netns setup.Linux
- CVE-2026-90226nfc: llcp: avoid userspace overflow on invalid optlenLinux
- CVE-2026-90222nfc: pn533: hold a reference to the request skb during send_frameLinux
- CVE-2026-90221nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsingLinux
- CVE-2026-90220ALSA: seq: Don't leak the extension cell pointer in the bounce payloadLinux
- CVE-2026-90219RDMA/cxgb4: Free debugfs on registration failureLinux
- CVE-2026-90218RDMA/cma: Fix WARNING in res_to_rtLinux
- CVE-2026-90216ubi: Fix rollback for explicit UBI device numbersLinux
- CVE-2026-90215mtd: ubi: Release device reference on busy detachLinux
- CVE-2026-90214ASoC: xilinx: formatter_pcm: fix stream_data leak on open errorLinux
- CVE-2026-90213firewire: core: fix memory leak in error path of build_tree()Linux
- CVE-2026-90212arm64/efi: Avoid voluntary preemption with efi_mm installedLinux
- CVE-2026-90211bpf, s390: Clear fetch destination on faulting arena atomicLinux
- CVE-2026-90209s390/debug: Fix deadlock during unregisterLinux
- CVE-2026-90208clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t typeLinux
- CVE-2026-90206nvmet: fix max_qid race between configfs and controller allocationLinux
- CVE-2026-90202scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffersLinux
- CVE-2026-90201net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg raceLinux
- CVE-2026-90200fs/ntfs3: fix integer overflow in MFT cluster validationLinux
- CVE-2026-90198ALSA: core: Fix use-after-free in snd_card_do_free()Linux
- CVE-2026-90197HID: haptic: don't write an uninitialized value to unhandled usagesLinux
- CVE-2026-90196ASoC: SOF: validate topology volume range before allocationLinux
- CVE-2026-90195riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc argsLinux
- CVE-2026-90194ACPI: scan: fix bus ID cleanup on device_add() failuresLinux
- CVE-2026-90193mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handlerLinux
- CVE-2026-90192mailbox: qcom-cpucp: handle NULL data in send_data callbackLinux
- CVE-2026-90190null_blk: use DEFINE_MUTEX for the file-scope mutexLinux
- CVE-2026-90189null_blk: register configfs subsystem after creating default devicesLinux
- CVE-2026-90188null_blk: free global tag_set on init error pathLinux
- CVE-2026-90187null_blk: free zones array on device power-offLinux
- CVE-2026-90186null_blk: reject per-device queue resize for shared tag setLinux
- CVE-2026-90185null_blk: serialize configfs attribute stores with the lockLinux
- CVE-2026-90184null_blk: serialize configfs attribute updates with device setupLinux
- CVE-2026-90183blk-iolatency: clear delay state when freeing policy dataLinux
- CVE-2026-90182blk-iocost: clear delay state when freeing policy dataLinux
- CVE-2026-90181ublk: avoid teardown retry loop on xarray allocation failureLinux
- CVE-2026-90180block: mtip32xx: synchronize ioctls with device removalLinux
- CVE-2026-90179apparmor: fix deadlock in complain-mode change_hatLinux
- CVE-2026-90178hwmon: (coretemp) Fix core_data leak on CPUs without PTSLinux
- CVE-2026-90175smb: server: fix leak of ksmbd_ipc_login_request_ext() returned bufferLinux
- CVE-2026-90171smb: smbdirect: release pending child sockets outside the handler lockLinux
- CVE-2026-90170ksmbd: validate ipc response length before dereferencing its fieldsLinux
- CVE-2026-90169ksmbd: free preauth sessions on connection teardownLinux
- CVE-2026-90167ksmbd: serialize oplock close with pending break ownershipLinux
- CVE-2026-90166smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()Linux
- CVE-2026-90165smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()Linux
- CVE-2026-90164smb/server: abort initialization when proc setup failsLinux
- CVE-2026-90163smb/server: call ksmbd_proc_cleanup() on module init failureLinux
- CVE-2026-90160lwt_bpf: Restore reserved headroom after xmit programLinux
- CVE-2026-90159bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooksLinux
- CVE-2026-90158m68k: nfcon: Do not call console_is_registered() in nfcon_device()Linux
- CVE-2026-90157bpf: Reject negative optlen in cgroup getsockopt hookLinux
- CVE-2026-90156ksmbd: safely discard unregistered deferred locksLinux
- CVE-2026-90155ksmbd: detach blocked lock requests before freeingLinux
- CVE-2026-90154ksmbd: scope session state changes to bound connectionsLinux
- CVE-2026-90152smb/server: fix session leak in ksmbd_session_register()Linux
- CVE-2026-90150pnfs/blocklayout: Fix device leaks on parse failureLinux
- CVE-2026-90148NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()Linux
- CVE-2026-90147clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()Linux
- CVE-2026-90144dpll: fix NULL deref in dpll_device_ops() during teardown raceLinux
- CVE-2026-90140cuse: wait for pending RCU callbacks on module exitLinux
- CVE-2026-90139fuse: check for NULL root inode in fuse_fill_super_submountLinux
- CVE-2026-90138vsock: don't check the listener's sk_err in vsock_accept()Linux
- CVE-2026-90136platform/x86/amd/hsmp: Reject negative power cap writes in hwmonLinux
- CVE-2026-90135net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()Linux
- CVE-2026-90134ntfs: fix kmap_local_page() usage in compressLinux
- CVE-2026-90130vdpa_sim: fix cleanup after worker creation failureLinux
- CVE-2026-90129virtio_balloon: quiesce balloon work before device shutdownLinux
- CVE-2026-90128vdpa/mlx5: fix wrong list iterated in add_direct_chain error pathLinux
- CVE-2026-90127virtio: rtc: time out alarm requestsLinux
- CVE-2026-90126rtc: pcf8563: fix clock provider leak on unbindLinux
- CVE-2026-90125smb: client: fix request buffer leak in smb2_new_read_req()Linux
- CVE-2026-90124irqchip/renesas-rzg2l: Fix loss of interruptLinux
- CVE-2026-90123irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callbackLinux
- CVE-2026-90122clk: visconti: Make sure clk_init_data is fully initializedLinux
- CVE-2026-90121irqchip/gic-v5: Clear per-CPU IRS data on teardownLinux
- CVE-2026-90119ALSA: ice1712: Fix the card leak at probe error with the auto-cleanupLinux
- CVE-2026-90117ntfs: validate usa_ofs before preserving the update sequence numberLinux
- CVE-2026-90116ALSA: mtpav: shut down output timer before card teardownLinux
- CVE-2026-90115xsk: fix NULL pointer dereference in __xsk_rcv()Linux
- CVE-2026-90114net: bridge: Reject descending VLAN tunnel rangesLinux
- CVE-2026-90113netdevsim: update queue NAPI association on queue resetLinux
- CVE-2026-90112net: qlcnic: validate unified ROM sections before loadingLinux
- CVE-2026-90109net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueueLinux
- CVE-2026-90108net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transitionLinux
- CVE-2026-90107net/smc: free pending qentry in smc_llc_flow_stop() before memsetLinux
- CVE-2026-90106net: bridge: arp/nd proxy: fix reading neigh haLinux
- CVE-2026-90105vxlan: fix reading neigh haLinux
- CVE-2026-90101bnxt_en: Fix call to hardware monitoring event handlerLinux
- CVE-2026-90100ptp: netc: fix period truncation and potential divide-by-zero in PEROUTLinux
- CVE-2026-90099net/sched: account classifier filter allocations to memcgLinux
- CVE-2026-90098net: sparx5: fix sleep in atomic context in MAC table accessLinux
- CVE-2026-90097Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partitionLinux
- CVE-2026-90096fuse: invalidate the correct range after O_APPEND direct writeLinux
- CVE-2026-90095fuse: Fix the condition to enable over-io-uringLinux
- CVE-2026-90094arm64: process: Fix context switching MTE store-only tag checkLinux
- CVE-2026-90090Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX pathLinux
- CVE-2026-90088Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loopLinux
- CVE-2026-90087Bluetooth: do not leak an hci_conn when a second LE connect is rejectedLinux
- CVE-2026-90086xsk: honor XDP_TX_METADATA in zero-copy pathLinux
- CVE-2026-90085octeontx2-af: fix NULL deref in NIX TM tree debugfs read pathLinux
- CVE-2026-90084octeontx2-vf: fix workqueue and netdev race in probe/removeLinux
- CVE-2026-90083net/sched: act_ife: Only operate on Ethernet framesLinux
- CVE-2026-90082net: mana: Cap MSI-X vectors to the device MSI-X table sizeLinux
- CVE-2026-90081net/rds: use wq_has_sleeper() in rds_cong_map_updated()Linux
- CVE-2026-90080octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setupLinux
- CVE-2026-90079octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()Linux
- CVE-2026-90078net/sched: act_skbmod: fix length calculations and avoid invalid header warningsLinux
- CVE-2026-90077net: fix a resource leak in copy_net_ns() error handling pathLinux
- CVE-2026-90076net/sched: fq: add overflow bounds to quantum and initial quantumLinux
- CVE-2026-90075net/sched: fq_codel: clamp default quantum and mtuLinux
- CVE-2026-90074net/sched: fq_pie: clamp default quantum to avoid signed overflowLinux
- CVE-2026-90073net/sched: hhf: clamp quantum before hhf_change() to avoid overflowLinux
- CVE-2026-90072net/sched: sfq: clamp quantum to avoid signed overflow soft lockupLinux
- CVE-2026-90070tpm: st33zp24: Return zero on status read failureLinux
- CVE-2026-90068ASoC: dapm: Fix off-by-one check on the second enum channelLinux
- CVE-2026-90066samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modifyLinux
- CVE-2026-90065net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failureLinux
- CVE-2026-90064drm/xe: Reject page faults from non-fault-mode scratch VMsLinux
- CVE-2026-90063virtio-net: Ensure that TCP packets don't overflow gso_segsLinux
- CVE-2026-90061netfilter: nf_tables: skip double clone set expressions on element insertLinux
- CVE-2026-90060ALSA: control: Don't add invalid kcontrols to LED layerLinux
- CVE-2026-90058net/sched: bound qdisc_pkt_len to prevent qdisc soft lockupLinux
- CVE-2026-90056net: fec: only stop PTP if it was initializedLinux
- CVE-2026-90055usb: atm: usbatm: fix invalid ci_range initializationLinux
- CVE-2026-90054tcp: fix corruption of urgent data on multi-segment retransmitLinux
- CVE-2026-90053net/sched: sch_htb: limit htb_classify inner-class filter hopsLinux
- CVE-2026-85720AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT requestAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-85718AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of serviceAsyncHttpClient async-http-client
- CVE-2026-85717AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect targetAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-61700MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requestsmariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-81868Steeltoe: Header-forwarded client cert lacks proof of private-key possessionSteeltoeOSS security-advisories · Steeltoe.Security.Authori…
- CVE-2026-75523Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secretsSteeltoeOSS security-advisories · Steeltoe.Management.Endpo…
- CVE-2026-86862pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance toolspgadmin.org pgAdmin
- CVE-2026-86861pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment checkpgadmin.org pgAdmin
- CVE-2026-92881vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zerovgmstream
- CVE-2026-85999Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)facelessuser soupsieve · soupsieve
- CVE-2026-86000Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patternsfacelessuser soupsieve · soupsieve
- CVE-2026-93013RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversalinfiniflow ragflow
- CVE-2026-12284Mattermost Desktop App Missing IPC Sender Validation in Calls Leave HandlerMattermost
- CVE-2026-76781Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attributeRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-75588Mattermost Desktop App plugin popout scheme validation bypassMattermost
- CVE-2026-92880vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds writevgmstream
- CVE-2026-54471Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability.Dell SmartFabric Manager
- CVE-2026-61793Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameternuxt-modules og-image · nuxt-og-image
- CVE-2026-81447Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-63461Vendure: Shop API list queries can return non-public entities when filterOperator is ORvendurehq vendure · @vendure/core
- CVE-2026-85078sanic chunked trailer request smuggling allows hidden second request executionsanic-org sanic · sanic
- CVE-2026-81453Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-81829Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolverRed Hat build of Quarkus 3.27.5.SP2 · Red Hat build of Q… +4
- CVE-2026-92879vgmstream mus_acm.c parse_mus resource consumptionvgmstream
- CVE-2026-81443Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-92963vm2 before 3.11.2 Information Disclosure via Internal Statepatriksimek vm2 · vm2
- CVE-2026-92962vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.jspatriksimek vm2 · vm2
- CVE-2026-71568BMCtest exposes Ironic without authentication and TLS during the testopenshift-metal3 bmctest
- CVE-2026-92949vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptorpatriksimek vm2 · vm2
- CVE-2026-92945vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matchingpatriksimek vm2 · vm2
- CVE-2026-92936vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stackpatriksimek vm2 · vm2
- CVE-2026-92933vm2 before 3.11.8 Information Disclosure via util.getCallSitespatriksimek vm2 · vm2
- CVE-2026-92973ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8pycontribs ansi2html
- CVE-2026-80355Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-78528WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerabilityBerqWP
- CVE-2026-78294WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerabilityDylan Kuhn Geo Mashup
- CVE-2026-74017WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerabilitywpeverest User Registration
- CVE-2026-74005WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityPublishPress Series
- CVE-2026-74002WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerabilitywpdevelop Booking Calendar
- CVE-2026-74000WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerabilitywp.insider Simple Membership
- CVE-2026-73999WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerabilityGora Tech Cooked
- CVE-2026-66676WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerabilityMatrixAddons Easy Invoice
- CVE-2026-66617WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityPublishPress Series
- CVE-2026-66608WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerabilityUnlimited Elements For Elementor
- CVE-2026-66579WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetElements For Elementor
- CVE-2026-66578WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerabilityProperty Hive PropertyHive
- CVE-2026-66577WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetSearch
- CVE-2026-66576WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetBlocks For Elementor
- CVE-2026-66575WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerabilityKingAddons.com King Addons for Elementor
- CVE-2026-66574WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerabilitybdthemes Element Pack Elementor Addons
- CVE-2026-66573WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetTabs
- CVE-2026-66572WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetBlog
- CVE-2026-78223Token revocation record built from unverified JWT claims in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-86522Log injection via an unescaped password reset identity in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-81637Replayable OAuth2 CSRF state retained after a failed callback in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-82759Reversible IP address pseudonymisation in AshAuthentication audit log hash modeteam-alembic ash_authentication
- CVE-2026-82723Actor record with password digest stored in AshAuthentication audit log entriesteam-alembic ash_authentication · ash_authentication
- CVE-2026-92904Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations checkRed Hat Satellite
- CVE-2026-92932MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabledmisp sachertortephp
- CVE-2026-92921admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5cjbi admin3
- CVE-2026-92920admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabledcjbi admin3
- CVE-2026-81441Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-81479Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-92915WWBN AVideo userVerifyEmail.php Unauthenticated Access ControlWWBN AVideo
- CVE-2026-78296WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerabilityWP ManageNinja FluentAuth
- CVE-2026-81439Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-81438Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +2
- CVE-2026-92611In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard Eclipse Foundation Eclipse Ankaios
- CVE-2026-92893Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parametersRed Hat Satellite
- CVE-2026-92894Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destructionRed Hat Satellite
- CVE-2026-78427Admission Control Bypass via Hardcoded Sidecar Image ExemptionSUSE github.com/neuvector/neuvector
- CVE-2026-78426Logout bypass via alternate JWT spellingSUSE neuvector
- CVE-2026-50608Authentication Vulnerability in NitroSense and PredatorSense SoftwareAcer System Monitoring
- CVE-2026-50607WebSocket Exposure Vulnerability in NitroSense and PredatorSense SoftwareAcer System Monitoring
- CVE-2026-50606Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense SoftwareAcer System Monitoring
- CVE-2026-87831Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom FieldCheckout Field Manager (Checkout Manager) for WooCommerce
- CVE-2026-87829Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID ReparentingCheckout Field Manager (Checkout Manager) for WooCommerce
- CVE-2026-91017Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT CallbackRobokassa payment gateway for Woocommerce
- CVE-2026-90982@fastify/static vulnerable to route guard bypass via path case-folding@fastify/static
- CVE-2026-44940Service token exposure and potential privilege escalation in SUSE ObservabilitySUSE Observability
- CVE-2026-91019Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential DisclosureEvent Booking Manager for WooCommerce
- CVE-2026-91016Motors < 1.4.121 - Unauthenticated Draft/Private Listing DisclosureMotors
- CVE-2026-91015Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expiredMaster Addons for Elementor
- CVE-2026-91011EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference ExpansionEWWW Image Optimizer
- CVE-2026-91010Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission DeletionInvisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for A…
- CVE-2026-91009Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachmentActive Woot Products Tables for WooCommerce. 100% FREE
- CVE-2026-91008Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation PanelEvent Booking Manager for WooCommerce
- CVE-2026-90923Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and DeletionAutopay
- CVE-2026-90922Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency MismatchPaid Membership Subscriptions
- CVE-2026-87836Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via ExportComments Import & Export
- CVE-2026-86824Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature KeyNewsletter
- CVE-2026-86788HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline TagHT Mega Addons for Elementor
- CVE-2026-86446LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST EndpointLearnPress
- CVE-2026-25261Untrusted Pointer Dereference in CameraQualcomm Snapdragon
- CVE-2026-50604Unauthenticated Access Vulnerability in NitroSense and PredatorSense SoftwareAcer Agent Service
- CVE-2026-50603Hard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSenseAcer Agent Service
- CVE-2026-92839Canva Desktop before v1.125.0 performed double decoding in the deeplink handler.Canva
- CVE-2026-86311Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2026-89064All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Headerservmask All-in-One WP Migration and Backup
- CVE-2021-3030Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colo