# CVEs published 2026-09-17

1,031 CVEs were published on September 17, 2026: 84 critical, 342 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-93309](https://cve.now/CVE-2026-93309.md): O-RAN-SC SMO OAM VES Collector allocation of resources (CVSS 5.3, O-RAN-SC SMO OAM)
- [CVE-2026-18441](https://cve.now/CVE-2026-18441.md): LatePoint - Appointment Booking & Scheduling \<= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer\[id\]' Parameter (CVSS 4.3, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-2585](https://cve.now/CVE-2026-2585.md): Brizy – Page Builder \<= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter (CVSS 6.4, themefusecom Brizy – Page Builder)
- [CVE-2026-93454](https://cve.now/CVE-2026-93454.md): Aureus ERP through 1.6.0 Stored XSS via Payment Term Note (CVSS 5.1, Webkul Aureus ERP)
- [CVE-2026-93453](https://cve.now/CVE-2026-93453.md): SOGo before 5.12.11 Password Reset Token Interception via Origin Header (CVSS 8.7, Alinto SOGo)
- [CVE-2026-93452](https://cve.now/CVE-2026-93452.md): snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress (CVSS 8.7, xerial snappy-java)
- [CVE-2026-93451](https://cve.now/CVE-2026-93451.md): snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods (CVSS 6.9, xerial snappy-java · org.xerial.snappy:snappy-java)
- [CVE-2026-93450](https://cve.now/CVE-2026-93450.md): go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal (CVSS 8.7, go-openapi swag)
- [CVE-2026-93308](https://cve.now/CVE-2026-93308.md): O-RAN-SC SMO OAM VES Collector allocation of resources (CVSS 5.3, O-RAN-SC SMO OAM)
- [CVE-2026-85887](https://cve.now/CVE-2026-85887.md): M365 Copilot Information Disclosure Vulnerability (CVSS 7.7, Microsoft 365 Copilot)
- [CVE-2026-83946](https://cve.now/CVE-2026-83946.md): Azure Portal Spoofing Vulnerability (CVSS 8.2, Microsoft Azure Portal)
- [CVE-2026-69843](https://cve.now/CVE-2026-69843.md): Microsoft Fabric Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Fabric)
- [CVE-2026-85878](https://cve.now/CVE-2026-85878.md): Azure Database for PostgreSQL Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure HorizonDB)
- [CVE-2026-62874](https://cve.now/CVE-2026-62874.md): Azure Billing Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Billing)
- [CVE-2026-87886](https://cve.now/CVE-2026-87886.md): Local privilege escalation due to insecure file permissions. (CVSS 7.8, KEV, Acronis Backup plugin for cPanel & WHM · Acronis Backup… +1)
- [CVE-2026-85917](https://cve.now/CVE-2026-85917.md): Azure AI Foundry Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Azure AI Foundry)
- [CVE-2026-85889](https://cve.now/CVE-2026-85889.md): Azure AI Foundry Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure AI Foundry)
- [CVE-2026-70200](https://cve.now/CVE-2026-70200.md): Azure Logic Apps Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Logic Apps)
- [CVE-2026-87701](https://cve.now/CVE-2026-87701.md): Azure Cosmos DB Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft Azure Cosmos DB)
- [CVE-2026-78501](https://cve.now/CVE-2026-78501.md): Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability (CVSS 8.6, Microsoft 365 Copilot's Business Chat)
- [CVE-2026-83944](https://cve.now/CVE-2026-83944.md): Azure Logic Apps Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Logic Apps)
- [CVE-2026-85885](https://cve.now/CVE-2026-85885.md): Microsoft 365 Copilot Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft 365 Copilot)
- [CVE-2026-68791](https://cve.now/CVE-2026-68791.md): Azure Machine Learning Information Disclosure Vulnerability (CVSS 8.6, Microsoft Azure Machine Learning)
- [CVE-2026-69399](https://cve.now/CVE-2026-69399.md): Azure Arc Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure ARC)
- [CVE-2026-77903](https://cve.now/CVE-2026-77903.md): Microsoft Dataverse Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft Dataverse)
- [CVE-2026-69865](https://cve.now/CVE-2026-69865.md): Microsoft Container Registry Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Container Registry)
- [CVE-2026-70009](https://cve.now/CVE-2026-70009.md): Azure Arc Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft Azure ARC)
- [CVE-2026-55946](https://cve.now/CVE-2026-55946.md): Microsoft Copilot Information Disclosure Vulnerability (CVSS 6.1, Microsoft Copilot)
- [CVE-2026-93436](https://cve.now/CVE-2026-93436.md): vLLM through 0.29.0 Memory Exhaustion via Rejected Requests (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-93435](https://cve.now/CVE-2026-93435.md): redis-parser through 3.0.0 Denial of Service via Unbounded Recursion (CVSS 8.7, NodeRedis redis-parser)
- [CVE-2026-54645](https://cve.now/CVE-2026-54645.md): CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass (CVSS 4.8, cubecart)
- [CVE-2026-54643](https://cve.now/CVE-2026-54643.md): CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php (CVSS 5.4, cubecart)
- [CVE-2026-54642](https://cve.now/CVE-2026-54642.md): CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php (CVSS 5.3, cubecart)
- [CVE-2026-54644](https://cve.now/CVE-2026-54644.md): CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System (CVSS 6.1, cubecart)
- [CVE-2026-54647](https://cve.now/CVE-2026-54647.md): CubeCart : SQL Injection via download\_expire Parameter in settings.index.inc.php (CVSS 7.2, cubecart)
- [CVE-2026-54646](https://cve.now/CVE-2026-54646.md): CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php (CVSS 7.2, cubecart)
- [CVE-2026-54648](https://cve.now/CVE-2026-54648.md): CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion (CVSS 6.5, cubecart)
- [CVE-2026-54734](https://cve.now/CVE-2026-54734.md): Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction (CVSS 10.0, prebid-server-java)
- [CVE-2026-54519](https://cve.now/CVE-2026-54519.md): AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion (CVSS 8.8, vmDeshpande ai-agent-automation)
- [CVE-2026-86688](https://cve.now/CVE-2026-86688.md): Session id is not renewed on authentication in ash\_authentication, allowing session fixation (CVSS 7.4, team-alembic ash\_authentication)
- [CVE-2026-76949](https://cve.now/CVE-2026-76949.md): Remember-me sign-in guard reads a session key that is never written in ash\_authentication, allowing session replacement (CVSS 9.1, team-alembic ash\_authentication)
- [CVE-2026-54520](https://cve.now/CVE-2026-54520.md): AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory (CVSS 8.1, vmDeshpande ai-agent-automation)
- [CVE-2026-54767](https://cve.now/CVE-2026-54767.md): WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar\_socios.php (CVSS 9.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-54671](https://cve.now/CVE-2026-54671.md): WeGIA: Authorization Bypass via Empty Resource Array in InternoControle (CVSS 8.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-54670](https://cve.now/CVE-2026-54670.md): WeGIA: Unauthenticated Auth Bypass + Local File Inclusion (CVSS 9.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-54634](https://cve.now/CVE-2026-54634.md): Hamlib: rigctld \`send\_raw\` Stack Out-of-Bounds Write and Uninitialized Memory Disclosure (CVSS 7.3, Hamlib)
- [CVE-2026-54608](https://cve.now/CVE-2026-54608.md): MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up (CVSS 7.1, MythicalLTD MythicalDash)
- [CVE-2026-54506](https://cve.now/CVE-2026-54506.md): Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field (CVSS 7.6, givanz Vvveb)
- [CVE-2026-54612](https://cve.now/CVE-2026-54612.md): Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global (CVSS 8.8, givanz Vvveb)
- [CVE-2026-54613](https://cve.now/CVE-2026-54613.md): Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter (CVSS 5.4, givanz Vvveb)
- [CVE-2026-93307](https://cve.now/CVE-2026-93307.md): O-RAN-SC SMO OAM VES Collector memory allocation (CVSS 5.3, O-RAN-SC SMO OAM)
- [CVE-2026-54507](https://cve.now/CVE-2026-54507.md): Vvveb oEmbedProxy vulnerable to server-side request forgery (CVSS 8.4, givanz Vvveb)
- [CVE-2026-50158](https://cve.now/CVE-2026-50158.md): yutu: Arbitrary File Write via MCP \`caption-download\` Tool (CVSS 7.7, eat-pray-ai yutu · github.com/eat-pray-ai/yutu)
- [CVE-2026-53534](https://cve.now/CVE-2026-53534.md): JabRef CAYW Sublime Text integration permits operating-system command injection (CVSS 7.5, jabref)
- [CVE-2026-53557](https://cve.now/CVE-2026-53557.md): SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution (CVSS 7.7, dataease SQLBot)
- [CVE-2026-53555](https://cve.now/CVE-2026-53555.md): Stored XSS via SVG Upload (CVSS 5.1, dataease SQLBot)
- [CVE-2026-53556](https://cve.now/CVE-2026-53556.md): SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read (CVSS 6.0, dataease SQLBot)
- [CVE-2026-53554](https://cve.now/CVE-2026-53554.md): SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing (CVSS 7.3, dataease SQLBot)
- [CVE-2026-54633](https://cve.now/CVE-2026-54633.md): PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine) (CVSS 6.9, podofo)
- [CVE-2026-54343](https://cve.now/CVE-2026-54343.md): Frappe LMS: Path Traversal in SCORM File Serving (CVSS 8.7, frappe lms)
- [CVE-2026-50291](https://cve.now/CVE-2026-50291.md): OpenImageIO: Segmentation Fault in BmpInput::read\_native\_scanline (bmpinput.cpp:399) (CVSS 5.5, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-14311](https://cve.now/CVE-2026-14311.md): Booking for Appointments and Events Calendar – Amelia (Premium) \<= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover (CVSS 5.4, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-16582](https://cve.now/CVE-2026-16582.md): Booking for Appointments and Events Calendar - Amelia \<= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass (CVSS 5.3, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-16750](https://cve.now/CVE-2026-16750.md): Motors – Car Dealership & Classified Listings \<= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure (CVSS 5.3, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2026-93426](https://cve.now/CVE-2026-93426.md): SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names (CVSS 8.4, signoz)
- [CVE-2026-73639](https://cve.now/CVE-2026-73639.md): Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read\_direct8 (CVSS 9.1, Imager-File-PNG · Imager)
- [CVE-2026-73638](https://cve.now/CVE-2026-73638.md): Imager versions from 0.45\_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff\_load\_ifd (CVSS 6.2, Imager)
- [CVE-2026-93386](https://cve.now/CVE-2026-93386.md): UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to sp (CVSS 5.4, Google Chrome)
- [CVE-2026-93385](https://cve.now/CVE-2026-93385.md): Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HT (CVSS 6.5, Google Chrome)
- [CVE-2026-93378](https://cve.now/CVE-2026-93378.md): Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process (CVSS 3.1, Google Chrome)
- [CVE-2026-93376](https://cve.now/CVE-2026-93376.md): Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read me (CVSS 6.3, Google Chrome)
- [CVE-2026-93383](https://cve.now/CVE-2026-93383.md): Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HT (CVSS 4.3, Google Chrome)
- [CVE-2026-93384](https://cve.now/CVE-2026-93384.md): Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social eng (CVSS 3.7, Google Chrome)
- [CVE-2026-93380](https://cve.now/CVE-2026-93380.md): Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and (CVSS 3.1, Google Chrome)
- [CVE-2026-93377](https://cve.now/CVE-2026-93377.md): Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary co (CVSS 8.8, Google Chrome)
- [CVE-2026-93379](https://cve.now/CVE-2026-93379.md): Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML (CVSS 4.3, Google Chrome)
- [CVE-2026-93381](https://cve.now/CVE-2026-93381.md): Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to p (CVSS 8.8, Google Chrome)
- [CVE-2026-93373](https://cve.now/CVE-2026-93373.md): Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox (CVSS 9.6, Google Chrome)
- [CVE-2026-93387](https://cve.now/CVE-2026-93387.md): Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-93382](https://cve.now/CVE-2026-93382.md): Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-93375](https://cve.now/CVE-2026-93375.md): Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially exec (CVSS 8.1, Google Chrome)
- [CVE-2026-93372](https://cve.now/CVE-2026-93372.md): Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside t (CVSS 9.6, Google Chrome)
- [CVE-2026-93374](https://cve.now/CVE-2026-93374.md): Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code (CVSS 9.6, Google Chrome)
- [CVE-2026-77281](https://cve.now/CVE-2026-77281.md): Caddy: rewrite placeholder re-expansion (CVSS 6.5, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-77615](https://cve.now/CVE-2026-77615.md): Paella Player: Stored XSS via caption cue text (CVSS 8.7, opencast · polimediaupv paella-player +2)
- [CVE-2026-15815](https://cve.now/CVE-2026-15815.md): CVE-2026-15815 CVE Record (CVSS 8.8, Grafana OSS · Grafana Enterprise)
- [CVE-2026-93395](https://cve.now/CVE-2026-93395.md): Integer Underflow → Heap Out-of-Bounds Read in \`bson\_new\_from\_buffer() (CVSS 6.9, MongoDB C Driver)
- [CVE-2026-54597](https://cve.now/CVE-2026-54597.md): ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter (CVSS 8.3, itflow-org itflow)
- [CVE-2026-54596](https://cve.now/CVE-2026-54596.md): ITFlow: Authenticated SQL Injection via recurring\_invoice\_frequency Parameter Enables Full Database Exfiltration (CVSS 8.1, itflow-org itflow)
- [CVE-2026-54907](https://cve.now/CVE-2026-54907.md): Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission (CVSS 5.3, fuomag9 caddy-proxy-manager)
- [CVE-2026-93394](https://cve.now/CVE-2026-93394.md): libmongoc SCRAM client nonce-validation bypass (CVSS 6.3, MongoDB C Driver)
- [CVE-2026-54604](https://cve.now/CVE-2026-54604.md): OpenSlide: openslide\_read\_region() returns uninitialized memory with libtiff 4.7.1 (CVSS 5.3, openslide)
- [CVE-2026-86049](https://cve.now/CVE-2026-86049.md): Jupyter Server: 5xx request logging leaks token-bearing Referer header values (CVSS 7.1, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2026-93393](https://cve.now/CVE-2026-93393.md): Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream (CVSS 9.2, MongoDB C Driver)
- [CVE-2026-48977](https://cve.now/CVE-2026-48977.md): OpenSlide: Arbitrary memory write with crafted Ventana BIF file (CVSS 7.7, openslide)
- [CVE-2026-54355](https://cve.now/CVE-2026-54355.md): MapServer: Reflected XSS in OpenLayers HTML Output via \`HTTP\_X\_FORWARDED\_HOST\` (CVSS 5.3, MapServer)
- [CVE-2026-68523](https://cve.now/CVE-2026-68523.md): Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service (CVSS 7.5, fulgur-rs fulgur · fulgur)
- [CVE-2026-54354](https://cve.now/CVE-2026-54354.md): MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation (CVSS 8.2, MapServer)
- [CVE-2026-76154](https://cve.now/CVE-2026-76154.md): CVE-2026-76154 CVE Record (CVSS 7.3, Grafana OSS · Grafana Enterprise)
- [CVE-2026-54339](https://cve.now/CVE-2026-54339.md): Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover (CVSS 7.7, LeslieLeung glean)
- [CVE-2026-67071](https://cve.now/CVE-2026-67071.md): HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer (CVSS 6.5, HCLSoftware HCL DevOps Deploy / HCL Launch)
- [CVE-2026-54510](https://cve.now/CVE-2026-54510.md): Speakr: CSRF bypass via unauthenticated API token parameter in csrf\_exempt\_for\_api\_tokens hook (CVSS 7.1, murtaza-nasir speakr)
- [CVE-2026-54565](https://cve.now/CVE-2026-54565.md): rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages (CVSS 4.7, edwardkim rhwp)
- [CVE-2026-68537](https://cve.now/CVE-2026-68537.md): Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service (CVSS 7.5, fulgur-rs fulgur · fulgur)
- [CVE-2026-54521](https://cve.now/CVE-2026-54521.md): FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP) (CVSS 6.1, M66B FairEmail)
- [CVE-2026-50277](https://cve.now/CVE-2026-50277.md): dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-cpp)
- [CVE-2026-54501](https://cve.now/CVE-2026-54501.md): Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors (CVSS 9.4, webrecorder browsertrix)
- [CVE-2026-54237](https://cve.now/CVE-2026-54237.md): Wavelog: Unauthenticated Remote Code Execution (CVSS 9.3, wavelog)
- [CVE-2026-45140](https://cve.now/CVE-2026-45140.md): Chamilo LMS CStudio upload flow allows unauthenticated remote code execution (CVSS 9.8, chamilo-lms · chamilo/chamilo-lms)
- [CVE-2026-45143](https://cve.now/CVE-2026-45143.md): Chamilo LMS: Student-to-admin stored XSS in private messages via v-html (CVSS 9.0, chamilo-lms)
- [CVE-2026-54460](https://cve.now/CVE-2026-54460.md): OpenReception: Unauthenticated WebAuthn passkey injection via \`POST /api/auth/passkeys\` leads to account takeover (CVSS 9.8, open-reception appointment-booking-software)
- [CVE-2026-50022](https://cve.now/CVE-2026-50022.md): Metacat acts as unintended proxy to backend Apache SOLR engine (CVSS 5.8, NCEAS metacat)
- [CVE-2026-50275](https://cve.now/CVE-2026-50275.md): Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-php)
- [CVE-2026-54918](https://cve.now/CVE-2026-54918.md): NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX\_DT\_LIBRARY\_URL) enables SSRF and test-data substitution from CI (CVSS 5.3, netbox-community devicetype-library)
- [CVE-2026-54916](https://cve.now/CVE-2026-54916.md): NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing \`tests/\_\_init\_\_.py\` + SSRF via unfixed \`NETBOX\_DT\_LIBRARY\_URL\` → Cloud Metadata credential theft (CVSS 8.8, netbox-community devicetype-library)
- [CVE-2026-54752](https://cve.now/CVE-2026-54752.md): NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request (CVSS 9.6, netbox-community devicetype-library)
- [CVE-2026-50125](https://cve.now/CVE-2026-50125.md): MKP: Unbounded Pod Log Read via Attacker-Controlled \`limitBytes\`/\`tailLines\` Causes Memory Exhaustion (CVSS 7.5, StacklokLabs mkp · github.com/StacklokLabs/mkp)
- [CVE-2026-54594](https://cve.now/CVE-2026-54594.md): OmniBlocks: Spamming in Discussions tab possible via disc.yml (CVSS 5.3, OmniBlocks monorepo)
- [CVE-2026-50285](https://cve.now/CVE-2026-50285.md): Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback (CVSS 7.5, pomerium · github.com/pomerium/pomerium)
- [CVE-2026-54692](https://cve.now/CVE-2026-54692.md): SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write) (CVSS 7.8, HappySeaFox sail)
- [CVE-2026-54627](https://cve.now/CVE-2026-54627.md): SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth) (CVSS 9.8, HappySeaFox sail)
- [CVE-2026-54626](https://cve.now/CVE-2026-54626.md): SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch) (CVSS 9.8, HappySeaFox sail)
- [CVE-2026-54618](https://cve.now/CVE-2026-54618.md): Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user (CVSS 9.4, jimprosser obsidian-web-mcp)
- [CVE-2026-54495](https://cve.now/CVE-2026-54495.md): Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters (CVSS 4.3, open-feature-operator · github.com/open-feature/open-featur…)
- [CVE-2026-54716](https://cve.now/CVE-2026-54716.md): Valhalla: Degenerate exclude\_polygons (collinear points, zero area) causes OOM in /sources\_to\_targets (CVSS 7.5, valhalla)
- [CVE-2026-45720](https://cve.now/CVE-2026-45720.md): Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token (CVSS 7.0, siderolabs omni · github.com/siderolabs/omni)
- [CVE-2026-45723](https://cve.now/CVE-2026-45723.md): Omni: Operator can traverse image-factory API paths via unsanitized \`talos\_version\` in CreateSchematic (CVSS 2.7, siderolabs omni · github.com/siderolabs/omni)
- [CVE-2026-45726](https://cve.now/CVE-2026-45726.md): Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService (CVSS 7.6, siderolabs omni · github.com/siderolabs/omni)
- [CVE-2026-92757](https://cve.now/CVE-2026-92757.md): Malformed connection string may disable field level encryption (CVSS 6.8, MongoDB Entity Framework Core Provider)
- [CVE-2026-93337](https://cve.now/CVE-2026-93337.md): NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection (CVSS 8.5, nm-l2tp NetworkManager-l2tp)
- [CVE-2026-92758](https://cve.now/CVE-2026-92758.md): Logs may collect sensitive information (CVSS 5.7, MongoDB Entity Framework Core Provider)
- [CVE-2026-92993](https://cve.now/CVE-2026-92993.md): Dromara mayfly-go Machine Script Feature machine\_script.go RunMachineScript os command injection (CVSS 5.3, Dromara mayfly-go)
- [CVE-2026-92943](https://cve.now/CVE-2026-92943.md): Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python (CVSS 8.1, AWSIoTPythonSDK)
- [CVE-2026-92756](https://cve.now/CVE-2026-92756.md): Combining encryption settings may disable encryption (CVSS 6.8, MongoDB Entity Framework Core Provider)
- [CVE-2026-90997](https://cve.now/CVE-2026-90997.md): Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch (CVSS 7.4, Keycloak · Red Hat Build of Keycloak)
- [CVE-2026-19477](https://cve.now/CVE-2026-19477.md): Stack-based Buffer Overflow Vulnerability in Linux (uldaq) (CVSS 7.8, MCC Universal Library for Linux)
- [CVE-2026-92230](https://cve.now/CVE-2026-92230.md): Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching (CVSS 7.5, Apache Software Foundation Apache Karaf)
- [CVE-2026-54253](https://cve.now/CVE-2026-54253.md): TS3 Manager: Reflected XSS via /api/download port parameter steals operator session (CVSS 8.2, joni1802 ts3-manager)
- [CVE-2026-54504](https://cve.now/CVE-2026-54504.md): MCP Documentation Server: Web UI API binds to all interfaces without authentication by default (CVSS 8.8, andrea9293 mcp-documentation-server · @andrea9293/mcp-docum…)
- [CVE-2026-54617](https://cve.now/CVE-2026-54617.md): GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler (CVSS 9.8, GravitLauncher Launcher · pro.gravit.launcher:launchserver-…)
- [CVE-2026-54524](https://cve.now/CVE-2026-54524.md): Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report (CVSS 7.1, frappe hrms)
- [CVE-2026-52852](https://cve.now/CVE-2026-52852.md): Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle (CVSS 6.5, traccar)
- [CVE-2026-52851](https://cve.now/CVE-2026-52851.md): Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions (CVSS 7.1, traccar)
- [CVE-2026-92992](https://cve.now/CVE-2026-92992.md): Dromara mayfly-go AI Assistant ai.go authorization (CVSS 5.3, Dromara mayfly-go)
- [CVE-2026-54649](https://cve.now/CVE-2026-54649.md): punchin-email: Operator inbox (FORWARD\_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To (CVSS 2.1, PunchIn-App punchin-email)
- [CVE-2026-54571](https://cve.now/CVE-2026-54571.md): ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service (CVSS 8.7, ESP32Async ESPAsyncWebServer)
- [CVE-2026-49292](https://cve.now/CVE-2026-49292.md): Kiwi TCMS: The /init-db/ page renders and responds to requests after first use (CVSS 0.0, kiwitcms Kiwi · kiwitcms)
- [CVE-2026-54239](https://cve.now/CVE-2026-54239.md): FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope (CVSS 8.8, wpengine faustjs)
- [CVE-2026-55061](https://cve.now/CVE-2026-55061.md): uniget: EDITOR Command Injection in uniget CLI (CVSS 1.0, uniget-org cli · gitlab.com/uniget-org/cli)
- [CVE-2026-55062](https://cve.now/CVE-2026-55062.md): uniget: Path Traversal in Hook Files - Directory Escape Vulnerability (CVSS 8.4, uniget-org cli · gitlab.com/uniget-org/cli)
- [CVE-2026-52727](https://cve.now/CVE-2026-52727.md): lxc-ci: Pacman keyring stored in archlinux image with a private key (CVSS 7.2, lxc-ci)
- [CVE-2026-54451](https://cve.now/CVE-2026-54451.md): Elixir protobuf: Unbounded recursion depth in embedded-message decoding (CVSS 8.2, elixir-protobuf protobuf)
- [CVE-2026-47252](https://cve.now/CVE-2026-47252.md): Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari) (CVSS 9.0, julien040 anyquery · github.com/julien040/anyquery/plugi… +4)
- [CVE-2026-92927](https://cve.now/CVE-2026-92927.md): SourceCodester Drug Recommendation System drug\_recommendor.sql information disclosure (CVSS 6.9, SourceCodester Drug Recommendation System)
- [CVE-2026-89038](https://cve.now/CVE-2026-89038.md): Verizon Cloud for Android \< 26.7.10 Path Traversal via OneTouchUploadActivity (CVSS 6.9, Verizon Cloud for Android)
- [CVE-2026-92926](https://cve.now/CVE-2026-92926.md): code-projects Matrimonial System partner\_preference.php writepartnerprefs sql injection (CVSS 6.9, code-projects Matrimonial System)
- [CVE-2026-52836](https://cve.now/CVE-2026-52836.md): OpenDDS: out-of-bounds \`rd\_ptr\` dereference in \`RtpsSampleHeader::init\` — triggered by malformed RTPS submessage, remotely exploitable denial of service (CVSS 8.7, OpenDDS)
- [CVE-2026-54676](https://cve.now/CVE-2026-54676.md): Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled (CVSS 6.5, Erudika scoold)
- [CVE-2026-54677](https://cve.now/CVE-2026-54677.md): Scoold: Authenticated user can post replies and comments to private-space questions without space membership (CVSS 6.5, Erudika scoold)
- [CVE-2026-54446](https://cve.now/CVE-2026-54446.md): NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode (CVSS 8.1, Labs64 NetLicensing-MCP · netlicensing-mcp)
- [CVE-2026-54053](https://cve.now/CVE-2026-54053.md): Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults (CVSS 9.6, brufdev many-notes)
- [CVE-2026-54551](https://cve.now/CVE-2026-54551.md): WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization) (CVSS 4.3, h44z wg-portal)
- [CVE-2026-44235](https://cve.now/CVE-2026-44235.md): rabbitmq-c: size\_t underflow in AMQP frame length computation leads to out-of-bounds read (CVSS 6.5, alanxz rabbitmq-c)
- [CVE-2026-44236](https://cve.now/CVE-2026-44236.md): rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame\_max (CVSS 7.1, alanxz rabbitmq-c)
- [CVE-2026-54546](https://cve.now/CVE-2026-54546.md): CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard (CVSS 5.0, dfpc-coe CloudTAK · @tak-ps/cloudtak)
- [CVE-2026-54579](https://cve.now/CVE-2026-54579.md): mport mirror-selection ping accepts insufficiently validated ICMP replies (CVSS 2.3, MidnightBSD mport)
- [CVE-2026-54576](https://cve.now/CVE-2026-54576.md): mport package installation has symlink TOCTOU in chown and chmod handling (CVSS 5.8, MidnightBSD mport)
- [CVE-2026-54587](https://cve.now/CVE-2026-54587.md): mport directory asset installation is vulnerable to symlink and path traversal races (CVSS 5.8, MidnightBSD mport)
- [CVE-2026-54575](https://cve.now/CVE-2026-54575.md): mport package fetch and clean paths are vulnerable to TOCTOU filesystem races (CVSS 5.8, MidnightBSD mport)
- [CVE-2026-8674](https://cve.now/CVE-2026-8674.md): Assertion failure in the DNS stub resolver with a long search domain (CVSS 5.3, The GNU C Library glibc)
- [CVE-2026-54578](https://cve.now/CVE-2026-54578.md): mport verify can compare stale checksum data after hashing failures (CVSS 2.0, MidnightBSD mport)
- [CVE-2026-54586](https://cve.now/CVE-2026-54586.md): mport permits repository and package mirror fetches over insecure transport (CVSS 6.0, MidnightBSD mport)
- [CVE-2026-54585](https://cve.now/CVE-2026-54585.md): mport sample file handling can write outside the configured root (CVSS 6.0, MidnightBSD mport)
- [CVE-2026-54580](https://cve.now/CVE-2026-54580.md): mport index decompression can leave partial or corrupt index data after zstd failures (CVSS 8.3, MidnightBSD mport)
- [CVE-2026-54582](https://cve.now/CVE-2026-54582.md): mport package installation can overwrite existing unmanaged or differently owned files (CVSS 6.0, MidnightBSD mport)
- [CVE-2026-54577](https://cve.now/CVE-2026-54577.md): mport audit can inspect the wrong package when options are present (CVSS 2.0, MidnightBSD mport)
- [CVE-2026-54583](https://cve.now/CVE-2026-54583.md): mport package bundle downloads allow unsafe destination filenames (CVSS 8.3, MidnightBSD mport)
- [CVE-2026-54581](https://cve.now/CVE-2026-54581.md): mport bootstrap index fetch can continue after hash verification failure (CVSS 8.3, MidnightBSD mport)
- [CVE-2026-28326](https://cve.now/CVE-2026-28326.md): SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability (CVSS 8.8, SolarWinds Access Rights Manager)
- [CVE-2026-93296](https://cve.now/CVE-2026-93296.md): MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends (CVSS 8.5, misp)
- [CVE-2026-93292](https://cve.now/CVE-2026-93292.md): SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders (CVSS 8.4, signoz)
- [CVE-2026-93295](https://cve.now/CVE-2026-93295.md): MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution (CVSS 8.7, misp)
- [CVE-2026-85716](https://cve.now/CVE-2026-85716.md): AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified (CVSS 3.7, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-93204](https://cve.now/CVE-2026-93204.md): batman-adv: dat: atomically update mac addresses (no CVSS, Linux)
- [CVE-2026-93203](https://cve.now/CVE-2026-93203.md): batman-adv: bla: avoid CRC corruption due to parallel claim add (CVSS 7.1, Linux)
- [CVE-2026-93202](https://cve.now/CVE-2026-93202.md): i3c: master: Fix recursive locking during device registration (no CVSS, Linux)
- [CVE-2026-93201](https://cve.now/CVE-2026-93201.md): dm-pcache: validate seg\_id fields from persistent memory (CVSS 7.8, Linux)
- [CVE-2026-93200](https://cve.now/CVE-2026-93200.md): i3c: master: Fix use-after-free of master-\>this (no CVSS, Linux)
- [CVE-2026-93199](https://cve.now/CVE-2026-93199.md): i3c: master: Do not treat master device as a duplicate target (no CVSS, Linux)
- [CVE-2026-93198](https://cve.now/CVE-2026-93198.md): dm-pcache: validate the persisted dirty\_tail chain at load (no CVSS, Linux)
- [CVE-2026-93197](https://cve.now/CVE-2026-93197.md): memcg: move LRU size accounting on reparenting instead of copying it (no CVSS, Linux)
- [CVE-2026-93196](https://cve.now/CVE-2026-93196.md): nvdimm: virtio\_pmem: refcount requests for token lifetime (CVSS 8.4, Linux)
- [CVE-2026-93195](https://cve.now/CVE-2026-93195.md): drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel (no CVSS, Linux)
- [CVE-2026-93194](https://cve.now/CVE-2026-93194.md): drm/rockchip: dw\_dp: Release core resources (no CVSS, Linux)
- [CVE-2026-93193](https://cve.now/CVE-2026-93193.md): drm/rockchip: analogix\_dp: Fix OF node reference leak via auto cleanup (no CVSS, Linux)
- [CVE-2026-93192](https://cve.now/CVE-2026-93192.md): drm/v3d: Clear queue-\>active\_job when v3d\_fence\_create() fails (CVSS 7.8, Linux)
- [CVE-2026-93191](https://cve.now/CVE-2026-93191.md): smack: fix incorrect task context in smack\_msg\_queue\_msgrcv (no CVSS, Linux)
- [CVE-2026-93190](https://cve.now/CVE-2026-93190.md): platform/chrome: cros\_ec\_typec: Reject out-of-bounds PD cap count (CVSS 8.4, Linux)
- [CVE-2026-93189](https://cve.now/CVE-2026-93189.md): HID: core: quiesce input in hid\_hw\_stop() to prevent use-after-free (CVSS 8.8, Linux)
- [CVE-2026-93188](https://cve.now/CVE-2026-93188.md): HID: roccat: bound device-supplied profile index (no CVSS, Linux)
- [CVE-2026-93187](https://cve.now/CVE-2026-93187.md): ASoC: SOF: ipc4-topology: Return error for invalid number of formats (no CVSS, Linux)
- [CVE-2026-93186](https://cve.now/CVE-2026-93186.md): cxl/mbox: Clamp mailbox output allocation to the payload size (no CVSS, Linux)
- [CVE-2026-93185](https://cve.now/CVE-2026-93185.md): ASoC: rt700-sdw: always drain jack work on remove (no CVSS, Linux)
- [CVE-2026-93184](https://cve.now/CVE-2026-93184.md): ASoC: fsl\_audmix: rework runtime PM handling in probe (no CVSS, Linux)
- [CVE-2026-93183](https://cve.now/CVE-2026-93183.md): drm/lima: call drm\_mm\_init() with a valid allocation range (no CVSS, Linux)
- [CVE-2026-93182](https://cve.now/CVE-2026-93182.md): sched/fair: Fix overflow in update\_tg\_cfs\_runnable() (no CVSS, Linux)
- [CVE-2026-93181](https://cve.now/CVE-2026-93181.md): perf/x86/intel/uncore: Fix uncore\_box ref/unref ordering (no CVSS, Linux)
- [CVE-2026-93180](https://cve.now/CVE-2026-93180.md): drm/panthor: Fix NPD issue on partial unmap of an evicted BO (no CVSS, Linux)
- [CVE-2026-93179](https://cve.now/CVE-2026-93179.md): drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (no CVSS, Linux)
- [CVE-2026-93178](https://cve.now/CVE-2026-93178.md): drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (CVSS 7.1, Linux)
- [CVE-2026-93177](https://cve.now/CVE-2026-93177.md): drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (CVSS 7.3, Linux)
- [CVE-2026-93176](https://cve.now/CVE-2026-93176.md): drm/amd/display: Fix dangling pointer in plane reset function (CVSS 7.0, Linux)
- [CVE-2026-93175](https://cve.now/CVE-2026-93175.md): drm/amd/display: Fix dangling pointer in CRTC reset function (CVSS 7.8, Linux)
- [CVE-2026-93174](https://cve.now/CVE-2026-93174.md): bpf: Copy per-CPU map value padding in copy\_map\_value\_long() (no CVSS, Linux)
- [CVE-2026-93173](https://cve.now/CVE-2026-93173.md): bpf,lsm: Drop bpf\_prog\_free from sleepable\_lsm\_hooks (no CVSS, Linux)
- [CVE-2026-93172](https://cve.now/CVE-2026-93172.md): mm/mm\_init: handle alloc\_percpu failure in free\_area\_init\_core\_hotplug (no CVSS, Linux)
- [CVE-2026-93171](https://cve.now/CVE-2026-93171.md): leds: lp5860: Fix a potential double-unlock (no CVSS, Linux)
- [CVE-2026-93170](https://cve.now/CVE-2026-93170.md): dmaengine: xilinx\_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (CVSS 7.8, Linux)
- [CVE-2026-93169](https://cve.now/CVE-2026-93169.md): dmaengine: zynqmp\_dma: fix race between runtime PM and device removal (no CVSS, Linux)
- [CVE-2026-93168](https://cve.now/CVE-2026-93168.md): dmaengine: xilinx\_dma: Fix CPU stall in xilinx\_dma\_poll\_timeout (no CVSS, Linux)
- [CVE-2026-93167](https://cve.now/CVE-2026-93167.md): csky: Fix a4/a5 restoration in syscall trace path (no CVSS, Linux)
- [CVE-2026-93166](https://cve.now/CVE-2026-93166.md): wifi: rtw89: debug: fix off by on in rtw89\_ppdu\_str() (no CVSS, Linux)
- [CVE-2026-93165](https://cve.now/CVE-2026-93165.md): platform/chrome: sensorhub: Fix memory overread in ring handler (CVSS 7.7, Linux)
- [CVE-2026-93164](https://cve.now/CVE-2026-93164.md): uprobes/x86: Move optimized uprobe from nop5 to nop10 (no CVSS, Linux)
- [CVE-2026-93163](https://cve.now/CVE-2026-93163.md): hwrng: core - fix rng list on registration error (no CVSS, Linux)
- [CVE-2026-93162](https://cve.now/CVE-2026-93162.md): crypto: qat - cancel work on re-enable SR-IOV timeout (no CVSS, Linux)
- [CVE-2026-93161](https://cve.now/CVE-2026-93161.md): crypto: qat - clear AES key schedule from stack (no CVSS, Linux)
- [CVE-2026-93160](https://cve.now/CVE-2026-93160.md): crypto: atmel-ecc - reject hardware ECDH without a public key (no CVSS, Linux)
- [CVE-2026-93159](https://cve.now/CVE-2026-93159.md): crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (no CVSS, Linux)
- [CVE-2026-93158](https://cve.now/CVE-2026-93158.md): crypto: sa2ul - stop probe if context pool creation fails (no CVSS, Linux)
- [CVE-2026-93157](https://cve.now/CVE-2026-93157.md): hwrng: xilinx-trng - propagate timeout before any data is read (no CVSS, Linux)
- [CVE-2026-93156](https://cve.now/CVE-2026-93156.md): crypto: rk3288 - fail ahash requests on HASH idle timeout (no CVSS, Linux)
- [CVE-2026-93155](https://cve.now/CVE-2026-93155.md): crypto: keembay - Fix AEAD unregister count in error path (no CVSS, Linux)
- [CVE-2026-93154](https://cve.now/CVE-2026-93154.md): RDMA/irdma: Add refcounting to user ring MRs (CVSS 7.8, Linux)
- [CVE-2026-93153](https://cve.now/CVE-2026-93153.md): RDMA/bng\_re: return a timeout when firmware responses stall (no CVSS, Linux)
- [CVE-2026-93152](https://cve.now/CVE-2026-93152.md): nvme-apple: Use acquire/release for queue enabled state (no CVSS, Linux)
- [CVE-2026-93151](https://cve.now/CVE-2026-93151.md): nvmet-rdma: fix response resource leak on queue teardown (CVSS 7.5, Linux)
- [CVE-2026-93150](https://cve.now/CVE-2026-93150.md): cgroup/cpuset: Make nr\_deadline\_tasks an atomic\_t (no CVSS, Linux)
- [CVE-2026-93149](https://cve.now/CVE-2026-93149.md): wifi: mac80211\_hwsim: avoid NULL skb in stop queue drain (no CVSS, Linux)
- [CVE-2026-93148](https://cve.now/CVE-2026-93148.md): bpf: Reject MEM\_ALLOC BTF accesses past object bounds (CVSS 7.8, Linux)
- [CVE-2026-93147](https://cve.now/CVE-2026-93147.md): s390/bpf: Replace ly instruction with llgf (CVSS 7.8, Linux)
- [CVE-2026-93146](https://cve.now/CVE-2026-93146.md): time/namespace: Validate nanosecond field in proc\_timens\_set\_offset() (no CVSS, Linux)
- [CVE-2026-93145](https://cve.now/CVE-2026-93145.md): clk: qcom: gdsc: tear down per-domain genpds in gdsc\_unregister() (no CVSS, Linux)
- [CVE-2026-93144](https://cve.now/CVE-2026-93144.md): bpf: Reject writes through untrusted BTF pointers (CVSS 7.8, Linux)
- [CVE-2026-93143](https://cve.now/CVE-2026-93143.md): staging: media: ipu7: fix pm\_runtime refcount leak in ipu7\_resume() (no CVSS, Linux)
- [CVE-2026-93142](https://cve.now/CVE-2026-93142.md): thermal/drivers/rcar: Fix error checking in probe() (no CVSS, Linux)
- [CVE-2026-93141](https://cve.now/CVE-2026-93141.md): usb: gadget: r8a66597: avoid double free of ep0\_req in probe error path (no CVSS, Linux)
- [CVE-2026-93140](https://cve.now/CVE-2026-93140.md): udf: Mark LVID buffer as uptodate before marking it dirty (no CVSS, Linux)
- [CVE-2026-93139](https://cve.now/CVE-2026-93139.md): drm/amdgpu/mes: Fix hung\_queue\_db\_array loop limit for multi-XCC (no CVSS, Linux)
- [CVE-2026-93138](https://cve.now/CVE-2026-93138.md): bpf: Fix vmlinux BTF prep race in bpf\_get\_btf\_vmlinux (CVSS 7.8, Linux)
- [CVE-2026-93137](https://cve.now/CVE-2026-93137.md): bpf: Fix use-after-free on mm\_struct in bpf\_find\_vma() (CVSS 7.8, Linux)
- [CVE-2026-93136](https://cve.now/CVE-2026-93136.md): bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (no CVSS, Linux)
- [CVE-2026-93135](https://cve.now/CVE-2026-93135.md): bpf: Reject programs with inlined helpers if JIT is not available (no CVSS, Linux)
- [CVE-2026-93134](https://cve.now/CVE-2026-93134.md): printk: Fix possible console use-after-free (no CVSS, Linux)
- [CVE-2026-93133](https://cve.now/CVE-2026-93133.md): ACPI: RISC-V: Check acpi\_get\_handle() status in riscv\_acpi\_add\_prt\_dep() (no CVSS, Linux)
- [CVE-2026-93132](https://cve.now/CVE-2026-93132.md): ACPI: RISC-V: Fix riscv\_acpi\_add\_prt\_dep() loop handling (no CVSS, Linux)
- [CVE-2026-93131](https://cve.now/CVE-2026-93131.md): platform/x86: dell-privacy: Fix race condition (no CVSS, Linux)
- [CVE-2026-93130](https://cve.now/CVE-2026-93130.md): platform/x86: dell-wmi-base: Fix resource leak on module load failure (no CVSS, Linux)
- [CVE-2026-93129](https://cve.now/CVE-2026-93129.md): platform/x86: dell-wmi-base: Fix handling of ultra performance key (no CVSS, Linux)
- [CVE-2026-93128](https://cve.now/CVE-2026-93128.md): platform/x86: lg-laptop: Fix LED resource handling (no CVSS, Linux)
- [CVE-2026-93127](https://cve.now/CVE-2026-93127.md): bpf: Drop scalar id on sign-extending narrowing stack fills (CVSS 7.8, Linux)
- [CVE-2026-93126](https://cve.now/CVE-2026-93126.md): remoteproc: qcom\_q6v5\_adsp: Fix reference leak for device node (no CVSS, Linux)
- [CVE-2026-93125](https://cve.now/CVE-2026-93125.md): bpf: Reject rdonly/rdwr\_buf\_size kfunc arguments that exceed u32 max (CVSS 7.8, Linux)
- [CVE-2026-93124](https://cve.now/CVE-2026-93124.md): platform/x86: asus-wireless: Fail probe when there is no ACPI match (no CVSS, Linux)
- [CVE-2026-93123](https://cve.now/CVE-2026-93123.md): serial: qcom-geni: do not advance stale DMA completions (no CVSS, Linux)
- [CVE-2026-93122](https://cve.now/CVE-2026-93122.md): usb: gadget: uac: validate rate list length before storing (CVSS 7.8, Linux)
- [CVE-2026-93121](https://cve.now/CVE-2026-93121.md): usb: gadget: f\_fs: Fix fence cleanup in ffs\_dmabuf\_transfer() error paths (CVSS 7.0, Linux)
- [CVE-2026-93120](https://cve.now/CVE-2026-93120.md): usb: gadget: configfs: fix out-of-bounds read of qw\_sign (no CVSS, Linux)
- [CVE-2026-93119](https://cve.now/CVE-2026-93119.md): usb: ljca: bound bank\_num in ljca\_enumerate\_gpio() (no CVSS, Linux)
- [CVE-2026-93118](https://cve.now/CVE-2026-93118.md): usb: gadget: aspeed\_udc: check endpoint DMA allocation (no CVSS, Linux)
- [CVE-2026-93117](https://cve.now/CVE-2026-93117.md): usb: fix UAF when probe runs concurrent to dyn ID removal (no CVSS, Linux)
- [CVE-2026-93116](https://cve.now/CVE-2026-93116.md): platform/x86: asus-wmi: fix resource leaks on probe failure (CVSS 7.0, Linux)
- [CVE-2026-93115](https://cve.now/CVE-2026-93115.md): platform/mellanox: mlxbf-pmc: Check ACPI\_COMPANION() against NULL (no CVSS, Linux)
- [CVE-2026-93114](https://cve.now/CVE-2026-93114.md): platform/surface: acpi-notify: Check ACPI companion before use (no CVSS, Linux)
- [CVE-2026-93113](https://cve.now/CVE-2026-93113.md): clk: qcom: camcc-sc8280xp: unregister CAMCC\_GDSC\_CLK (no CVSS, Linux)
- [CVE-2026-93112](https://cve.now/CVE-2026-93112.md): bpf: Require a BPF cpumask for bpf\_cpumask\_populate() (CVSS 7.1, Linux)
- [CVE-2026-93111](https://cve.now/CVE-2026-93111.md): bpf: Mark tracing\_multi trampolines as ftrace managed (CVSS 7.8, Linux)
- [CVE-2026-93110](https://cve.now/CVE-2026-93110.md): RDMA/core: Wait for RCU callbacks before unloading ib\_core (no CVSS, Linux)
- [CVE-2026-93109](https://cve.now/CVE-2026-93109.md): RDMA/mlx5: Drain RCU callbacks during module teardown (no CVSS, Linux)
- [CVE-2026-93108](https://cve.now/CVE-2026-93108.md): RDMA/ipoib: Drain RCU callbacks during module teardown (no CVSS, Linux)
- [CVE-2026-93107](https://cve.now/CVE-2026-93107.md): RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (CVSS 8.2, Linux)
- [CVE-2026-93106](https://cve.now/CVE-2026-93106.md): crash\_dump: release keyring reference at the correct time (no CVSS, Linux)
- [CVE-2026-93105](https://cve.now/CVE-2026-93105.md): esp: do not unref managed frag pages in esp\_ssg\_unref() (CVSS 7.8, Linux)
- [CVE-2026-93104](https://cve.now/CVE-2026-93104.md): RDMA/rvt: Return NULL after port allocation failure (no CVSS, Linux)
- [CVE-2026-93103](https://cve.now/CVE-2026-93103.md): RDMA/hfi1: Preserve unit 0 on allocation failure (no CVSS, Linux)
- [CVE-2026-93102](https://cve.now/CVE-2026-93102.md): RDMA/hfi1: Free RX data on late probe failure (no CVSS, Linux)
- [CVE-2026-93101](https://cve.now/CVE-2026-93101.md): media: v4l2-async: Unregister sub-device if asc\_list is empty (no CVSS, Linux)
- [CVE-2026-93100](https://cve.now/CVE-2026-93100.md): fs/resctrl: Prevent use-after-free in rdtgroup\_kn\_put() (no CVSS, Linux)
- [CVE-2026-93099](https://cve.now/CVE-2026-93099.md): fs/resctrl: Fix UAF from worker threads when domains are removed (no CVSS, Linux)
- [CVE-2026-93098](https://cve.now/CVE-2026-93098.md): rpmsg: glink: fix deadlock in endpoint destroy during driver detach (no CVSS, Linux)
- [CVE-2026-93097](https://cve.now/CVE-2026-93097.md): cxl/mbox: Break poison list loop on an empty payload (no CVSS, Linux)
- [CVE-2026-93096](https://cve.now/CVE-2026-93096.md): cxl/features: Serialize multi-part Get/Set Feature transfers (no CVSS, Linux)
- [CVE-2026-93095](https://cve.now/CVE-2026-93095.md): hfsplus: validate thread record before delete key rebuild (CVSS 7.8, Linux)
- [CVE-2026-93094](https://cve.now/CVE-2026-93094.md): wifi: ath12k: fix dp\_link\_peer dangling references on AP vdev rollback (no CVSS, Linux)
- [CVE-2026-93093](https://cve.now/CVE-2026-93093.md): firmware: arm\_scmi: Publish channel state before callbacks (no CVSS, Linux)
- [CVE-2026-93092](https://cve.now/CVE-2026-93092.md): firmware: arm\_scmi: Unregister device notifier before IDR teardown (no CVSS, Linux)
- [CVE-2026-93091](https://cve.now/CVE-2026-93091.md): firmware: arm\_scmi: Quiesce notifications before teardown (no CVSS, Linux)
- [CVE-2026-93090](https://cve.now/CVE-2026-93090.md): firmware: arm\_scmi: Clean up channels on setup failure (no CVSS, Linux)
- [CVE-2026-93089](https://cve.now/CVE-2026-93089.md): firmware: arm\_scmi: Free transport channel on IDR failure (no CVSS, Linux)
- [CVE-2026-93086](https://cve.now/CVE-2026-93086.md): firmware: arm\_scmi: Avoid IDR updates while cleaning channels (no CVSS, Linux)
- [CVE-2026-93085](https://cve.now/CVE-2026-93085.md): firmware: arm\_scmi: Reject out of range DT protocol IDs (no CVSS, Linux)
- [CVE-2026-93084](https://cve.now/CVE-2026-93084.md): firmware: arm\_scmi: Drop handle on protocol bind failures (no CVSS, Linux)
- [CVE-2026-93083](https://cve.now/CVE-2026-93083.md): firmware: arm\_scmi: Unwind TX receiver mailbox setup failure (no CVSS, Linux)
- [CVE-2026-93082](https://cve.now/CVE-2026-93082.md): firmware: arm\_scmi: Unwind P2A receiver mailbox setup failure (no CVSS, Linux)
- [CVE-2026-93081](https://cve.now/CVE-2026-93081.md): firmware: arm\_scmi: Fix SCMI device destroy lifetimes (no CVSS, Linux)
- [CVE-2026-93080](https://cve.now/CVE-2026-93080.md): firmware: arm\_scmi: Fix transport device teardown lookup (no CVSS, Linux)
- [CVE-2026-93079](https://cve.now/CVE-2026-93079.md): cxl/features: Reject Get Feature count larger than the output buffer (CVSS 7.8, Linux)
- [CVE-2026-93078](https://cve.now/CVE-2026-93078.md): cxl/features: Reject Set Features output buffer smaller than the header (no CVSS, Linux)
- [CVE-2026-93077](https://cve.now/CVE-2026-93077.md): cxl/features: Clamp Get Feature output size to the remaining buffer (no CVSS, Linux)
- [CVE-2026-93076](https://cve.now/CVE-2026-93076.md): dax/fsdev: clear vmemmap\_shift when binding static pgmap (no CVSS, Linux)
- [CVE-2026-93075](https://cve.now/CVE-2026-93075.md): dax/fsdev: clear pgmap ops and owner on unbind (no CVSS, Linux)
- [CVE-2026-93074](https://cve.now/CVE-2026-93074.md): dax/fsdev: use \_\_va(phys) for kaddr in direct\_access (CVSS 7.8, Linux)
- [CVE-2026-93073](https://cve.now/CVE-2026-93073.md): dax: read holder\_ops once in dax\_holder\_notify\_failure() (no CVSS, Linux)
- [CVE-2026-93072](https://cve.now/CVE-2026-93072.md): irqchip/renesas-irqc: Fix generic interrupt chip leak on remove (no CVSS, Linux)
- [CVE-2026-93071](https://cve.now/CVE-2026-93071.md): media: bcm2835-unicam: Fix asc leaked in error/remove path (no CVSS, Linux)
- [CVE-2026-93070](https://cve.now/CVE-2026-93070.md): media: ipu6: Do not free aux device pdata after init (CVSS 7.8, Linux)
- [CVE-2026-93069](https://cve.now/CVE-2026-93069.md): OPP: Fix cleanup ordering (no CVSS, Linux)
- [CVE-2026-93068](https://cve.now/CVE-2026-93068.md): drm/amd/display: Fix DM I2C teardown race (no CVSS, Linux)
- [CVE-2026-93067](https://cve.now/CVE-2026-93067.md): drm/bridge: tc358767: clamp the reported AUX read size to the request (no CVSS, Linux)
- [CVE-2026-93066](https://cve.now/CVE-2026-93066.md): x86/mm/pat: Take cpa\_lock around large-page collapse (no CVSS, Linux)
- [CVE-2026-93065](https://cve.now/CVE-2026-93065.md): wifi: iwlwifi: fix counter type in iwl\_fwrt\_dump\_error\_logs (no CVSS, Linux)
- [CVE-2026-93064](https://cve.now/CVE-2026-93064.md): wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (no CVSS, Linux)
- [CVE-2026-93063](https://cve.now/CVE-2026-93063.md): wifi: iwlwifi: mei: check SAP message length before reading it (CVSS 8.4, Linux)
- [CVE-2026-93062](https://cve.now/CVE-2026-93062.md): wifi: iwlwifi: guard against division by zero in iwl\_dbg\_tlv\_alloc\_fragments (no CVSS, Linux)
- [CVE-2026-93061](https://cve.now/CVE-2026-93061.md): gpu: host1x: Avoid stack over-read in debug output helpers (no CVSS, Linux)
- [CVE-2026-93060](https://cve.now/CVE-2026-93060.md): drm/msm/adreno: fix use after free on error path in a6xx\_gpu\_init() (no CVSS, Linux)
- [CVE-2026-93059](https://cve.now/CVE-2026-93059.md): drm/msm: Fix task\_struct reference leak in recover\_worker (no CVSS, Linux)
- [CVE-2026-93058](https://cve.now/CVE-2026-93058.md): drm/msm: Only fini scheduler after successful init (no CVSS, Linux)
- [CVE-2026-93057](https://cve.now/CVE-2026-93057.md): scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context (no CVSS, Linux)
- [CVE-2026-93056](https://cve.now/CVE-2026-93056.md): usb: gadget: f\_uac1\_legacy: remove broken string configfs attributes (no CVSS, Linux)
- [CVE-2026-93055](https://cve.now/CVE-2026-93055.md): UDF symlink pathComponent header OOB read (no CVSS, Linux)
- [CVE-2026-93054](https://cve.now/CVE-2026-93054.md): uio: Fix stale info pointer in failed registration path (CVSS 7.0, Linux)
- [CVE-2026-93053](https://cve.now/CVE-2026-93053.md): speakup: keyhelp: guard letter\_offsets possible out-of-range indexing (no CVSS, Linux)
- [CVE-2026-93052](https://cve.now/CVE-2026-93052.md): misc: bcm-vk: Use acquire/release for msgq\_inited (no CVSS, Linux)
- [CVE-2026-93051](https://cve.now/CVE-2026-93051.md): misc: ad525x\_dpot: use driver core groups for sysfs files (no CVSS, Linux)
- [CVE-2026-93050](https://cve.now/CVE-2026-93050.md): ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove (no CVSS, Linux)
- [CVE-2026-93049](https://cve.now/CVE-2026-93049.md): mtd: mtdswap: Avoid freeing registered blktrans device twice (no CVSS, Linux)
- [CVE-2026-93048](https://cve.now/CVE-2026-93048.md): mtd: part: reject MTDPART\_OFS\_RETAIN in mtd\_add\_partition() (no CVSS, Linux)
- [CVE-2026-93047](https://cve.now/CVE-2026-93047.md): drm/v3d: Associate BOs with every job that accesses them (no CVSS, Linux)
- [CVE-2026-93046](https://cve.now/CVE-2026-93046.md): software node: Fix software\_node\_get\_reference\_args() with index -1 (CVSS 7.0, Linux)
- [CVE-2026-93045](https://cve.now/CVE-2026-93045.md): bpf: Reject arena frees below the arena base (CVSS 7.8, Linux)
- [CVE-2026-93044](https://cve.now/CVE-2026-93044.md): bpf: Disallow interpreter fallback for arena-related insns (no CVSS, Linux)
- [CVE-2026-93043](https://cve.now/CVE-2026-93043.md): bpf: Disallow interpreter fallback for gotox insn (no CVSS, Linux)
- [CVE-2026-93042](https://cve.now/CVE-2026-93042.md): dmaengine: dw-edma: Terminate all descriptors without callbacks (CVSS 8.8, Linux)
- [CVE-2026-93041](https://cve.now/CVE-2026-93041.md): dmaengine: dw-edma: Serialize abort state updates (no CVSS, Linux)
- [CVE-2026-93040](https://cve.now/CVE-2026-93040.md): dmaengine: dw-edma: Serialize channel state checks (no CVSS, Linux)
- [CVE-2026-93039](https://cve.now/CVE-2026-93039.md): ASoC: meson: Keep link pointers valid on realloc failure (CVSS 7.4, Linux)
- [CVE-2026-93038](https://cve.now/CVE-2026-93038.md): iio: dac: ad5686: missing NULL check on match data (no CVSS, Linux)
- [CVE-2026-93037](https://cve.now/CVE-2026-93037.md): RDMA/hfi1: Propagate sdma\_txinit\_ahg() errors (CVSS 7.8, Linux)
- [CVE-2026-92525](https://cve.now/CVE-2026-92525.md): RDMA/rxe: Validate num\_sge/cur\_sge before indexing wqe-\>dma.sge\[\] (CVSS 7.1, Linux)
- [CVE-2026-92524](https://cve.now/CVE-2026-92524.md): irqchip/gic-v3-its: Prevent leak in its\_vpe\_irq\_domain\_alloc() (no CVSS, Linux)
- [CVE-2026-92523](https://cve.now/CVE-2026-92523.md): RDMA/nldev: validate dynamic counter attribute length (no CVSS, Linux)
- [CVE-2026-92522](https://cve.now/CVE-2026-92522.md): ACPI: processor: validate MADT IOAPIC entry bounds (CVSS 7.3, Linux)
- [CVE-2026-92521](https://cve.now/CVE-2026-92521.md): ACPI: PCI: Clear driver\_data on all paths that free the acpi\_pci\_root (no CVSS, Linux)
- [CVE-2026-92520](https://cve.now/CVE-2026-92520.md): bpf: Zero queue and stack outputs on lock failure (no CVSS, Linux)
- [CVE-2026-92519](https://cve.now/CVE-2026-92519.md): riscv, bpf: Fix memory leak in bpf\_jit\_free (no CVSS, Linux)
- [CVE-2026-92518](https://cve.now/CVE-2026-92518.md): riscv, bpf: Fix kernel stack corruption in tailcall with CFI (CVSS 7.8, Linux)
- [CVE-2026-92517](https://cve.now/CVE-2026-92517.md): bpf, riscv: Fix extable handling for arena load\_acquire (no CVSS, Linux)
- [CVE-2026-92516](https://cve.now/CVE-2026-92516.md): bpf: Fix offset warn check for bpf\_res\_spin\_lock (no CVSS, Linux)
- [CVE-2026-92515](https://cve.now/CVE-2026-92515.md): bpf: Preserve unique-field state across nested structs (no CVSS, Linux)
- [CVE-2026-92514](https://cve.now/CVE-2026-92514.md): RDMA/erdma: Fix CEQ tasklet use-after-free on removal (no CVSS, Linux)
- [CVE-2026-92513](https://cve.now/CVE-2026-92513.md): RDMA/mana\_ib: drain QP references after partial table insertion (no CVSS, Linux)
- [CVE-2026-92512](https://cve.now/CVE-2026-92512.md): RDMA/core: Fix use after free in ib\_query\_qp() (no CVSS, Linux)
- [CVE-2026-92511](https://cve.now/CVE-2026-92511.md): RDMA/core: Fix potential use after free in ib\_destroy\_cq\_user() (CVSS 7.8, Linux)
- [CVE-2026-92510](https://cve.now/CVE-2026-92510.md): RDMA/core: Fix potential use after free in ib\_destroy\_srq\_user() (CVSS 7.8, Linux)
- [CVE-2026-92509](https://cve.now/CVE-2026-92509.md): RDMA/core: Fix potential use after free in counter\_release() (no CVSS, Linux)
- [CVE-2026-92508](https://cve.now/CVE-2026-92508.md): RDMA/core: Fix potential use after free in ib\_free\_cq() (CVSS 7.8, Linux)
- [CVE-2026-92507](https://cve.now/CVE-2026-92507.md): RDMA/core: Fix potential use after free in ib\_dealloc\_pd\_user() (CVSS 7.8, Linux)
- [CVE-2026-92506](https://cve.now/CVE-2026-92506.md): firmware: arm\_scmi: Fix requested device removal race (no CVSS, Linux)
- [CVE-2026-92505](https://cve.now/CVE-2026-92505.md): iommu/amd: Fix undefined behavior in devid\_write debugfs function (no CVSS, Linux)
- [CVE-2026-92504](https://cve.now/CVE-2026-92504.md): thermal: intel: int3400: clean up ODVP on probe failures (CVSS 7.0, Linux)
- [CVE-2026-92503](https://cve.now/CVE-2026-92503.md): ext4: fix ABBA deadlock in ext4\_xattr\_inode\_cache\_find() (no CVSS, Linux)
- [CVE-2026-92502](https://cve.now/CVE-2026-92502.md): ext4: clear stale xarray tags on folios skipped during writeback (no CVSS, Linux)
- [CVE-2026-92501](https://cve.now/CVE-2026-92501.md): ext4: drain in-flight DIO before buffered write fallback (no CVSS, Linux)
- [CVE-2026-92500](https://cve.now/CVE-2026-92500.md): ext4: use fsdata to track inline data write state and fix race (no CVSS, Linux)
- [CVE-2026-92499](https://cve.now/CVE-2026-92499.md): ext4: validate readdir offset before accessing dirent (no CVSS, Linux)
- [CVE-2026-92498](https://cve.now/CVE-2026-92498.md): wifi: ath6kl: avoid buffer overreads in WMI event handlers (no CVSS, Linux)
- [CVE-2026-92497](https://cve.now/CVE-2026-92497.md): wifi: ath12k: Avoid buffer overread in ath12k\_wmi\_op\_rx() (no CVSS, Linux)
- [CVE-2026-92496](https://cve.now/CVE-2026-92496.md): wifi: ath11k: Avoid buffer overread in ath11k\_wmi\_tlv\_op\_rx() (no CVSS, Linux)
- [CVE-2026-92495](https://cve.now/CVE-2026-92495.md): RDMA/bnxt\_re: Clear VM\_MAYWRITE on DBR/toggle page mmap (no CVSS, Linux)
- [CVE-2026-92494](https://cve.now/CVE-2026-92494.md): ext4: fix buffer\_head leak in ext4\_init\_orphan\_info (no CVSS, Linux)
- [CVE-2026-92493](https://cve.now/CVE-2026-92493.md): cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active (no CVSS, Linux)
- [CVE-2026-92492](https://cve.now/CVE-2026-92492.md): cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks (no CVSS, Linux)
- [CVE-2026-92491](https://cve.now/CVE-2026-92491.md): firmware: arm\_scmi: Roll back partial protocol table registration (no CVSS, Linux)
- [CVE-2026-92490](https://cve.now/CVE-2026-92490.md): firmware: arm\_scmi: Unrequest devices if driver registration fails (no CVSS, Linux)
- [CVE-2026-92489](https://cve.now/CVE-2026-92489.md): xfrm: Fix skb double-free in xfrm\_dev\_direct\_output() (CVSS 9.8, Linux)
- [CVE-2026-92488](https://cve.now/CVE-2026-92488.md): RDMA/erdma: complete object teardown when the destroy command fails (CVSS 7.0, Linux)
- [CVE-2026-92487](https://cve.now/CVE-2026-92487.md): exfat: fix valid\_size extension over a shared writable mapping (no CVSS, Linux)
- [CVE-2026-92486](https://cve.now/CVE-2026-92486.md): bpf: Fix CFI mismatch in task work callback (no CVSS, Linux)
- [CVE-2026-92485](https://cve.now/CVE-2026-92485.md): bpf: Fix WARNING in bpf\_tracing\_link\_release (CVSS 7.8, Linux)
- [CVE-2026-92484](https://cve.now/CVE-2026-92484.md): cxl/region: Fix use-after-free in find\_pos\_and\_ways() error path (no CVSS, Linux)
- [CVE-2026-92483](https://cve.now/CVE-2026-92483.md): liveupdate: Remember FLB retrieve() status (no CVSS, Linux)
- [CVE-2026-92482](https://cve.now/CVE-2026-92482.md): pinctrl: mediatek: use devm\_gpiochip\_add\_data() for GPIO chip (no CVSS, Linux)
- [CVE-2026-92481](https://cve.now/CVE-2026-92481.md): pinctrl: mediatek: free EINT resources on unbind (no CVSS, Linux)
- [CVE-2026-92480](https://cve.now/CVE-2026-92480.md): scsi: ufs: core: Validate string descriptors (no CVSS, Linux)
- [CVE-2026-92479](https://cve.now/CVE-2026-92479.md): scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags (no CVSS, Linux)
- [CVE-2026-92478](https://cve.now/CVE-2026-92478.md): scsi: ufs: core: Validate connected lane counts (no CVSS, Linux)
- [CVE-2026-92477](https://cve.now/CVE-2026-92477.md): scsi: ufs: debugfs: Reserve space for a string terminator (no CVSS, Linux)
- [CVE-2026-92476](https://cve.now/CVE-2026-92476.md): crypto: keembay - Initialize completion before requesting IRQ (no CVSS, Linux)
- [CVE-2026-90435](https://cve.now/CVE-2026-90435.md): RDMA/mlx5: Fix integer overflow of user QP buffer size (CVSS 7.8, Linux)
- [CVE-2026-90434](https://cve.now/CVE-2026-90434.md): isofs: release zisofs block pointer buffer head (no CVSS, Linux)
- [CVE-2026-90433](https://cve.now/CVE-2026-90433.md): spi: oc-tiny: switch to managed controller allocation (no CVSS, Linux)
- [CVE-2026-90432](https://cve.now/CVE-2026-90432.md): sched\_ext: Abort directly from the hardlockup handler (no CVSS, Linux)
- [CVE-2026-90431](https://cve.now/CVE-2026-90431.md): remoteproc: Prevent crash handling to race with rproc\_del() (no CVSS, Linux)
- [CVE-2026-90430](https://cve.now/CVE-2026-90430.md): iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (no CVSS, Linux)
- [CVE-2026-90429](https://cve.now/CVE-2026-90429.md): iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init (CVSS 7.8, Linux)
- [CVE-2026-90428](https://cve.now/CVE-2026-90428.md): iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (no CVSS, Linux)
- [CVE-2026-90427](https://cve.now/CVE-2026-90427.md): iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm\_krealloc() (CVSS 7.4, Linux)
- [CVE-2026-90426](https://cve.now/CVE-2026-90426.md): iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (no CVSS, Linux)
- [CVE-2026-90425](https://cve.now/CVE-2026-90425.md): iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID (CVSS 8.8, Linux)
- [CVE-2026-90424](https://cve.now/CVE-2026-90424.md): iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path (no CVSS, Linux)
- [CVE-2026-90423](https://cve.now/CVE-2026-90423.md): RDMA/rxe: Fix UAF in ODP init error-handling path (CVSS 7.8, Linux)
- [CVE-2026-90422](https://cve.now/CVE-2026-90422.md): clk: mediatek: pllfh: Fix IO remapping leak in register\_pllfhs error path (no CVSS, Linux)
- [CVE-2026-90421](https://cve.now/CVE-2026-90421.md): PCI: Fix UAF when probe runs concurrent to dyn ID removal (no CVSS, Linux)
- [CVE-2026-90420](https://cve.now/CVE-2026-90420.md): nilfs2: fix infinite loop in nilfs\_clean\_segments() (no CVSS, Linux)
- [CVE-2026-90419](https://cve.now/CVE-2026-90419.md): nilfs2: prevent out-of-bounds read in super root block parsing (CVSS 7.1, Linux)
- [CVE-2026-90418](https://cve.now/CVE-2026-90418.md): nilfs2: fix BUG in nilfs\_copy\_dirty\_pages() on dirty state mismatch (no CVSS, Linux)
- [CVE-2026-90417](https://cve.now/CVE-2026-90417.md): RDMA/cxgb4: Fix dereg\_skb leak and double free in write\_tpt\_entry() (no CVSS, Linux)
- [CVE-2026-90416](https://cve.now/CVE-2026-90416.md): RDMA/mlx5: Fix stack out-of-bounds read in cc\_params debugfs (no CVSS, Linux)
- [CVE-2026-90415](https://cve.now/CVE-2026-90415.md): RDMA/cxgb4: free STAG index when TPT entry write fails (no CVSS, Linux)
- [CVE-2026-90414](https://cve.now/CVE-2026-90414.md): IB/isert: reject PDUs declaring more data than was received (CVSS 9.1, Linux)
- [CVE-2026-90413](https://cve.now/CVE-2026-90413.md): IB/isert: reject login PDUs declaring more data than was received (CVSS 9.1, Linux)
- [CVE-2026-90412](https://cve.now/CVE-2026-90412.md): nvmet: fix return status of RMI log page on allocation failure (no CVSS, Linux)
- [CVE-2026-90411](https://cve.now/CVE-2026-90411.md): nvme-fc: unmap cmd\_iu DMA on rsp\_iu mapping failure in init\_request (no CVSS, Linux)
- [CVE-2026-90410](https://cve.now/CVE-2026-90410.md): spi: davinci: switch to managed controller allocation (no CVSS, Linux)
- [CVE-2026-90409](https://cve.now/CVE-2026-90409.md): drm/panthor: Add vm\_bind region with kbo range overlap check (no CVSS, Linux)
- [CVE-2026-90408](https://cve.now/CVE-2026-90408.md): wifi: ath12k: fix overreads in ath12k\_wmi\_process\_csa\_switch\_count\_event() (CVSS 7.7, Linux)
- [CVE-2026-90407](https://cve.now/CVE-2026-90407.md): wifi: ath11k: fix overreads in ath11k\_wmi\_process\_csa\_switch\_count\_event() (CVSS 7.7, Linux)
- [CVE-2026-90406](https://cve.now/CVE-2026-90406.md): media: qcom: iris: handle runtime PM resume failure in core deinit (no CVSS, Linux)
- [CVE-2026-90405](https://cve.now/CVE-2026-90405.md): media: stm32: dcmi: fix some error handling bugs in probe() (no CVSS, Linux)
- [CVE-2026-90404](https://cve.now/CVE-2026-90404.md): platform/chrome: cros\_ec\_debugfs: Unregister panic notifier (no CVSS, Linux)
- [CVE-2026-90403](https://cve.now/CVE-2026-90403.md): wifi: rtlwifi: pci: fix error path in rtl\_pci\_probe() (CVSS 7.0, Linux)
- [CVE-2026-90402](https://cve.now/CVE-2026-90402.md): bus: mhi: host: Fix controller cleanup on EDL sysfs failure (CVSS 7.0, Linux)
- [CVE-2026-90401](https://cve.now/CVE-2026-90401.md): md: remove REQ\_NOWAIT support from raid1/10/456 (CVSS 7.1, Linux)
- [CVE-2026-90400](https://cve.now/CVE-2026-90400.md): md: recheck spare changes before starting sync (no CVSS, Linux)
- [CVE-2026-90399](https://cve.now/CVE-2026-90399.md): wifi: ath12k: fix stride mismatch in mac\_phy\_caps\_parse() (CVSS 8.4, Linux)
- [CVE-2026-90398](https://cve.now/CVE-2026-90398.md): wifi: ath11k: fix stride mismatch in mac\_phy\_caps\_parse() (CVSS 8.4, Linux)
- [CVE-2026-90397](https://cve.now/CVE-2026-90397.md): firmware: qcom: scm: Fix NULL dereference in IRQ handler before \_\_scm is published (no CVSS, Linux)
- [CVE-2026-90396](https://cve.now/CVE-2026-90396.md): block: fix dio leak on metadata mapping error (no CVSS, Linux)
- [CVE-2026-90395](https://cve.now/CVE-2026-90395.md): power: supply: isp1704\_charger: cancel work on remove (no CVSS, Linux)
- [CVE-2026-90394](https://cve.now/CVE-2026-90394.md): power: supply: sc2731\_charger: cancel work on remove (no CVSS, Linux)
- [CVE-2026-90393](https://cve.now/CVE-2026-90393.md): bpf: Fix potential UAF in bpf\_netns\_link\_update\_prog (no CVSS, Linux)
- [CVE-2026-90392](https://cve.now/CVE-2026-90392.md): bpf: Fix potential UAF when reading bpf link info (CVSS 7.8, Linux)
- [CVE-2026-90391](https://cve.now/CVE-2026-90391.md): lib/test\_hmm: fail dmirror\_fault() when the mirrored mm is gone (no CVSS, Linux)
- [CVE-2026-90390](https://cve.now/CVE-2026-90390.md): md/bitmap: resume array on backlog\_store() error path (no CVSS, Linux)
- [CVE-2026-90389](https://cve.now/CVE-2026-90389.md): md: scope memalloc\_noio to allocation critical sections (no CVSS, Linux)
- [CVE-2026-90388](https://cve.now/CVE-2026-90388.md): iommu/dma: Check atomic pool allocation result directly (CVSS 7.8, Linux)
- [CVE-2026-90387](https://cve.now/CVE-2026-90387.md): swiotlb: Preserve allocation virtual address for dynamic pools (CVSS 7.8, Linux)
- [CVE-2026-90386](https://cve.now/CVE-2026-90386.md): i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (no CVSS, Linux)
- [CVE-2026-90385](https://cve.now/CVE-2026-90385.md): md/raid1: create serial pool adding rdev to array with serialize\_policy=1 (no CVSS, Linux)
- [CVE-2026-90384](https://cve.now/CVE-2026-90384.md): iomap: release the folio batch on iomap callback failures (no CVSS, Linux)
- [CVE-2026-90383](https://cve.now/CVE-2026-90383.md): misc: sgi-gru: remove interrupt-context page-table walks (CVSS 7.8, Linux)
- [CVE-2026-90382](https://cve.now/CVE-2026-90382.md): wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (no CVSS, Linux)
- [CVE-2026-90381](https://cve.now/CVE-2026-90381.md): wifi: mt76: fix handling channel context with different bands in mt76\_switch\_vif\_chanctx() (CVSS 8.8, Linux)
- [CVE-2026-90380](https://cve.now/CVE-2026-90380.md): wifi: mt76: mt792x: fix use-after-free in mt76\_rx\_poll\_complete (CVSS 8.8, Linux)
- [CVE-2026-90379](https://cve.now/CVE-2026-90379.md): wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash (CVSS 8.8, Linux)
- [CVE-2026-90378](https://cve.now/CVE-2026-90378.md): wifi: mt76: mt792x: Fix memory leak in SDIO TX path (no CVSS, Linux)
- [CVE-2026-90377](https://cve.now/CVE-2026-90377.md): wifi: mt76: fix RX data queuing of RRO 3.0 (no CVSS, Linux)
- [CVE-2026-90376](https://cve.now/CVE-2026-90376.md): wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP (no CVSS, Linux)
- [CVE-2026-90375](https://cve.now/CVE-2026-90375.md): wifi: mt76: fix non-AQL packet accounting for MLO stations (no CVSS, Linux)
- [CVE-2026-90374](https://cve.now/CVE-2026-90374.md): wifi: mt76: mt7996: validate RX band\_idx before dereferencing phys\[\] (no CVSS, Linux)
- [CVE-2026-90373](https://cve.now/CVE-2026-90373.md): wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (no CVSS, Linux)
- [CVE-2026-90372](https://cve.now/CVE-2026-90372.md): wifi: mt76: mt7915: avoid nss underflow in mt7915\_mcu\_get\_sta\_nss (CVSS 7.1, Linux)
- [CVE-2026-90371](https://cve.now/CVE-2026-90371.md): wifi: mt76: fix RXDMAD\_C buffer recycling race (CVSS 8.8, Linux)
- [CVE-2026-90370](https://cve.now/CVE-2026-90370.md): wifi: mt76: mt7996: bound TLV walk in mt7996\_mcu\_get\_chip\_config (no CVSS, Linux)
- [CVE-2026-90369](https://cve.now/CVE-2026-90369.md): wifi: mt76: fix out-of-bounds access in mmio copy helpers (no CVSS, Linux)
- [CVE-2026-90368](https://cve.now/CVE-2026-90368.md): wifi: mt76: mt7915: unwind state on add\_interface failure (no CVSS, Linux)
- [CVE-2026-90367](https://cve.now/CVE-2026-90367.md): wifi: mt76: mt7996: hold dev-\>mt76.mutex while disabling tx worker in SER (CVSS 8.8, Linux)
- [CVE-2026-90366](https://cve.now/CVE-2026-90366.md): wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (no CVSS, Linux)
- [CVE-2026-90365](https://cve.now/CVE-2026-90365.md): wifi: mt76: cancel reset and rc work on device unregister (no CVSS, Linux)
- [CVE-2026-90364](https://cve.now/CVE-2026-90364.md): ACPI: processor: Unregister cpufreq notifier on init failure (no CVSS, Linux)
- [CVE-2026-90363](https://cve.now/CVE-2026-90363.md): drm/msm: don't tear down KMS twice when KMS init fails (no CVSS, Linux)
- [CVE-2026-90362](https://cve.now/CVE-2026-90362.md): drm/msm/dsi: Drop dev\_pm\_opp\_set\_rate(0) (no CVSS, Linux)
- [CVE-2026-90361](https://cve.now/CVE-2026-90361.md): wifi: ath11k: fix leak in ath11k\_service\_ready\_ext\_event() (no CVSS, Linux)
- [CVE-2026-90360](https://cve.now/CVE-2026-90360.md): regulator: core: use system\_freezable\_wq for init complete work (no CVSS, Linux)
- [CVE-2026-90359](https://cve.now/CVE-2026-90359.md): bpf: Reject \>8 byte return values on return-reading trampoline paths (no CVSS, Linux)
- [CVE-2026-90358](https://cve.now/CVE-2026-90358.md): bpf, x86: Fix trampoline stack size for 128-bit arguments (CVSS 7.8, Linux)
- [CVE-2026-90357](https://cve.now/CVE-2026-90357.md): wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (CVSS 8.8, Linux)
- [CVE-2026-90356](https://cve.now/CVE-2026-90356.md): wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset (no CVSS, Linux)
- [CVE-2026-90355](https://cve.now/CVE-2026-90355.md): wifi: mt76: mt7996: clear stale link state on full reset (no CVSS, Linux)
- [CVE-2026-90354](https://cve.now/CVE-2026-90354.md): wifi: mt76: mt7915: fix double hif2 init on the non-WED path (no CVSS, Linux)
- [CVE-2026-90353](https://cve.now/CVE-2026-90353.md): wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (CVSS 7.0, Linux)
- [CVE-2026-90352](https://cve.now/CVE-2026-90352.md): wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (no CVSS, Linux)
- [CVE-2026-90351](https://cve.now/CVE-2026-90351.md): wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed (no CVSS, Linux)
- [CVE-2026-90350](https://cve.now/CVE-2026-90350.md): wifi: mt76: reject out-of-range link ids in mt76\_vif\_link() (no CVSS, Linux)
- [CVE-2026-90349](https://cve.now/CVE-2026-90349.md): wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996\_tx() (no CVSS, Linux)
- [CVE-2026-90348](https://cve.now/CVE-2026-90348.md): wifi: ath10k: snoc: use memcpy\_fromio() for MSA ramdump (no CVSS, Linux)
- [CVE-2026-90347](https://cve.now/CVE-2026-90347.md): arm64: ptrace: Keep 'orig\_x0' in-sync with x0 on syscall entry (CVSS 8.4, Linux)
- [CVE-2026-90346](https://cve.now/CVE-2026-90346.md): wifi: nl80211: clean up color-change beacon data on errors (no CVSS, Linux)
- [CVE-2026-90345](https://cve.now/CVE-2026-90345.md): wifi: brcmfmac: fix P2P action frame handling without device vif (no CVSS, Linux)
- [CVE-2026-90344](https://cve.now/CVE-2026-90344.md): wifi: mac80211: disconnect on CSA to channel 0 (no CVSS, Linux)
- [CVE-2026-90343](https://cve.now/CVE-2026-90343.md): wifi: cfg80211: stop PMSR before P2P and NAN teardown (CVSS 7.8, Linux)
- [CVE-2026-90342](https://cve.now/CVE-2026-90342.md): bpf: Fix mmap\_lock deadlock on arena lock failure (no CVSS, Linux)
- [CVE-2026-90341](https://cve.now/CVE-2026-90341.md): firmware: coreboot: Validate table bounds (CVSS 7.7, Linux)
- [CVE-2026-90340](https://cve.now/CVE-2026-90340.md): pinctrl: generic: free maps on pinctrl\_generic\_to\_map() failure (no CVSS, Linux)
- [CVE-2026-90339](https://cve.now/CVE-2026-90339.md): powerpc/syscall: Fix syscall skip handling for seccomp and ptrace (no CVSS, Linux)
- [CVE-2026-90338](https://cve.now/CVE-2026-90338.md): serial: amba-pl011: keep console clock enabled for atomic writes (no CVSS, Linux)
- [CVE-2026-90337](https://cve.now/CVE-2026-90337.md): serial: core: do fallible allocations before the console can be registered (no CVSS, Linux)
- [CVE-2026-90336](https://cve.now/CVE-2026-90336.md): serial: core: clear freed pointers on uart\_register\_driver() failure (no CVSS, Linux)
- [CVE-2026-90335](https://cve.now/CVE-2026-90335.md): tty: skip cdev\_del() when no cdev is registered (no CVSS, Linux)
- [CVE-2026-90334](https://cve.now/CVE-2026-90334.md): tty: clear cdev pointer after cdev\_add() failure (no CVSS, Linux)
- [CVE-2026-90333](https://cve.now/CVE-2026-90333.md): dm-integrity: replace forgeable discard filler with a keyed sector marker (no CVSS, Linux)
- [CVE-2026-90332](https://cve.now/CVE-2026-90332.md): PCI: dwc: ep: Flush cached MSI write before unmapping the iATU (CVSS 8.2, Linux)
- [CVE-2026-90331](https://cve.now/CVE-2026-90331.md): HID: asus: refactor the two workqueues and init sequence (no CVSS, Linux)
- [CVE-2026-90330](https://cve.now/CVE-2026-90330.md): HID: logitech-hidpp: Fix FF device cleanup on init failure (no CVSS, Linux)
- [CVE-2026-90329](https://cve.now/CVE-2026-90329.md): HID: synchronize input before cleaning up a failed probe (CVSS 8.8, Linux)
- [CVE-2026-90328](https://cve.now/CVE-2026-90328.md): HID: steam: Reject short reads (no CVSS, Linux)
- [CVE-2026-90327](https://cve.now/CVE-2026-90327.md): phonet: pep: do not write beyond optlen in getsockopt (no CVSS, Linux)
- [CVE-2026-90326](https://cve.now/CVE-2026-90326.md): blk-cgroup: fix race between policy activation and blkg destruction (CVSS 7.8, Linux)
- [CVE-2026-90325](https://cve.now/CVE-2026-90325.md): blk-cgroup: skip dying blkg in blkcg\_activate\_policy() (CVSS 7.8, Linux)
- [CVE-2026-90324](https://cve.now/CVE-2026-90324.md): ublk: check import\_ubuf() return value (CVSS 7.8, Linux)
- [CVE-2026-90323](https://cve.now/CVE-2026-90323.md): ublk: validate auto buf reg before taking uring\_cmd (no CVSS, Linux)
- [CVE-2026-90322](https://cve.now/CVE-2026-90322.md): ocfs2/cluster: keep heartbeat local node stable (no CVSS, Linux)
- [CVE-2026-90321](https://cve.now/CVE-2026-90321.md): ocfs2: validate inline xattrs during inode block validation (CVSS 7.8, Linux)
- [CVE-2026-90320](https://cve.now/CVE-2026-90320.md): ocfs2: validate external xattr entries when reading metadata (CVSS 7.8, Linux)
- [CVE-2026-90319](https://cve.now/CVE-2026-90319.md): rapidio: clear mport-\>net when rio\_add\_net() fails (no CVSS, Linux)
- [CVE-2026-90318](https://cve.now/CVE-2026-90318.md): fat: release buffer head after rebuilding parent (no CVSS, Linux)
- [CVE-2026-90317](https://cve.now/CVE-2026-90317.md): bpf: Invalidate RCU pointers after final spin unlock (CVSS 7.8, Linux)
- [CVE-2026-90316](https://cve.now/CVE-2026-90316.md): drm/omap: dsi: Do not copy isr table (CVSS 7.8, Linux)
- [CVE-2026-90315](https://cve.now/CVE-2026-90315.md): PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (no CVSS, Linux)
- [CVE-2026-90314](https://cve.now/CVE-2026-90314.md): remoteproc: fix OOB read via signed offset in rsc\_table\_for\_each\_entry() (no CVSS, Linux)
- [CVE-2026-90313](https://cve.now/CVE-2026-90313.md): bpf, cgroup: Fix invalid storage access after \_\_cgroup\_bpf\_attach failed (no CVSS, Linux)
- [CVE-2026-90312](https://cve.now/CVE-2026-90312.md): bpf: Check load-acquire src ptr type before the load (CVSS 7.8, Linux)
- [CVE-2026-90311](https://cve.now/CVE-2026-90311.md): thermal: hwmon: Remove hwmon class device along with its parent (no CVSS, Linux)
- [CVE-2026-90309](https://cve.now/CVE-2026-90309.md): RDMA/erdma: Hold CQ references when processing EQ events (CVSS 7.8, Linux)
- [CVE-2026-90308](https://cve.now/CVE-2026-90308.md): RDMA/erdma: Hold QP references for AE and CM processing (CVSS 7.8, Linux)
- [CVE-2026-90307](https://cve.now/CVE-2026-90307.md): RDMA/srp: fix heap information leak on a truncated SRP\_CRED\_REQ (no CVSS, Linux)
- [CVE-2026-90306](https://cve.now/CVE-2026-90306.md): ARM: 9481/2: breakpoint: CFI breakpoints only on demand (no CVSS, Linux)
- [CVE-2026-90305](https://cve.now/CVE-2026-90305.md): ARM: 9483/1: select HAVE\_POSIX\_CPU\_TIMERS\_TASK\_WORK (no CVSS, Linux)
- [CVE-2026-90304](https://cve.now/CVE-2026-90304.md): ARM: 9484/1: enable interrupts when unhandled user faults are triggered (no CVSS, Linux)
- [CVE-2026-90303](https://cve.now/CVE-2026-90303.md): ARM: 9485/1: mm: acquire mmap write lock around show\_pte() for user faults (no CVSS, Linux)
- [CVE-2026-90302](https://cve.now/CVE-2026-90302.md): ocfs2: synchronize heartbeat callbacks with o2net teardown (no CVSS, Linux)
- [CVE-2026-90301](https://cve.now/CVE-2026-90301.md): ocfs2: o2hb: quiesce negotiate handlers and timeout work (CVSS 8.1, Linux)
- [CVE-2026-90300](https://cve.now/CVE-2026-90300.md): bpf: Clear buf on error in \_\_bpf\_get\_task\_stack (no CVSS, Linux)
- [CVE-2026-90299](https://cve.now/CVE-2026-90299.md): bpf: Fix sleepable check for tracing/lsm prog (no CVSS, Linux)
- [CVE-2026-90298](https://cve.now/CVE-2026-90298.md): drm/sun4i: tcon: Drop TCON TOP device reference (no CVSS, Linux)
- [CVE-2026-90297](https://cve.now/CVE-2026-90297.md): drm/sun4i: crtc: Propagate layer initialization error (no CVSS, Linux)
- [CVE-2026-90296](https://cve.now/CVE-2026-90296.md): cpufreq: imx6q: fix devres accumulation across driver rebind (no CVSS, Linux)
- [CVE-2026-90295](https://cve.now/CVE-2026-90295.md): cpufreq: imx6q: fix out-of-bounds write when probed more than once (no CVSS, Linux)
- [CVE-2026-90294](https://cve.now/CVE-2026-90294.md): IB/isert: delay the final Login Response until the session is registered (CVSS 7.5, Linux)
- [CVE-2026-90293](https://cve.now/CVE-2026-90293.md): IB/isert: post the full-feature receive buffers after session registration (CVSS 7.5, Linux)
- [CVE-2026-90292](https://cve.now/CVE-2026-90292.md): RDMA/siw: Fix use-after-free in siw\_accept() (CVSS 7.8, Linux)
- [CVE-2026-90291](https://cve.now/CVE-2026-90291.md): module/dups: Fix use-after-free in kmod\_dup\_req lifetime handling (CVSS 7.8, Linux)
- [CVE-2026-90290](https://cve.now/CVE-2026-90290.md): arm64: hibernate: Restore DAIF state on error (no CVSS, Linux)
- [CVE-2026-90289](https://cve.now/CVE-2026-90289.md): drm/amd/display: Resize MST HDCP per-connector arrays to 32 (CVSS 7.8, Linux)
- [CVE-2026-90288](https://cve.now/CVE-2026-90288.md): phy: renesas: rcar-gen2: Fix double of\_node\_put on phy creation failure (CVSS 7.4, Linux)
- [CVE-2026-90287](https://cve.now/CVE-2026-90287.md): phy: sunplus: fix error handling in sp\_uphy\_init() (no CVSS, Linux)
- [CVE-2026-90286](https://cve.now/CVE-2026-90286.md): drm/amdgpu/gfx6: Use PFP on the compute queues too (CVSS 8.8, Linux)
- [CVE-2026-90285](https://cve.now/CVE-2026-90285.md): scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (no CVSS, Linux)
- [CVE-2026-90284](https://cve.now/CVE-2026-90284.md): firmware\_loader: do not queue completed sysfs fallback requests (no CVSS, Linux)
- [CVE-2026-90283](https://cve.now/CVE-2026-90283.md): hugetlbfs: release subpool on fill\_super failure (no CVSS, Linux)
- [CVE-2026-90282](https://cve.now/CVE-2026-90282.md): phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend (no CVSS, Linux)
- [CVE-2026-90281](https://cve.now/CVE-2026-90281.md): phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (no CVSS, Linux)
- [CVE-2026-90280](https://cve.now/CVE-2026-90280.md): phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend (no CVSS, Linux)
- [CVE-2026-90279](https://cve.now/CVE-2026-90279.md): md/raid5: round bitmap stripes with sector division (no CVSS, Linux)
- [CVE-2026-90278](https://cve.now/CVE-2026-90278.md): md: wait for behind writes before destroying bitmap (no CVSS, Linux)
- [CVE-2026-90277](https://cve.now/CVE-2026-90277.md): md/md-llbitmap: prevent create failure bitmap UAF (no CVSS, Linux)
- [CVE-2026-90276](https://cve.now/CVE-2026-90276.md): md/md-llbitmap: stop daemon timer rearm on destroy (no CVSS, Linux)
- [CVE-2026-90275](https://cve.now/CVE-2026-90275.md): md/raid1: don't set array\_frozen in raid1\_takeover() (no CVSS, Linux)
- [CVE-2026-90274](https://cve.now/CVE-2026-90274.md): coresight: etm4x: fix underflow for usage of (nrseqstate - 1) (no CVSS, Linux)
- [CVE-2026-90273](https://cve.now/CVE-2026-90273.md): coresight: etm4x: missing cscfg\_csdev\_disable\_active\_config() in perf enable (no CVSS, Linux)
- [CVE-2026-90272](https://cve.now/CVE-2026-90272.md): perf: arm\_pmuv3: Zero initialize hw\_id branch stack field (no CVSS, Linux)
- [CVE-2026-90271](https://cve.now/CVE-2026-90271.md): arm\_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt (no CVSS, Linux)
- [CVE-2026-90270](https://cve.now/CVE-2026-90270.md): arm\_mpam: Disable driver unbind to avoid UAF (no CVSS, Linux)
- [CVE-2026-90269](https://cve.now/CVE-2026-90269.md): bpf: Reject load-acquire from pointers requiring fault protection (no CVSS, Linux)
- [CVE-2026-90268](https://cve.now/CVE-2026-90268.md): scsi: sd: Fix error handling in sd\_probe() after large pool creation failure (CVSS 8.1, Linux)
- [CVE-2026-90267](https://cve.now/CVE-2026-90267.md): scsi: sd: Fix special\_vec mempool leak when scsi\_alloc\_sgtables() fails (no CVSS, Linux)
- [CVE-2026-90266](https://cve.now/CVE-2026-90266.md): btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge (no CVSS, Linux)
- [CVE-2026-90265](https://cve.now/CVE-2026-90265.md): btrfs: defrag: fix deadlock between defrag and delalloc space reservation (no CVSS, Linux)
- [CVE-2026-90264](https://cve.now/CVE-2026-90264.md): btrfs: always wait for ordered extents to avoid OE races (no CVSS, Linux)
- [CVE-2026-90263](https://cve.now/CVE-2026-90263.md): btrfs: check if root is readonly when setting posix acl (no CVSS, Linux)
- [CVE-2026-90262](https://cve.now/CVE-2026-90262.md): btrfs: retry verity reads for not-uptodate Merkle folios (no CVSS, Linux)
- [CVE-2026-90261](https://cve.now/CVE-2026-90261.md): btrfs: zoned: flush active metadata block group at btree\_writepages() start (no CVSS, Linux)
- [CVE-2026-90260](https://cve.now/CVE-2026-90260.md): btrfs: zoned: don't clobber the extent buffer when zeroing it out (CVSS 7.1, Linux)
- [CVE-2026-90259](https://cve.now/CVE-2026-90259.md): btrfs: qgroup: fix a wrong length calculation in qgroup\_free\_reserved\_data() (no CVSS, Linux)
- [CVE-2026-90258](https://cve.now/CVE-2026-90258.md): pinctrl: airoha: add missed IRQ resource helpers (no CVSS, Linux)
- [CVE-2026-90257](https://cve.now/CVE-2026-90257.md): Bluetooth: virtio\_bt: avoid OOB read of build info string (no CVSS, Linux)
- [CVE-2026-90256](https://cve.now/CVE-2026-90256.md): Bluetooth: L2CAP: use proto\_lock for l2cap\_data to fix l2cap\_disconn\_ind (CVSS 8.8, Linux)
- [CVE-2026-90255](https://cve.now/CVE-2026-90255.md): Bluetooth: hci\_conn: fix the SCO setup context lifetime (CVSS 8.8, Linux)
- [CVE-2026-90254](https://cve.now/CVE-2026-90254.md): Bluetooth: hci\_sync: free the advertising instance on the failure and cancel paths (no CVSS, Linux)
- [CVE-2026-90253](https://cve.now/CVE-2026-90253.md): Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (no CVSS, Linux)
- [CVE-2026-90252](https://cve.now/CVE-2026-90252.md): Bluetooth: MGMT: free the HCI command when it is cancelled (no CVSS, Linux)
- [CVE-2026-90251](https://cve.now/CVE-2026-90251.md): Bluetooth: MSFT: validate evt\_prefix\_len against the response length (no CVSS, Linux)
- [CVE-2026-90250](https://cve.now/CVE-2026-90250.md): bpf, cgroup: Fix storage null-ptr-deref after replacing prog (no CVSS, Linux)
- [CVE-2026-90249](https://cve.now/CVE-2026-90249.md): iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes (no CVSS, Linux)
- [CVE-2026-90248](https://cve.now/CVE-2026-90248.md): net/sched: cls\_api: fix teardown of an adopted proto on insert-race loss (no CVSS, Linux)
- [CVE-2026-90247](https://cve.now/CVE-2026-90247.md): bpf: Fix mmap\_lock leak in irq\_work path (no CVSS, Linux)
- [CVE-2026-90246](https://cve.now/CVE-2026-90246.md): apparmor: fix integer overflow in verify\_tags() bounds check (CVSS 7.1, Linux)
- [CVE-2026-90245](https://cve.now/CVE-2026-90245.md): fbdev: kyro: Validate overlay viewport coordinates (no CVSS, Linux)
- [CVE-2026-90244](https://cve.now/CVE-2026-90244.md): iommu/dma: Restore locking around msi\_page\_list (CVSS 7.8, Linux)
- [CVE-2026-90243](https://cve.now/CVE-2026-90243.md): iommu/vt-d: Clear Present bit before tearing down copied context entry (CVSS 8.1, Linux)
- [CVE-2026-90242](https://cve.now/CVE-2026-90242.md): iommu/vt-d: Fix iopf\_refcount leak on RID domain replacement (no CVSS, Linux)
- [CVE-2026-90241](https://cve.now/CVE-2026-90241.md): iommu/vt-d: Tear down scalable-mode context on probe failure (CVSS 8.2, Linux)
- [CVE-2026-90240](https://cve.now/CVE-2026-90240.md): iommu/vt-d: Flush context cache with correct SID when tearing down aliases (CVSS 8.8, Linux)
- [CVE-2026-90239](https://cve.now/CVE-2026-90239.md): media: amd: isp4: release partial allocations in isp4if\_alloc\_fw\_gpumem() (no CVSS, Linux)
- [CVE-2026-90238](https://cve.now/CVE-2026-90238.md): media: amd: isp4: fix self-deadlock in isp4sd\_pwron\_and\_init() error path (no CVSS, Linux)
- [CVE-2026-90237](https://cve.now/CVE-2026-90237.md): netfilter: nft\_ct: move custom expectation support to helper (CVSS 7.8, Linux)
- [CVE-2026-90236](https://cve.now/CVE-2026-90236.md): NFSD: Release the export reference when reaping open stateids (no CVSS, Linux)
- [CVE-2026-90235](https://cve.now/CVE-2026-90235.md): sunrpc: xprtsock: annotate shared socket callbacks with READ\_ONCE/WRITE\_ONCE (CVSS 9.8, Linux)
- [CVE-2026-90234](https://cve.now/CVE-2026-90234.md): NFS: Return a delegation the client fails to record (CVSS 7.5, Linux)
- [CVE-2026-90233](https://cve.now/CVE-2026-90233.md): nvme-pci: release descriptor pools on probe failure (no CVSS, Linux)
- [CVE-2026-90232](https://cve.now/CVE-2026-90232.md): amt: Don't support cross-netns setup. (no CVSS, Linux)
- [CVE-2026-90231](https://cve.now/CVE-2026-90231.md): apparmor: fix unconfined user namespace restriction forced stack (CVSS 8.4, Linux)
- [CVE-2026-90230](https://cve.now/CVE-2026-90230.md): nvmet: fix heap out-of-bounds read in nvmet\_auth\_negotiate() (CVSS 9.1, Linux)
- [CVE-2026-90229](https://cve.now/CVE-2026-90229.md): nvme-apple: Destroy the admin queue on removal (CVSS 7.4, Linux)
- [CVE-2026-90228](https://cve.now/CVE-2026-90228.md): nvmet: fix NULL pointer dereference in nvmet\_execute\_identify\_ns\_zns() (CVSS 7.5, Linux)
- [CVE-2026-90227](https://cve.now/CVE-2026-90227.md): nvme/ioctl: check SUBMIT\_IO with nvme\_cmd\_allowed() (CVSS 7.8, Linux)
- [CVE-2026-90226](https://cve.now/CVE-2026-90226.md): nfc: llcp: avoid userspace overflow on invalid optlen (no CVSS, Linux)
- [CVE-2026-90225](https://cve.now/CVE-2026-90225.md): nfc: llcp: read llcp\_sock-\>local under the socket lock in getsockopt (CVSS 7.8, Linux)
- [CVE-2026-90224](https://cve.now/CVE-2026-90224.md): nfc: nci: fix double completion race in nci\_data\_exchange\_complete (CVSS 7.5, Linux)
- [CVE-2026-90223](https://cve.now/CVE-2026-90223.md): nfc: llcp: bound SNL TLV parsing to the skb and add length checks (CVSS 7.1, Linux)
- [CVE-2026-90222](https://cve.now/CVE-2026-90222.md): nfc: pn533: hold a reference to the request skb during send\_frame (no CVSS, Linux)
- [CVE-2026-90221](https://cve.now/CVE-2026-90221.md): nfc: nci: fix use of uninitialized memory in CORE\_INIT\_RSP parsing (no CVSS, Linux)
- [CVE-2026-90220](https://cve.now/CVE-2026-90220.md): ALSA: seq: Don't leak the extension cell pointer in the bounce payload (no CVSS, Linux)
- [CVE-2026-90219](https://cve.now/CVE-2026-90219.md): RDMA/cxgb4: Free debugfs on registration failure (no CVSS, Linux)
- [CVE-2026-90218](https://cve.now/CVE-2026-90218.md): RDMA/cma: Fix WARNING in res\_to\_rt (no CVSS, Linux)
- [CVE-2026-90217](https://cve.now/CVE-2026-90217.md): bpf: Compare iterator types during state pruning (CVSS 7.8, Linux)
- [CVE-2026-90216](https://cve.now/CVE-2026-90216.md): ubi: Fix rollback for explicit UBI device numbers (no CVSS, Linux)
- [CVE-2026-90215](https://cve.now/CVE-2026-90215.md): mtd: ubi: Release device reference on busy detach (no CVSS, Linux)
- [CVE-2026-90214](https://cve.now/CVE-2026-90214.md): ASoC: xilinx: formatter\_pcm: fix stream\_data leak on open error (no CVSS, Linux)
- [CVE-2026-90213](https://cve.now/CVE-2026-90213.md): firewire: core: fix memory leak in error path of build\_tree() (no CVSS, Linux)
- [CVE-2026-90212](https://cve.now/CVE-2026-90212.md): arm64/efi: Avoid voluntary preemption with efi\_mm installed (no CVSS, Linux)
- [CVE-2026-90211](https://cve.now/CVE-2026-90211.md): bpf, s390: Clear fetch destination on faulting arena atomic (no CVSS, Linux)
- [CVE-2026-90210](https://cve.now/CVE-2026-90210.md): bpf: Fix UAF in bpf\_trampoline\_multi\_attach\_free on update failure (CVSS 7.8, Linux)
- [CVE-2026-90209](https://cve.now/CVE-2026-90209.md): s390/debug: Fix deadlock during unregister (no CVSS, Linux)
- [CVE-2026-90208](https://cve.now/CVE-2026-90208.md): clocksource/drivers/samsung\_pwm: Switch to raw\_spinlock\_t type (no CVSS, Linux)
- [CVE-2026-90207](https://cve.now/CVE-2026-90207.md): ALSA: seq: midi: Serialize input teardown with event\_input (CVSS 7.8, Linux)
- [CVE-2026-90206](https://cve.now/CVE-2026-90206.md): nvmet: fix max\_qid race between configfs and controller allocation (no CVSS, Linux)
- [CVE-2026-90205](https://cve.now/CVE-2026-90205.md): ocfs2: validate orphan slot during inode read (CVSS 7.8, Linux)
- [CVE-2026-90204](https://cve.now/CVE-2026-90204.md): ocfs2: validate DIO orphan slot during inode read (CVSS 7.8, Linux)
- [CVE-2026-90203](https://cve.now/CVE-2026-90203.md): Squashfs: check block offset is not negative (CVSS 7.1, Linux)
- [CVE-2026-90202](https://cve.now/CVE-2026-90202.md): scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (no CVSS, Linux)
- [CVE-2026-90201](https://cve.now/CVE-2026-90201.md): net: page\_pool: fix UAF in \_\_page\_pool\_release\_netmem\_dma on xa\_cmpxchg race (no CVSS, Linux)
- [CVE-2026-90200](https://cve.now/CVE-2026-90200.md): fs/ntfs3: fix integer overflow in MFT cluster validation (no CVSS, Linux)
- [CVE-2026-90199](https://cve.now/CVE-2026-90199.md): fs/ntfs3: reject out-of-range evcn in mi\_enum\_attr() (CVSS 7.8, Linux)
- [CVE-2026-90198](https://cve.now/CVE-2026-90198.md): ALSA: core: Fix use-after-free in snd\_card\_do\_free() (no CVSS, Linux)
- [CVE-2026-90197](https://cve.now/CVE-2026-90197.md): HID: haptic: don't write an uninitialized value to unhandled usages (no CVSS, Linux)
- [CVE-2026-90196](https://cve.now/CVE-2026-90196.md): ASoC: SOF: validate topology volume range before allocation (no CVSS, Linux)
- [CVE-2026-90195](https://cve.now/CVE-2026-90195.md): riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args (no CVSS, Linux)
- [CVE-2026-90194](https://cve.now/CVE-2026-90194.md): ACPI: scan: fix bus ID cleanup on device\_add() failures (no CVSS, Linux)
- [CVE-2026-90193](https://cve.now/CVE-2026-90193.md): mailbox: qcom-cpucp: fix PREEMPT\_RT self-deadlock in IRQ handler (no CVSS, Linux)
- [CVE-2026-90192](https://cve.now/CVE-2026-90192.md): mailbox: qcom-cpucp: handle NULL data in send\_data callback (no CVSS, Linux)
- [CVE-2026-90191](https://cve.now/CVE-2026-90191.md): mailbox: riscv-sbi-mpxy: validate RPMI notification lengths (CVSS 8.4, Linux)
- [CVE-2026-90190](https://cve.now/CVE-2026-90190.md): null\_blk: use DEFINE\_MUTEX for the file-scope mutex (no CVSS, Linux)
- [CVE-2026-90189](https://cve.now/CVE-2026-90189.md): null\_blk: register configfs subsystem after creating default devices (no CVSS, Linux)
- [CVE-2026-90188](https://cve.now/CVE-2026-90188.md): null\_blk: free global tag\_set on init error path (no CVSS, Linux)
- [CVE-2026-90187](https://cve.now/CVE-2026-90187.md): null\_blk: free zones array on device power-off (no CVSS, Linux)
- [CVE-2026-90186](https://cve.now/CVE-2026-90186.md): null\_blk: reject per-device queue resize for shared tag set (no CVSS, Linux)
- [CVE-2026-90185](https://cve.now/CVE-2026-90185.md): null\_blk: serialize configfs attribute stores with the lock (no CVSS, Linux)
- [CVE-2026-90184](https://cve.now/CVE-2026-90184.md): null\_blk: serialize configfs attribute updates with device setup (no CVSS, Linux)
- [CVE-2026-90183](https://cve.now/CVE-2026-90183.md): blk-iolatency: clear delay state when freeing policy data (no CVSS, Linux)
- [CVE-2026-90182](https://cve.now/CVE-2026-90182.md): blk-iocost: clear delay state when freeing policy data (no CVSS, Linux)
- [CVE-2026-90181](https://cve.now/CVE-2026-90181.md): ublk: avoid teardown retry loop on xarray allocation failure (no CVSS, Linux)
- [CVE-2026-90180](https://cve.now/CVE-2026-90180.md): block: mtip32xx: synchronize ioctls with device removal (no CVSS, Linux)
- [CVE-2026-90179](https://cve.now/CVE-2026-90179.md): apparmor: fix deadlock in complain-mode change\_hat (no CVSS, Linux)
- [CVE-2026-90178](https://cve.now/CVE-2026-90178.md): hwmon: (coretemp) Fix core\_data leak on CPUs without PTS (no CVSS, Linux)
- [CVE-2026-90177](https://cve.now/CVE-2026-90177.md): bpf: Check pointer type for all atomic RMW paths (CVSS 7.8, Linux)
- [CVE-2026-90176](https://cve.now/CVE-2026-90176.md): ksmbd: Do not skip lock checks for single-byte ranges (CVSS 8.1, Linux)
- [CVE-2026-90175](https://cve.now/CVE-2026-90175.md): smb: server: fix leak of ksmbd\_ipc\_login\_request\_ext() returned buffer (no CVSS, Linux)
- [CVE-2026-90174](https://cve.now/CVE-2026-90174.md): ksmbd: fix slab-out-of-bounds read in ksmbd\_alloc\_user() (CVSS 7.1, Linux)
- [CVE-2026-90173](https://cve.now/CVE-2026-90173.md): smb: smbdirect: free completion queues with ib\_free\_cq() (CVSS 9.8, Linux)
- [CVE-2026-90172](https://cve.now/CVE-2026-90172.md): smb: smbdirect: destroy QP before mem pools on accept failure (CVSS 7.5, Linux)
- [CVE-2026-90171](https://cve.now/CVE-2026-90171.md): smb: smbdirect: release pending child sockets outside the handler lock (no CVSS, Linux)
- [CVE-2026-90170](https://cve.now/CVE-2026-90170.md): ksmbd: validate ipc response length before dereferencing its fields (no CVSS, Linux)
- [CVE-2026-90169](https://cve.now/CVE-2026-90169.md): ksmbd: free preauth sessions on connection teardown (no CVSS, Linux)
- [CVE-2026-90167](https://cve.now/CVE-2026-90167.md): ksmbd: serialize oplock close with pending break ownership (no CVSS, Linux)
- [CVE-2026-90166](https://cve.now/CVE-2026-90166.md): smb/server: fix null-ptr-deref in ksmbd\_ipc\_tree\_connect\_request() (no CVSS, Linux)
- [CVE-2026-90165](https://cve.now/CVE-2026-90165.md): smb/server: fix invalid pointer dereference in ksmbd\_stop\_durable\_scavenger() (no CVSS, Linux)
- [CVE-2026-90164](https://cve.now/CVE-2026-90164.md): smb/server: abort initialization when proc setup fails (no CVSS, Linux)
- [CVE-2026-90163](https://cve.now/CVE-2026-90163.md): smb/server: call ksmbd\_proc\_cleanup() on module init failure (no CVSS, Linux)
- [CVE-2026-90162](https://cve.now/CVE-2026-90162.md): ksmbd: defer publishing granted locks to prevent UAF/double-free race (CVSS 8.8, Linux)
- [CVE-2026-90161](https://cve.now/CVE-2026-90161.md): erofs: fix interlaced ztailpacking pclusters (CVSS 7.1, Linux)
- [CVE-2026-90160](https://cve.now/CVE-2026-90160.md): lwt\_bpf: Restore reserved headroom after xmit program (no CVSS, Linux)
- [CVE-2026-90159](https://cve.now/CVE-2026-90159.md): bpf: Disallow bpf\_{g,s}etsockopt() in cgroup UNIX getname hooks (no CVSS, Linux)
- [CVE-2026-90158](https://cve.now/CVE-2026-90158.md): m68k: nfcon: Do not call console\_is\_registered() in nfcon\_device() (no CVSS, Linux)
- [CVE-2026-90157](https://cve.now/CVE-2026-90157.md): bpf: Reject negative optlen in cgroup getsockopt hook (no CVSS, Linux)
- [CVE-2026-90156](https://cve.now/CVE-2026-90156.md): ksmbd: safely discard unregistered deferred locks (no CVSS, Linux)
- [CVE-2026-90155](https://cve.now/CVE-2026-90155.md): ksmbd: detach blocked lock requests before freeing (no CVSS, Linux)
- [CVE-2026-90154](https://cve.now/CVE-2026-90154.md): ksmbd: scope session state changes to bound connections (no CVSS, Linux)
- [CVE-2026-90153](https://cve.now/CVE-2026-90153.md): ksmbd: bound smb\_check\_perm\_dacl() ACE walks by DACL size (CVSS 8.1, Linux)
- [CVE-2026-90152](https://cve.now/CVE-2026-90152.md): smb/server: fix session leak in ksmbd\_session\_register() (no CVSS, Linux)
- [CVE-2026-90151](https://cve.now/CVE-2026-90151.md): NFSv4: remove callback IDR entry on client allocation failure (CVSS 9.8, Linux)
- [CVE-2026-90150](https://cve.now/CVE-2026-90150.md): pnfs/blocklayout: Fix device leaks on parse failure (no CVSS, Linux)
- [CVE-2026-90149](https://cve.now/CVE-2026-90149.md): NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (CVSS 7.5, Linux)
- [CVE-2026-90148](https://cve.now/CVE-2026-90148.md): NFSv4: Fix incorrect argument passed to nfs4\_delete\_lease() in nfs4\_add\_lease() (no CVSS, Linux)
- [CVE-2026-90147](https://cve.now/CVE-2026-90147.md): clk: devres: fix cleanup in devm\_clk\_get\_optional\_enabled\_with\_rate() (no CVSS, Linux)
- [CVE-2026-90146](https://cve.now/CVE-2026-90146.md): bpf, xdp: move offload check into dev\_xdp\_install() (CVSS 7.8, Linux)
- [CVE-2026-90145](https://cve.now/CVE-2026-90145.md): hinic3: Fix skb linearization mismatch and drop skb when skb\_checksum\_help() failed (CVSS 7.1, Linux)
- [CVE-2026-90144](https://cve.now/CVE-2026-90144.md): dpll: fix NULL deref in dpll\_device\_ops() during teardown race (no CVSS, Linux)
- [CVE-2026-90143](https://cve.now/CVE-2026-90143.md): net: kcm: Hold RCU read lock while running BPF parser (CVSS 7.8, Linux)
- [CVE-2026-90142](https://cve.now/CVE-2026-90142.md): virtio\_net: Fix resize of the RX ring (CVSS 7.8, Linux)
- [CVE-2026-90141](https://cve.now/CVE-2026-90141.md): ipvs: fix integer overflow in ftp helper port/address parsing (CVSS 7.3, Linux)
- [CVE-2026-90140](https://cve.now/CVE-2026-90140.md): cuse: wait for pending RCU callbacks on module exit (no CVSS, Linux)
- [CVE-2026-90139](https://cve.now/CVE-2026-90139.md): fuse: check for NULL root inode in fuse\_fill\_super\_submount (no CVSS, Linux)
- [CVE-2026-90138](https://cve.now/CVE-2026-90138.md): vsock: don't check the listener's sk\_err in vsock\_accept() (no CVSS, Linux)
- [CVE-2026-90137](https://cve.now/CVE-2026-90137.md): platform/x86: hp-bioscfg: fix password encoding bounds check (CVSS 7.7, Linux)
- [CVE-2026-90136](https://cve.now/CVE-2026-90136.md): platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (no CVSS, Linux)
- [CVE-2026-90135](https://cve.now/CVE-2026-90135.md): net: add missing ref\_tracker\_dir\_exit() to alloc\_netdev\_mqs() (no CVSS, Linux)
- [CVE-2026-90134](https://cve.now/CVE-2026-90134.md): ntfs: fix kmap\_local\_page() usage in compress (no CVSS, Linux)
- [CVE-2026-90133](https://cve.now/CVE-2026-90133.md): ntfs: Fix index\_root heap OOB write in ntfs\_ir\_to\_ib() (CVSS 7.8, Linux)
- [CVE-2026-90132](https://cve.now/CVE-2026-90132.md): ntfs: reject unprivileged writes to reserved $LX\* xattrs (CVSS 7.1, Linux)
- [CVE-2026-90131](https://cve.now/CVE-2026-90131.md): ntfs: serialize resident iomap reads with mrec\_lock (CVSS 7.1, Linux)
- [CVE-2026-90130](https://cve.now/CVE-2026-90130.md): vdpa\_sim: fix cleanup after worker creation failure (no CVSS, Linux)
- [CVE-2026-90129](https://cve.now/CVE-2026-90129.md): virtio\_balloon: quiesce balloon work before device shutdown (no CVSS, Linux)
- [CVE-2026-90128](https://cve.now/CVE-2026-90128.md): vdpa/mlx5: fix wrong list iterated in add\_direct\_chain error path (no CVSS, Linux)
- [CVE-2026-90127](https://cve.now/CVE-2026-90127.md): virtio: rtc: time out alarm requests (no CVSS, Linux)
- [CVE-2026-90126](https://cve.now/CVE-2026-90126.md): rtc: pcf8563: fix clock provider leak on unbind (no CVSS, Linux)
- [CVE-2026-90125](https://cve.now/CVE-2026-90125.md): smb: client: fix request buffer leak in smb2\_new\_read\_req() (no CVSS, Linux)
- [CVE-2026-90124](https://cve.now/CVE-2026-90124.md): irqchip/renesas-rzg2l: Fix loss of interrupt (no CVSS, Linux)
- [CVE-2026-90123](https://cve.now/CVE-2026-90123.md): irqchip/ast2700-intc: Avoid allocating in the irq\_domain activate() callback (no CVSS, Linux)
- [CVE-2026-90122](https://cve.now/CVE-2026-90122.md): clk: visconti: Make sure clk\_init\_data is fully initialized (no CVSS, Linux)
- [CVE-2026-90121](https://cve.now/CVE-2026-90121.md): irqchip/gic-v5: Clear per-CPU IRS data on teardown (no CVSS, Linux)
- [CVE-2026-90120](https://cve.now/CVE-2026-90120.md): irqchip/gic-v5: Check get\_logical\_index() return value in MADT IAFFID parsing (CVSS 8.4, Linux)
- [CVE-2026-90119](https://cve.now/CVE-2026-90119.md): ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (no CVSS, Linux)
- [CVE-2026-90118](https://cve.now/CVE-2026-90118.md): ntfs: fix off-by-one page overflow in ntfs\_decompress() (CVSS 7.8, Linux)
- [CVE-2026-90117](https://cve.now/CVE-2026-90117.md): ntfs: validate usa\_ofs before preserving the update sequence number (no CVSS, Linux)
- [CVE-2026-90116](https://cve.now/CVE-2026-90116.md): ALSA: mtpav: shut down output timer before card teardown (no CVSS, Linux)
- [CVE-2026-90115](https://cve.now/CVE-2026-90115.md): xsk: fix NULL pointer dereference in \_\_xsk\_rcv() (no CVSS, Linux)
- [CVE-2026-90114](https://cve.now/CVE-2026-90114.md): net: bridge: Reject descending VLAN tunnel ranges (no CVSS, Linux)
- [CVE-2026-90113](https://cve.now/CVE-2026-90113.md): netdevsim: update queue NAPI association on queue reset (no CVSS, Linux)
- [CVE-2026-90112](https://cve.now/CVE-2026-90112.md): net: qlcnic: validate unified ROM sections before loading (no CVSS, Linux)
- [CVE-2026-90111](https://cve.now/CVE-2026-90111.md): ip6mr: do not clone dst in ip6mr\_cache\_report() (CVSS 7.8, Linux)
- [CVE-2026-90110](https://cve.now/CVE-2026-90110.md): inetpeer: randomize RB-tree node comparison using SipHash (CVSS 9.4, Linux)
- [CVE-2026-90109](https://cve.now/CVE-2026-90109.md): net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue (no CVSS, Linux)
- [CVE-2026-90108](https://cve.now/CVE-2026-90108.md): net/smc: free stashed qentry before overwrite in REQ\_ADD\_LINK to ADD\_LINK transition (no CVSS, Linux)
- [CVE-2026-90107](https://cve.now/CVE-2026-90107.md): net/smc: free pending qentry in smc\_llc\_flow\_stop() before memset (no CVSS, Linux)
- [CVE-2026-90106](https://cve.now/CVE-2026-90106.md): net: bridge: arp/nd proxy: fix reading neigh ha (no CVSS, Linux)
- [CVE-2026-90105](https://cve.now/CVE-2026-90105.md): vxlan: fix reading neigh ha (no CVSS, Linux)
- [CVE-2026-90104](https://cve.now/CVE-2026-90104.md): NFSv4.1: zero referring call lists before decoding (CVSS 9.8, Linux)
- [CVE-2026-90103](https://cve.now/CVE-2026-90103.md): NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (CVSS 7.5, Linux)
- [CVE-2026-90102](https://cve.now/CVE-2026-90102.md): NFSv4/pnfs: key the data server cache on the NFS version (CVSS 7.5, Linux)
- [CVE-2026-90101](https://cve.now/CVE-2026-90101.md): bnxt\_en: Fix call to hardware monitoring event handler (no CVSS, Linux)
- [CVE-2026-90100](https://cve.now/CVE-2026-90100.md): ptp: netc: fix period truncation and potential divide-by-zero in PEROUT (no CVSS, Linux)
- [CVE-2026-90099](https://cve.now/CVE-2026-90099.md): net/sched: account classifier filter allocations to memcg (no CVSS, Linux)
- [CVE-2026-90098](https://cve.now/CVE-2026-90098.md): net: sparx5: fix sleep in atomic context in MAC table access (no CVSS, Linux)
- [CVE-2026-90097](https://cve.now/CVE-2026-90097.md): Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (no CVSS, Linux)
- [CVE-2026-90096](https://cve.now/CVE-2026-90096.md): fuse: invalidate the correct range after O\_APPEND direct write (no CVSS, Linux)
- [CVE-2026-90095](https://cve.now/CVE-2026-90095.md): fuse: Fix the condition to enable over-io-uring (no CVSS, Linux)
- [CVE-2026-90094](https://cve.now/CVE-2026-90094.md): arm64: process: Fix context switching MTE store-only tag check (no CVSS, Linux)
- [CVE-2026-90093](https://cve.now/CVE-2026-90093.md): Bluetooth: L2CAP: access chan-\>conn safely in get/setsockopt (CVSS 7.8, Linux)
- [CVE-2026-90092](https://cve.now/CVE-2026-90092.md): Bluetooth: L2CAP: reject accept queue add unless BT\_LISTEN (CVSS 8.0, Linux)
- [CVE-2026-90091](https://cve.now/CVE-2026-90091.md): Bluetooth: L2CAP: fix race l2cap\_sock\_cleanup\_listen() vs. put\_chan (CVSS 8.0, Linux)
- [CVE-2026-90090](https://cve.now/CVE-2026-90090.md): Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (no CVSS, Linux)
- [CVE-2026-90089](https://cve.now/CVE-2026-90089.md): Bluetooth: btnxpuart: Validate the FW dump header length (CVSS 7.1, Linux)
- [CVE-2026-90088](https://cve.now/CVE-2026-90088.md): Bluetooth: RFCOMM: Validate MTU in rfcomm\_apply\_pn() to prevent infinite loop (no CVSS, Linux)
- [CVE-2026-90087](https://cve.now/CVE-2026-90087.md): Bluetooth: do not leak an hci\_conn when a second LE connect is rejected (no CVSS, Linux)
- [CVE-2026-90086](https://cve.now/CVE-2026-90086.md): xsk: honor XDP\_TX\_METADATA in zero-copy path (no CVSS, Linux)
- [CVE-2026-90085](https://cve.now/CVE-2026-90085.md): octeontx2-af: fix NULL deref in NIX TM tree debugfs read path (no CVSS, Linux)
- [CVE-2026-90084](https://cve.now/CVE-2026-90084.md): octeontx2-vf: fix workqueue and netdev race in probe/remove (no CVSS, Linux)
- [CVE-2026-90083](https://cve.now/CVE-2026-90083.md): net/sched: act\_ife: Only operate on Ethernet frames (no CVSS, Linux)
- [CVE-2026-90082](https://cve.now/CVE-2026-90082.md): net: mana: Cap MSI-X vectors to the device MSI-X table size (no CVSS, Linux)
- [CVE-2026-90081](https://cve.now/CVE-2026-90081.md): net/rds: use wq\_has\_sleeper() in rds\_cong\_map\_updated() (no CVSS, Linux)
- [CVE-2026-90080](https://cve.now/CVE-2026-90080.md): octeontx2-pf: fix NULL deref of af\_xdp\_zc\_qidx on rep setup (no CVSS, Linux)
- [CVE-2026-90079](https://cve.now/CVE-2026-90079.md): octeontx2-af: fix cn20k mailbox lifetime on repeated rvu\_mbox\_init() (no CVSS, Linux)
- [CVE-2026-90078](https://cve.now/CVE-2026-90078.md): net/sched: act\_skbmod: fix length calculations and avoid invalid header warnings (no CVSS, Linux)
- [CVE-2026-90077](https://cve.now/CVE-2026-90077.md): net: fix a resource leak in copy\_net\_ns() error handling path (no CVSS, Linux)
- [CVE-2026-90076](https://cve.now/CVE-2026-90076.md): net/sched: fq: add overflow bounds to quantum and initial quantum (no CVSS, Linux)
- [CVE-2026-90075](https://cve.now/CVE-2026-90075.md): net/sched: fq\_codel: clamp default quantum and mtu (no CVSS, Linux)
- [CVE-2026-90074](https://cve.now/CVE-2026-90074.md): net/sched: fq\_pie: clamp default quantum to avoid signed overflow (no CVSS, Linux)
- [CVE-2026-90073](https://cve.now/CVE-2026-90073.md): net/sched: hhf: clamp quantum before hhf\_change() to avoid overflow (no CVSS, Linux)
- [CVE-2026-90072](https://cve.now/CVE-2026-90072.md): net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (no CVSS, Linux)
- [CVE-2026-90071](https://cve.now/CVE-2026-90071.md): net/sched: sch\_teql: restore skb-\>dev on the slave failure path (CVSS 7.8, Linux)
- [CVE-2026-90070](https://cve.now/CVE-2026-90070.md): tpm: st33zp24: Return zero on status read failure (no CVSS, Linux)
- [CVE-2026-90069](https://cve.now/CVE-2026-90069.md): crypto: acomp - allocate async request context when cloning (CVSS 7.8, Linux)
- [CVE-2026-90068](https://cve.now/CVE-2026-90068.md): ASoC: dapm: Fix off-by-one check on the second enum channel (no CVSS, Linux)
- [CVE-2026-90067](https://cve.now/CVE-2026-90067.md): libceph: validate banner payload length (CVSS 7.5, Linux)
- [CVE-2026-90066](https://cve.now/CVE-2026-90066.md): samples/ftrace: Fix kthread\_stop() on ERR\_PTR in ftrace-direct-multi-modify (no CVSS, Linux)
- [CVE-2026-90065](https://cve.now/CVE-2026-90065.md): net/smc: release the internal TCP sock on IPPROTO\_SMC socket creation failure (no CVSS, Linux)
- [CVE-2026-90064](https://cve.now/CVE-2026-90064.md): drm/xe: Reject page faults from non-fault-mode scratch VMs (no CVSS, Linux)
- [CVE-2026-90063](https://cve.now/CVE-2026-90063.md): virtio-net: Ensure that TCP packets don't overflow gso\_segs (no CVSS, Linux)
- [CVE-2026-90062](https://cve.now/CVE-2026-90062.md): netfilter: nf\_tables: move hardware offload step after building the chain blob (CVSS 7.1, Linux)
- [CVE-2026-90061](https://cve.now/CVE-2026-90061.md): netfilter: nf\_tables: skip double clone set expressions on element insert (no CVSS, Linux)
- [CVE-2026-90060](https://cve.now/CVE-2026-90060.md): ALSA: control: Don't add invalid kcontrols to LED layer (no CVSS, Linux)
- [CVE-2026-90059](https://cve.now/CVE-2026-90059.md): net: stmmac: restore NET\_IP\_ALIGN in the RX DMA offset (CVSS 7.5, Linux)
- [CVE-2026-90058](https://cve.now/CVE-2026-90058.md): net/sched: bound qdisc\_pkt\_len to prevent qdisc soft lockup (no CVSS, Linux)
- [CVE-2026-90057](https://cve.now/CVE-2026-90057.md): slip: remove slip\_hangup() to fix use-after-free in slip\_receive\_buf() (CVSS 7.8, Linux)
- [CVE-2026-90056](https://cve.now/CVE-2026-90056.md): net: fec: only stop PTP if it was initialized (no CVSS, Linux)
- [CVE-2026-90055](https://cve.now/CVE-2026-90055.md): usb: atm: usbatm: fix invalid ci\_range initialization (no CVSS, Linux)
- [CVE-2026-90054](https://cve.now/CVE-2026-90054.md): tcp: fix corruption of urgent data on multi-segment retransmit (no CVSS, Linux)
- [CVE-2026-90053](https://cve.now/CVE-2026-90053.md): net/sched: sch\_htb: limit htb\_classify inner-class filter hops (no CVSS, Linux)
- [CVE-2026-90051](https://cve.now/CVE-2026-90051.md): tcp: reject non zerocopy devmem tx (CVSS 7.8, Linux)
- [CVE-2026-92980](https://cve.now/CVE-2026-92980.md): HortusFox-Web \< 6.1 Remote Code Execution via Import/Export (CVSS 8.6, danielbrendel hortusfox-web)
- [CVE-2026-85720](https://cve.now/CVE-2026-85720.md): AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request (CVSS 5.9, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-85718](https://cve.now/CVE-2026-85718.md): AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service (CVSS 5.9, AsyncHttpClient async-http-client)
- [CVE-2026-85721](https://cve.now/CVE-2026-85721.md): AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service (CVSS 7.5, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-89036](https://cve.now/CVE-2026-89036.md): Appwrite \< 2.0.0 Argument Injection via providerRootDirectory Parameter (CVSS 8.7, appwrite)
- [CVE-2026-85717](https://cve.now/CVE-2026-85717.md): AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target (CVSS 6.8, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-85719](https://cve.now/CVE-2026-85719.md): AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP (CVSS 7.5, AsyncHttpClient async-http-client)
- [CVE-2026-61700](https://cve.now/CVE-2026-61700.md): MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests (CVSS 3.7, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-69197](https://cve.now/CVE-2026-69197.md): Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion (CVSS 8.7, Umbraco-CMS · Umbraco.Cms)
- [CVE-2026-81515](https://cve.now/CVE-2026-81515.md): Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) (CVSS 7.5, SteeltoeOSS security-advisories · Steeltoe.Discovery.Eureka)
- [CVE-2026-81516](https://cve.now/CVE-2026-81516.md): Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) (CVSS 7.5, SteeltoeOSS security-advisories · Steeltoe.Discovery.Consul)
- [CVE-2026-81868](https://cve.now/CVE-2026-81868.md): Steeltoe: Header-forwarded client cert lacks proof of private-key possession (CVSS 6.5, SteeltoeOSS security-advisories · Steeltoe.Security.Authori…)
- [CVE-2026-75523](https://cve.now/CVE-2026-75523.md): Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets (CVSS 5.9, SteeltoeOSS security-advisories · Steeltoe.Management.Endpo…)
- [CVE-2026-85715](https://cve.now/CVE-2026-85715.md): ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion (CVSS 7.5, mattiasw ExifReader · exifreader)
- [CVE-2026-86864](https://cve.now/CVE-2026-86864.md): pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool (CVSS 8.8, pgadmin.org pgAdmin)
- [CVE-2026-86863](https://cve.now/CVE-2026-86863.md): pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode (CVSS 9.8, pgadmin.org pgAdmin)
- [CVE-2026-86862](https://cve.now/CVE-2026-86862.md): pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools (CVSS 6.5, pgadmin.org pgAdmin)
- [CVE-2026-86861](https://cve.now/CVE-2026-86861.md): pgAdmin 4: File Manager save\_file writes through a symbolic link planted after the containment check (CVSS 5.9, pgadmin.org pgAdmin)
- [CVE-2026-92881](https://cve.now/CVE-2026-92881.md): vgmstream AWB parser awb.c init\_vgmstream\_awb\_memory divide by zero (CVSS 5.3, vgmstream)
- [CVE-2026-56795](https://cve.now/CVE-2026-56795.md): Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. (CVSS 8.2, Dell Driver Pack For Windows OS · Dell Driver Pack For L… +2)
- [CVE-2026-85999](https://cve.now/CVE-2026-85999.md): Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex \`RE\_WS\_END\` (triggers on VALID selectors) (CVSS 5.3, facelessuser soupsieve · soupsieve)
- [CVE-2026-86000](https://cve.now/CVE-2026-86000.md): Soup Sieve: Polynomial-time ReDoS (O(n²)) in the \`IDENTIFIER\` / \`VALUE\` selector sub-patterns (CVSS 5.3, facelessuser soupsieve · soupsieve)
- [CVE-2026-86040](https://cve.now/CVE-2026-86040.md): libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS (CVSS 7.5, js-libp2p · @libp2p floodsub)
- [CVE-2026-91039](https://cve.now/CVE-2026-91039.md): dynamic\_oidc identities are not namespaced by connection in ash\_authentication, allowing cross-connection account takeover (CVSS 9.1, team-alembic ash\_authentication)
- [CVE-2026-86039](https://cve.now/CVE-2026-86039.md): libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses (CVSS 8.2, js-libp2p · @libp2p/peer-store)
- [CVE-2026-86038](https://cve.now/CVE-2026-86038.md): libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID (CVSS 7.5, js-libp2p · @libp2p/gossipsub)
- [CVE-2026-93015](https://cve.now/CVE-2026-93015.md): BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write (CVSS 7.0, BlueKitchen BTstack)
- [CVE-2026-93014](https://cve.now/CVE-2026-93014.md): RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter (CVSS 7.1, RosarioSIS)
- [CVE-2026-93013](https://cve.now/CVE-2026-93013.md): RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal (CVSS 5.3, infiniflow ragflow)
- [CVE-2026-76834](https://cve.now/CVE-2026-76834.md): b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key (CVSS 9.2, b2evolution CMS)
- [CVE-2026-12284](https://cve.now/CVE-2026-12284.md): Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler (CVSS 3.8, Mattermost)
- [CVE-2026-76781](https://cve.now/CVE-2026-76781.md): Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-75588](https://cve.now/CVE-2026-75588.md): Mattermost Desktop App plugin popout scheme validation bypass (CVSS 2.6, Mattermost)
- [CVE-2026-92880](https://cve.now/CVE-2026-92880.md): vgmstream EA SCHl parser vadpcm\_decoder.c vadpcm\_read\_coefs\_be out-of-bounds write (CVSS 5.3, vgmstream)
- [CVE-2026-26950](https://cve.now/CVE-2026-26950.md): Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. (CVSS 8.1, Dell SmartFabric Manager)
- [CVE-2026-87742](https://cve.now/CVE-2026-87742.md): Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering (CVSS 7.5, Red Hat build of Quarkus 3.27.5.SP2 · Red Hat build of Q… +2)
- [CVE-2026-54471](https://cve.now/CVE-2026-54471.md): Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. (CVSS 3.5, Dell SmartFabric Manager)
- [CVE-2026-79752](https://cve.now/CVE-2026-79752.md): CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection (CVSS 9.2, cakephp · cakephp/database +1)
- [CVE-2026-61793](https://cve.now/CVE-2026-61793.md): Nuxt OG Image has unauthenticated SSRF via \`fonts\[\].path\` URL parameter (CVSS 6.9, nuxt-modules og-image · nuxt-og-image)
- [CVE-2026-81447](https://cve.now/CVE-2026-81447.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. (CVSS 6.8, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-63459](https://cve.now/CVE-2026-63459.md): Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions (CVSS 8.7, vendurehq vendure · @vendure/dashboard)
- [CVE-2026-63461](https://cve.now/CVE-2026-63461.md): Vendure: Shop API list queries can return non-public entities when filterOperator is OR (CVSS 5.3, vendurehq vendure · @vendure/core)
- [CVE-2026-63472](https://cve.now/CVE-2026-63472.md): Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification (CVSS 9.1, vendurehq vendure · @vendure/core)
- [CVE-2026-63460](https://cve.now/CVE-2026-63460.md): Vendure: Unauthenticated ReDoS via \`regex\` filter on SQLite backends (CVSS 7.5, vendurehq vendure · @vendure/core)
- [CVE-2026-80356](https://cve.now/CVE-2026-80356.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vul (CVSS 7.3, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-71538](https://cve.now/CVE-2026-71538.md): @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows (CVSS 8.5, cyclonedx-node-npm · @cyclonedx/cyclonedx-npm)
- [CVE-2026-81446](https://cve.now/CVE-2026-81446.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. (CVSS 7.4, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-85078](https://cve.now/CVE-2026-85078.md): sanic chunked trailer request smuggling allows hidden second request execution (CVSS 6.5, sanic-org sanic · sanic)
- [CVE-2026-81445](https://cve.now/CVE-2026-81445.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. (CVSS 7.2, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-85077](https://cve.now/CVE-2026-85077.md): Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses (CVSS 8.2, sanic-org sanic)
- [CVE-2026-77614](https://cve.now/CVE-2026-77614.md): Opencast: Session fixation in login enables account takeover via crafted link (CVSS 8.8, opencast)
- [CVE-2026-92987](https://cve.now/CVE-2026-92987.md): roxmltree through 0.21.1 Denial of Service via Quadratic Parsing (CVSS 8.7, RazrFalcon roxmltree)
- [CVE-2026-92986](https://cve.now/CVE-2026-92986.md): SiYuan before 3.8.4 Cross-Site Scripting via Document Title (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-92985](https://cve.now/CVE-2026-92985.md): SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-92984](https://cve.now/CVE-2026-92984.md): HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier (CVSS 8.5, hubzero-cms)
- [CVE-2026-92983](https://cve.now/CVE-2026-92983.md): InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch (CVSS 8.7, InternLM lmdeploy)
- [CVE-2026-88952](https://cve.now/CVE-2026-88952.md): OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication (CVSS 9.1, team-alembic ash\_authentication)
- [CVE-2026-81453](https://cve.now/CVE-2026-81453.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory (' (CVSS 6.5, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-81829](https://cve.now/CVE-2026-81829.md): Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver (CVSS 5.3, Red Hat build of Quarkus 3.27.5.SP2 · Red Hat build of Q… +4)
- [CVE-2026-92879](https://cve.now/CVE-2026-92879.md): vgmstream mus\_acm.c parse\_mus resource consumption (CVSS 5.3, vgmstream)
- [CVE-2026-81443](https://cve.now/CVE-2026-81443.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. (CVSS 6.4, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-81442](https://cve.now/CVE-2026-81442.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. (CVSS 8.1, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-92963](https://cve.now/CVE-2026-92963.md): vm2 before 3.11.2 Information Disclosure via Internal State (CVSS 6.9, patriksimek vm2 · vm2)
- [CVE-2026-92962](https://cve.now/CVE-2026-92962.md): vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js (CVSS 2.1, patriksimek vm2 · vm2)
- [CVE-2026-92961](https://cve.now/CVE-2026-92961.md): vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass (CVSS 8.7, patriksimek vm2 · vm2)
- [CVE-2026-92960](https://cve.now/CVE-2026-92960.md): vm2 before 3.11.6 Process-wide State Exposure via os and dns (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-71568](https://cve.now/CVE-2026-71568.md): BMCtest exposes Ironic without authentication and TLS during the test (CVSS 5.3, openshift-metal3 bmctest)
- [CVE-2026-92959](https://cve.now/CVE-2026-92959.md): vm2 before 3.11.8 allowAsync Bypass via Promise Thenable (CVSS 7.1, patriksimek vm2 · vm2)
- [CVE-2026-92958](https://cve.now/CVE-2026-92958.md): vm2 before 3.11.7 Denylist Bypass via fs/promises (CVSS 8.4, patriksimek vm2 · vm2)
- [CVE-2026-92957](https://cve.now/CVE-2026-92957.md): vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix (CVSS 9.4, patriksimek vm2 · vm2)
- [CVE-2026-92956](https://cve.now/CVE-2026-92956.md): vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-92955](https://cve.now/CVE-2026-92955.md): vm2 before 3.11.8 Sandbox Escape via NodeVM (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-92954](https://cve.now/CVE-2026-92954.md): vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise (CVSS 9.2, patriksimek vm2 · vm2)
- [CVE-2026-92953](https://cve.now/CVE-2026-92953.md): vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray (CVSS 9.3, patriksimek vm2 · vm2)
- [CVE-2026-92952](https://cve.now/CVE-2026-92952.md): vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass (CVSS 8.9, patriksimek vm2 · vm2)
- [CVE-2026-92951](https://cve.now/CVE-2026-92951.md): vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver (CVSS 9.4, patriksimek vm2 · vm2)
- [CVE-2026-92950](https://cve.now/CVE-2026-92950.md): vm2 before 3.11.7 Sandbox Escape via CLI require (CVSS 9.3, patriksimek vm2 · vm2)
- [CVE-2026-92949](https://cve.now/CVE-2026-92949.md): vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor (CVSS 6.3, patriksimek vm2 · vm2)
- [CVE-2026-92948](https://cve.now/CVE-2026-92948.md): vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test (CVSS 9.4, patriksimek vm2 · vm2)
- [CVE-2026-92947](https://cve.now/CVE-2026-92947.md): vm2 before 3.11.7 Memory Disclosure via Buffer Pool (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-92946](https://cve.now/CVE-2026-92946.md): vm2 before 3.11.7 Remote Code Execution via require.external (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-92945](https://cve.now/CVE-2026-92945.md): vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching (CVSS 2.3, patriksimek vm2 · vm2)
- [CVE-2026-92944](https://cve.now/CVE-2026-92944.md): vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector (CVSS 9.3, patriksimek vm2 · vm2)
- [CVE-2026-92942](https://cve.now/CVE-2026-92942.md): vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry (CVSS 8.7, patriksimek vm2 · vm2)
- [CVE-2026-92941](https://cve.now/CVE-2026-92941.md): vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-92940](https://cve.now/CVE-2026-92940.md): vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-92939](https://cve.now/CVE-2026-92939.md): vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine (CVSS 9.4, patriksimek vm2 · vm2)
- [CVE-2026-92938](https://cve.now/CVE-2026-92938.md): vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite (CVSS 9.4, patriksimek vm2 · vm2)
- [CVE-2026-92937](https://cve.now/CVE-2026-92937.md): vm2 3.11.6 Remote Code Execution via Promise call/apply (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-92936](https://cve.now/CVE-2026-92936.md): vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack (CVSS 6.9, patriksimek vm2 · vm2)
- [CVE-2026-92935](https://cve.now/CVE-2026-92935.md): vm2 NodeVM Remote Code Execution via Array-Shaped Require (CVSS 9.5, patriksimek vm2 · vm2)
- [CVE-2026-92934](https://cve.now/CVE-2026-92934.md): vm2 before 3.11.8 Sandbox Escape RCE via AggregateError (CVSS 9.5, patriksimek vm2 · vm2)
- [CVE-2026-92933](https://cve.now/CVE-2026-92933.md): vm2 before 3.11.8 Information Disclosure via util.getCallSites (CVSS 6.9, patriksimek vm2 · vm2)
- [CVE-2026-92973](https://cve.now/CVE-2026-92973.md): ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8 (CVSS 5.3, pycontribs ansi2html)
- [CVE-2026-92972](https://cve.now/CVE-2026-92972.md): SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint (CVSS 8.8, sgl-project sglang)
- [CVE-2026-92971](https://cve.now/CVE-2026-92971.md): InternLM LMDeploy through 0.17.0 Assertion Denial of Service (CVSS 8.7, InternLM lmdeploy)
- [CVE-2026-92970](https://cve.now/CVE-2026-92970.md): HUBzero CMS through 2.2.32 Path Traversal via File Upload (CVSS 8.7, hubzero-cms)
- [CVE-2026-80355](https://cve.now/CVE-2026-80355.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. (CVSS 5.4, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-89418](https://cve.now/CVE-2026-89418.md): Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf) (CVSS 8.7, protobuf-javascript)
- [CVE-2026-14850](https://cve.now/CVE-2026-14850.md): Weak password recovery mechanism for forgotten password in MobiAPParc (CVSS 8.8, MobiAPParc)
- [CVE-2026-90887](https://cve.now/CVE-2026-90887.md): WordPress WP Inventory Manager plugin \<= 2.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Inventory Manager)
- [CVE-2026-78528](https://cve.now/CVE-2026-78528.md): WordPress BerqWP plugin \<= 4.1.15 - Broken Access Control vulnerability (CVSS 5.3, BerqWP)
- [CVE-2026-78295](https://cve.now/CVE-2026-78295.md): WordPress Xagio SEO plugin \<= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Xagio SEO)
- [CVE-2026-78294](https://cve.now/CVE-2026-78294.md): WordPress Geo Mashup plugin \<= 1.13.21 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Dylan Kuhn Geo Mashup)
- [CVE-2026-74017](https://cve.now/CVE-2026-74017.md): WordPress User Registration plugin \<= 5.2.7 - Broken Access Control vulnerability (CVSS 5.3, wpeverest User Registration)
- [CVE-2026-74005](https://cve.now/CVE-2026-74005.md): WordPress PublishPress Series plugin \<= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, PublishPress Series)
- [CVE-2026-74002](https://cve.now/CVE-2026-74002.md): WordPress Booking Calendar plugin \<= 11.7 - Broken Access Control vulnerability (CVSS 5.3, wpdevelop Booking Calendar)
- [CVE-2026-74000](https://cve.now/CVE-2026-74000.md): WordPress Simple Membership plugin \<= 4.8.2 - Broken Access Control vulnerability (CVSS 5.3, wp.insider Simple Membership)
- [CVE-2026-73999](https://cve.now/CVE-2026-73999.md): WordPress Cooked plugin \<= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Gora Tech Cooked)
- [CVE-2026-66676](https://cve.now/CVE-2026-66676.md): WordPress Easy Invoice plugin \<= 2.3.8 - Broken Access Control vulnerability (CVSS 5.3, MatrixAddons Easy Invoice)
- [CVE-2026-66631](https://cve.now/CVE-2026-66631.md): WordPress MC Woocommerce Wishlist plugin \<= 1.9.21 - SQL Injection vulnerability (CVSS 7.6, Moreconvert Team MC Woocommerce Wishlist)
- [CVE-2026-66630](https://cve.now/CVE-2026-66630.md): WordPress PublishPress Series plugin \<= 3.1.3 - SQL Injection vulnerability (CVSS 7.6, PublishPress Series)
- [CVE-2026-66628](https://cve.now/CVE-2026-66628.md): WordPress WP-Lister Lite for eBay plugin \<= 3.8.11 - SQL Injection vulnerability (CVSS 7.6, WP Lab WP-Lister Lite for eBay)
- [CVE-2026-66626](https://cve.now/CVE-2026-66626.md): WordPress SKT Addons for Elementor plugin \<= 4.0 - SQL Injection vulnerability (CVSS 7.6, Sonal S Sinha SKT Addons for Elementor)
- [CVE-2026-66625](https://cve.now/CVE-2026-66625.md): WordPress WC Vendors Marketplace plugin \<= 2.7.2.1 - SQL Injection vulnerability (CVSS 7.6, WCVendors WC Vendors Marketplace)
- [CVE-2026-66624](https://cve.now/CVE-2026-66624.md): WordPress WPMasterToolKit plugin \<= 2.22.0 - SQL Injection vulnerability (CVSS 7.6, Ludwig You WPMasterToolKit)
- [CVE-2026-66619](https://cve.now/CVE-2026-66619.md): WordPress Newsletters plugin \<= 4.18 - SQL Injection vulnerability (CVSS 7.6, Tribulant Software Newsletters)
- [CVE-2026-66618](https://cve.now/CVE-2026-66618.md): WordPress WP Maps plugin \<= 4.9.9 - SQL Injection vulnerability (CVSS 7.6, Flipper Code WP Maps)
- [CVE-2026-66617](https://cve.now/CVE-2026-66617.md): WordPress PublishPress Series plugin \<= 3.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PublishPress Series)
- [CVE-2026-66608](https://cve.now/CVE-2026-66608.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, Unlimited Elements For Elementor)
- [CVE-2026-66580](https://cve.now/CVE-2026-66580.md): WordPress Product Feed Manager plugin \<= 7.12.0 - SQL Injection vulnerability (CVSS 8.5, RexTheme Product Feed Manager)
- [CVE-2026-66579](https://cve.now/CVE-2026-66579.md): WordPress JetElements For Elementor plugin \<= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock. Jetimpex JetElements For Elementor)
- [CVE-2026-66578](https://cve.now/CVE-2026-66578.md): WordPress PropertyHive plugin \<= 2.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Property Hive PropertyHive)
- [CVE-2026-66577](https://cve.now/CVE-2026-66577.md): WordPress JetSearch plugin \<= 3.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock. Jetimpex JetSearch)
- [CVE-2026-66576](https://cve.now/CVE-2026-66576.md): WordPress JetBlocks For Elementor plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock. Jetimpex JetBlocks For Elementor)
- [CVE-2026-66575](https://cve.now/CVE-2026-66575.md): WordPress King Addons for Elementor plugin \<= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, KingAddons.com King Addons for Elementor)
- [CVE-2026-66574](https://cve.now/CVE-2026-66574.md): WordPress Element Pack Elementor Addons plugin \<= 8.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bdthemes Element Pack Elementor Addons)
- [CVE-2026-66573](https://cve.now/CVE-2026-66573.md): WordPress JetTabs plugin \<= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock. Jetimpex JetTabs)
- [CVE-2026-66572](https://cve.now/CVE-2026-66572.md): WordPress JetBlog plugin \<= 2.4.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock. Jetimpex JetBlog)
- [CVE-2026-66571](https://cve.now/CVE-2026-66571.md): WordPress Asset CleanUp: Page Speed Booster plugin \<= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Gabe Livan Asset CleanUp: Page Speed Booster)
- [CVE-2026-62108](https://cve.now/CVE-2026-62108.md): WordPress Headless Single Sign On plugin \<= 1.7.0 - Broken Authentication vulnerability (CVSS 9.8, miniOrange Headless Single Sign On)
- [CVE-2026-62104](https://cve.now/CVE-2026-62104.md): WordPress Migratico Lite plugin \<= 2.6.8 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, superweby Migratico Lite)
- [CVE-2026-62101](https://cve.now/CVE-2026-62101.md): WordPress EduAdmin Booking plugin \<= 5.4.2 - Broken Authentication vulnerability (CVSS 9.8, Chris Åkerfeldt Wendel EduAdmin Booking)
- [CVE-2026-90986](https://cve.now/CVE-2026-90986.md): WordPress Visitor Traffic Real Time Statistics Pro plugin \<= 11.21 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CODEPRESS IT Solutions Visitor Traffic Real Time Statistics…)
- [CVE-2026-85500](https://cve.now/CVE-2026-85500.md): \`require\_confirmed\_with\` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication (CVSS 9.1, team-alembic ash\_authentication)
- [CVE-2026-86533](https://cve.now/CVE-2026-86533.md): Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix (CVSS 9.1, team-alembic ash\_authentication · team-alembic ash\_authenti…)
- [CVE-2026-81632](https://cve.now/CVE-2026-81632.md): Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix (CVSS 7.2, team-alembic ash\_authentication\_phoenix · team-alembic ash\_…)
- [CVE-2026-80218](https://cve.now/CVE-2026-80218.md): Sign-in token minted for one resource accepted by another in AshAuthentication (CVSS 7.6, team-alembic ash\_authentication)
- [CVE-2026-78223](https://cve.now/CVE-2026-78223.md): Token revocation record built from unverified JWT claims in AshAuthentication (CVSS 6.9, team-alembic ash\_authentication)
- [CVE-2026-86522](https://cve.now/CVE-2026-86522.md): Log injection via an unescaped password reset identity in AshAuthentication (CVSS 6.3, team-alembic ash\_authentication)
- [CVE-2026-81637](https://cve.now/CVE-2026-81637.md): Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication (CVSS 2.3, team-alembic ash\_authentication)
- [CVE-2026-82761](https://cve.now/CVE-2026-82761.md): Magic link single-use tokens replayable via TOCTOU race in AshAuthentication (CVSS 9.1, team-alembic ash\_authentication)
- [CVE-2026-82685](https://cve.now/CVE-2026-82685.md): Confirmation token accepted on any record in AshAuthentication (CVSS 7.6, team-alembic ash\_authentication)
- [CVE-2026-82760](https://cve.now/CVE-2026-82760.md): Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in (CVSS 8.2, team-alembic ash\_authentication)
- [CVE-2026-82759](https://cve.now/CVE-2026-82759.md): Reversible IP address pseudonymisation in AshAuthentication audit log hash mode (CVSS 1.8, team-alembic ash\_authentication)
- [CVE-2026-82723](https://cve.now/CVE-2026-82723.md): Actor record with password digest stored in AshAuthentication audit log entries (CVSS 1.8, team-alembic ash\_authentication · ash\_authentication)
- [CVE-2026-92904](https://cve.now/CVE-2026-92904.md): Rubygem-foreman\_remote\_execution: job output readable without object-level view\_job\_invocations check (CVSS 4.3, Red Hat Satellite)
- [CVE-2026-92932](https://cve.now/CVE-2026-92932.md): MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled (CVSS 5.1, misp sachertortephp)
- [CVE-2026-92921](https://cve.now/CVE-2026-92921.md): admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5 (CVSS 4.9, cjbi admin3)
- [CVE-2026-92920](https://cve.now/CVE-2026-92920.md): admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled (CVSS 5.4, cjbi admin3)
- [CVE-2026-92919](https://cve.now/CVE-2026-92919.md): admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename (CVSS 8.1, cjbi admin3)
- [CVE-2026-92918](https://cve.now/CVE-2026-92918.md): admin3 through 3.0.0 Session Token Disclosure via Audit Log (CVSS 8.8, cjbi admin3)
- [CVE-2026-81481](https://cve.now/CVE-2026-81481.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory (' (CVSS 7.5, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-81480](https://cve.now/CVE-2026-81480.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. (CVSS 7.2, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-92860](https://cve.now/CVE-2026-92860.md): rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation (CVSS 9.4, rcourtman Pulse)
- [CVE-2026-90823](https://cve.now/CVE-2026-90823.md): FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /u (CVSS 9.8, FatPipe Networks MPVPN · FatPipe Networks WARP +1)
- [CVE-2026-90822](https://cve.now/CVE-2026-90822.md): FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerabili (CVSS 9.8, FatPipe Networks MPVPN · FatPipe Networks WARP +1)
- [CVE-2026-81441](https://cve.now/CVE-2026-81441.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. (CVSS 4.0, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-92925](https://cve.now/CVE-2026-92925.md): Redis: redis: out-of-bounds read via crafted cluster bus packets (CVSS 7.1, Red Hat Enterprise Linux · Pen Drive Powered by Red Hat… +2)
- [CVE-2026-81440](https://cve.now/CVE-2026-81440.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. (CVSS 7.3, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-81479](https://cve.now/CVE-2026-81479.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. (CVSS 5.8, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-81478](https://cve.now/CVE-2026-81478.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. (CVSS 8.1, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-92917](https://cve.now/CVE-2026-92917.md): Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print\_r (CVSS 8.7, getgrav grav)
- [CVE-2026-92916](https://cve.now/CVE-2026-92916.md): Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork (CVSS 8.7, getgrav grav)
- [CVE-2026-92915](https://cve.now/CVE-2026-92915.md): WWBN AVideo userVerifyEmail.php Unauthenticated Access Control (CVSS 6.9, WWBN AVideo)
- [CVE-2026-92914](https://cve.now/CVE-2026-92914.md): AVideo LoginControl PGP Second Factor Authentication Bypass (CVSS 8.6, WWBN AVideo)
- [CVE-2026-92913](https://cve.now/CVE-2026-92913.md): AVideo Weak PRNG Activation Code Authentication Bypass (CVSS 9.1, WWBN AVideo)
- [CVE-2026-92912](https://cve.now/CVE-2026-92912.md): AVideo Cryptographically Weak PRNG via uniqid Stream Key (CVSS 8.3, WWBN AVideo)
- [CVE-2026-81477](https://cve.now/CVE-2026-81477.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. (CVSS 7.2, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-81476](https://cve.now/CVE-2026-81476.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Comm (CVSS 8.1, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-78296](https://cve.now/CVE-2026-78296.md): WordPress FluentAuth plugin \<= 2.1.2 - Email Verification Bypass vulnerability (CVSS 5.3, WP ManageNinja FluentAuth)
- [CVE-2026-81475](https://cve.now/CVE-2026-81475.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. (CVSS 8.1, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-81439](https://cve.now/CVE-2026-81439.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. (CVSS 3.7, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-92903](https://cve.now/CVE-2026-92903.md): Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings (CVSS 8.2, Snowflake CLI)
- [CVE-2026-81438](https://cve.now/CVE-2026-81438.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. (CVSS 3.7, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-81474](https://cve.now/CVE-2026-81474.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. (CVSS 7.8, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-66269](https://cve.now/CVE-2026-66269.md): Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code (' (CVSS 7.3, Dell OpenManage Server Administrator Managed Node (Patch… +2)
- [CVE-2026-92611](https://cve.now/CVE-2026-92611.md): In Eclipse Ankaios versions 0.6.0 to before 1.0.4, \`LogRule::matches\` in the agent control-interface authorizer stops at the first wildcard (CVSS 4.8, Eclipse Foundation Eclipse Ankaios)
- [CVE-2026-92893](https://cve.now/CVE-2026-92893.md): Rubygem-foreman\_ansible: ansible inventory api ignores view\_hosts permission filters, exposes hidden parameters (CVSS 4.3, Red Hat Satellite)
- [CVE-2026-92894](https://cve.now/CVE-2026-92894.md): Rubygem-foreman\_ansible: unscoped lookupvalue deletion allows cross-model override value destruction (CVSS 4.3, Red Hat Satellite)
- [CVE-2026-78427](https://cve.now/CVE-2026-78427.md): Admission Control Bypass via Hardcoded Sidecar Image Exemption (CVSS 5.3, SUSE github.com/neuvector/neuvector)
- [CVE-2026-78425](https://cve.now/CVE-2026-78425.md): SAML Audience Confusion Allows Cross-SP Authentication (CVSS 7.6, SUSE github.com/neuvector/neuvector)
- [CVE-2026-78426](https://cve.now/CVE-2026-78426.md): Logout bypass via alternate JWT spelling (CVSS 2.0, SUSE neuvector)
- [CVE-2026-78428](https://cve.now/CVE-2026-78428.md): Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently (CVSS 8.8, SUSE neuvector)
- [CVE-2026-50610](https://cve.now/CVE-2026-50610.md): Improper Access control Vulnerability in NitroSense and PredatorSense Software (CVSS 7.4, Acer System Monitoring)
- [CVE-2026-50609](https://cve.now/CVE-2026-50609.md): Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software (CVSS 7.4, Acer System Monitoring)
- [CVE-2026-15688](https://cve.now/CVE-2026-15688.md): Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting (CVSS 9.2, Mitsubishi Electric GX Works3 · Mitsubishi Electric Motion…)
- [CVE-2026-50608](https://cve.now/CVE-2026-50608.md): Authentication Vulnerability in NitroSense and PredatorSense Software (CVSS 1.2, Acer System Monitoring)
- [CVE-2026-50607](https://cve.now/CVE-2026-50607.md): WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software (CVSS 2.7, Acer System Monitoring)
- [CVE-2026-50606](https://cve.now/CVE-2026-50606.md): Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense Software (CVSS 1.2, Acer System Monitoring)
- [CVE-2026-87831](https://cve.now/CVE-2026-87831.md): Checkout Field Manager \< 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field (CVSS 4.3, Checkout Field Manager (Checkout Manager) for WooCommerce)
- [CVE-2026-87829](https://cve.now/CVE-2026-87829.md): Checkout Field Manager \< 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting (CVSS 4.3, Checkout Field Manager (Checkout Manager) for WooCommerce)
- [CVE-2026-50605](https://cve.now/CVE-2026-50605.md): Privilege Escalation Vulnerability in NitroSense and PredatorSense Software (CVSS 7.4, Acer Agent Serivce)
- [CVE-2026-86320](https://cve.now/CVE-2026-86320.md): Flatpak-builder: host code execution via \`git am\` hook execution in patch source extraction (\`use-git-am\`) (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-91017](https://cve.now/CVE-2026-91017.md): Robokassa payment gateway for Woocommerce \< 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback (CVSS 3.7, Robokassa payment gateway for Woocommerce)
- [CVE-2026-87963](https://cve.now/CVE-2026-87963.md): Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter (CVSS 8.6, Yo)
- [CVE-2026-86801](https://cve.now/CVE-2026-86801.md): To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler (CVSS 8.8, To Do List Member)
- [CVE-2026-90982](https://cve.now/CVE-2026-90982.md): @fastify/static vulnerable to route guard bypass via path case-folding (CVSS 5.3, @fastify/static)
- [CVE-2026-44940](https://cve.now/CVE-2026-44940.md): Service token exposure and potential privilege escalation in SUSE Observability (CVSS 5.7, SUSE Observability)
- [CVE-2026-91019](https://cve.now/CVE-2026-91019.md): Event Booking Manager for WooCommerce \< 5.6.0 - Contributor+ Payment Gateway Credential Disclosure (CVSS 4.9, Event Booking Manager for WooCommerce)
- [CVE-2026-91016](https://cve.now/CVE-2026-91016.md): Motors \< 1.4.121 - Unauthenticated Draft/Private Listing Disclosure (CVSS 5.3, Motors)
- [CVE-2026-91015](https://cve.now/CVE-2026-91015.md): Master Addons for Elementor \< 3.1.9 - Unauthenticated Popup Deactivation via jltma\_popup\_disable\_expired (CVSS 5.3, Master Addons for Elementor)
- [CVE-2026-91014](https://cve.now/CVE-2026-91014.md): Realtyna Organic IDX plugin + WPL Real Estate \< 5.4.2 - Reflected XSS via Location Selector Endpoint (CVSS 7.1, Realtyna Organic IDX plugin + WPL Real Estate)
- [CVE-2026-91011](https://cve.now/CVE-2026-91011.md): EWWW Image Optimizer \< 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion (CVSS 6.8, EWWW Image Optimizer)
- [CVE-2026-91010](https://cve.now/CVE-2026-91010.md): Invisible Anti-Spam & CAPTCHA \< 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion (CVSS 4.3, Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for A…)
- [CVE-2026-91009](https://cve.now/CVE-2026-91009.md): Active Products Tables for WooCommerce \< 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot\_update\_attachment (CVSS 4.3, Active Woot Products Tables for WooCommerce. 100% FREE)
- [CVE-2026-91008](https://cve.now/CVE-2026-91008.md): Event Booking Manager for WooCommerce \< 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel (CVSS 3.7, Event Booking Manager for WooCommerce)
- [CVE-2026-90923](https://cve.now/CVE-2026-90923.md): Autopay \< 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion (CVSS 6.5, Autopay)
- [CVE-2026-90922](https://cve.now/CVE-2026-90922.md): Paid Member Subscriptions \< 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch (CVSS 5.3, Paid Membership Subscriptions)
- [CVE-2026-88904](https://cve.now/CVE-2026-88904.md): PuppyFW \<= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation (CVSS 8.8, PuppyFW)
- [CVE-2026-88795](https://cve.now/CVE-2026-88795.md): wpShopGermany IT-RECHT KANZLEI \< 2.4 - Unauthenticated RCE via Predictable API Token (CVSS 9.0, wpShopGermany IT-RECHT KANZLEI)
- [CVE-2026-88792](https://cve.now/CVE-2026-88792.md): Dictionary \<= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update (CVSS 8.8, Dictionary)
- [CVE-2026-87836](https://cve.now/CVE-2026-87836.md): Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export (CVSS 2.7, Comments Import & Export)
- [CVE-2026-87786](https://cve.now/CVE-2026-87786.md): Dewa Kirim \<= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates (CVSS 8.8, Dewa Kirim)
- [CVE-2026-86824](https://cve.now/CVE-2026-86824.md): Newsletter \< 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key (CVSS 4.8, Newsletter)
- [CVE-2026-86788](https://cve.now/CVE-2026-86788.md): HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag (CVSS 6.8, HT Mega Addons for Elementor)
- [CVE-2026-86710](https://cve.now/CVE-2026-86710.md): Login with QR \<= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin\_code' Parameter (CVSS 9.8, Login with QR)
- [CVE-2026-86709](https://cve.now/CVE-2026-86709.md): The Pressengine \<= 1.0 - Unauthenticated Authentication Bypass (CVSS 9.8, The Pressengine)
- [CVE-2026-86707](https://cve.now/CVE-2026-86707.md): Private Feed Key \<= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter (CVSS 9.8, Private Feed Key)
- [CVE-2026-86446](https://cve.now/CVE-2026-86446.md): LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint (CVSS 3.7, LearnPress)
- [CVE-2026-85130](https://cve.now/CVE-2026-85130.md): WPLP Cookie Consent \< 4.4.4 - Unauthenticated Stored XSS via Consent Logs (CVSS 8.8, WPLP Cookie Consent)
- [CVE-2026-85128](https://cve.now/CVE-2026-85128.md): Choose User Role at Registration for WooCommerce \< 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request (CVSS 7.5, Choose User Role at Registration)
- [CVE-2025-15697](https://cve.now/CVE-2025-15697.md): Dictionary \<= 1.0 - Reflected XSS via Multiple Parameters (CVSS 7.1, Dictionary)
- [CVE-2026-87796](https://cve.now/CVE-2026-87796.md): Multi Uploader for Gravity Forms \<= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload (CVSS 9.8, sh1zen Multi Uploader for Gravity Forms)
- [CVE-2026-87935](https://cve.now/CVE-2026-87935.md): Paid Downloads \<= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads\_update\_file' Action (CVSS 8.1, ichurakov Paid Downloads)
- [CVE-2026-25294](https://cve.now/CVE-2026-25294.md): Buffer Over-read in WLAN Firmware (CVSS 7.4, Qualcomm Snapdragon)
- [CVE-2026-25290](https://cve.now/CVE-2026-25290.md): Integer Overflow or Wraparound in OOBM (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25284](https://cve.now/CVE-2026-25284.md): Buffer Over-read in OOBM (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2026-25283](https://cve.now/CVE-2026-25283.md): Stack-based Buffer Overflow in OOBM (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25282](https://cve.now/CVE-2026-25282.md): Out-of-bounds Read in OOBM (CVSS 7.9, Qualcomm Snapdragon)
- [CVE-2026-25281](https://cve.now/CVE-2026-25281.md): Allocation of Resources Without Limits or Throttling in OOBM (CVSS 7.4, Qualcomm Snapdragon)
- [CVE-2026-25280](https://cve.now/CVE-2026-25280.md): Out-of-bounds Write in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25278](https://cve.now/CVE-2026-25278.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25275](https://cve.now/CVE-2026-25275.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2026-25261](https://cve.now/CVE-2026-25261.md): Untrusted Pointer Dereference in Camera (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2026-24081](https://cve.now/CVE-2026-24081.md): Buffer Over-read in BT Controller (CVSS 7.4, Qualcomm Snapdragon)
- [CVE-2026-24075](https://cve.now/CVE-2026-24075.md): Buffer Over-read in Qualcomm IPC (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-24074](https://cve.now/CVE-2026-24074.md): Out-of-bounds Write in Video (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-24073](https://cve.now/CVE-2026-24073.md): Out-of-bounds Write in Video (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-59607](https://cve.now/CVE-2025-59607.md): Untrusted Pointer Dereference in Windows Compute (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-50604](https://cve.now/CVE-2026-50604.md): Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software (CVSS 4.9, Acer Agent Service)
- [CVE-2026-50603](https://cve.now/CVE-2026-50603.md): Hard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSense (CVSS 4.9, Acer Agent Service)
- [CVE-2026-92839](https://cve.now/CVE-2026-92839.md): Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. (CVSS 4.3, Canva)
- [CVE-2026-86311](https://cve.now/CVE-2026-86311.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2026-89064](https://cve.now/CVE-2026-89064.md): All-in-One WP Migration and Backup \<= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header (CVSS 5.3, servmask All-in-One WP Migration and Backup)
- [CVE-2026-92838](https://cve.now/CVE-2026-92838.md): GeoVision GV-Remote E-Map dll hijacking vulnerability (CVSS 7.8, GeoVision GV-Remote E-map)
- [CVE-2026-81546](https://cve.now/CVE-2026-81546.md): The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity docum (CVSS 7.7, Canva Affinity)
- [CVE-2021-3030](https://cve.now/CVE-2021-3030.md): Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colo (CVSS 6.1)
- [CVE-2025-55787](https://cve.now/CVE-2025-55787.md): In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. (CVSS 9.8)
- [CVE-2026-52483](https://cve.now/CVE-2026-52483.md): The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR\_g8.10\_1.11(WVK.0)b46 allow auth (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.