# CVEs published 2026-10-18

552 CVEs were published on October 18, 2026: 10 critical, 55 high. Days are UTC.

- [CVE-2026-112032](https://cve.now/CVE-2026-112032.md): aircheng-org iWebShop-5 util.php search sql injection (CVSS 5.1, aircheng-org iWebShop-5)
- [CVE-2026-112031](https://cve.now/CVE-2026-112031.md): Chamilo LMS Ticket TicketManager.php addProject cross site scripting (CVSS 5.1, Chamilo LMS)
- [CVE-2026-112030](https://cve.now/CVE-2026-112030.md): diem-project diem dmDataLoad.php default password (CVSS 5.3, diem-project diem)
- [CVE-2026-112112](https://cve.now/CVE-2026-112112.md): An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matchi (CVSS 2.3, nic BIRD)
- [CVE-2026-112029](https://cve.now/CVE-2026-112029.md): diem-project diem SHA1 PluginDmUser.class.php weak password hash (CVSS 2.0, diem-project diem)
- [CVE-2026-112028](https://cve.now/CVE-2026-112028.md): light0011 cms Vote VoteController.class.php logic error (CVSS 6.9, light0011 cms)
- [CVE-2026-112111](https://cve.now/CVE-2026-112111.md): The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the \[bs\_tcontent\] shortcode. (CVSS 5.1, Bootstrap Shortcodes project Bootstrap Shortcodes)
- [CVE-2026-112027](https://cve.now/CVE-2026-112027.md): light0011 cms Uploadify check-exists.php file\_exists file information disclosure (CVSS 6.9, light0011 cms)
- [CVE-2026-112026](https://cve.now/CVE-2026-112026.md): light0011 cms UserModel.class.php sha1 weak password hash (CVSS 6.3, light0011 cms)
- [CVE-2026-112025](https://cve.now/CVE-2026-112025.md): light0011 cms Captcha Validation UserController.class.php access control (CVSS 6.9, light0011 cms)
- [CVE-2026-97859](https://cve.now/CVE-2026-97859.md): Gitea API disclosure of private user social graph, keys and stars (CVSS 6.5, Gitea)
- [CVE-2026-97204](https://cve.now/CVE-2026-97204.md): Gitea label deletion across repository and organization IDs (CVSS 3.1, Gitea)
- [CVE-2026-110494](https://cve.now/CVE-2026-110494.md): Gitea release attachment re-linking of issue attachments (CVSS 6.3, Gitea)
- [CVE-2026-110324](https://cve.now/CVE-2026-110324.md): Gitea private profile information disclosure through POST request (CVSS 6.5, Gitea)
- [CVE-2026-110311](https://cve.now/CVE-2026-110311.md): Gitea draft release creation disclosing attachment metadata (CVSS 4.3, Gitea)
- [CVE-2026-109844](https://cve.now/CVE-2026-109844.md): Gitea watched repositories API disclosure after access revocation (CVSS 4.3, Gitea)
- [CVE-2026-107686](https://cve.now/CVE-2026-107686.md): Gitea reactions accepted on locked issues and comments (CVSS 4.3, Gitea)
- [CVE-2026-107618](https://cve.now/CVE-2026-107618.md): Gitea cross-site request forgery on repository topics (CVSS 8.1, Gitea)
- [CVE-2026-105964](https://cve.now/CVE-2026-105964.md): Gitea Actions artifact v4 API unbounded request body (CVSS 6.5, Gitea)
- [CVE-2026-105661](https://cve.now/CVE-2026-105661.md): Gitea panic on the repositories route of individual users (CVSS 5.3, Gitea)
- [CVE-2026-109553](https://cve.now/CVE-2026-109553.md): Gitea SSH certificate principal impersonation of other users (CVSS 7.5, Gitea)
- [CVE-2026-104627](https://cve.now/CVE-2026-104627.md): Gitea OpenID account linking without session binding (CVSS 5.4, Gitea)
- [CVE-2024-4457](https://cve.now/CVE-2024-4457.md): Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution (CVSS 9.1, WSO2 Enterprise Integrator · WSO2 API Manager +5)
- [CVE-2026-111993](https://cve.now/CVE-2026-111993.md): Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage (CVSS 4.8, Soarkey StudentManagement)
- [CVE-2026-111992](https://cve.now/CVE-2026-111992.md): itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection (CVSS 5.3, itsmeravitejak Online-Examination-System)
- [CVE-2026-98868](https://cve.now/CVE-2026-98868.md): dm-pcache: reject a kset that overruns its segment (no CVSS, Linux)
- [CVE-2026-98867](https://cve.now/CVE-2026-98867.md): dm-pcache: bound the logical key offset from persistent memory (no CVSS, Linux)
- [CVE-2026-98866](https://cve.now/CVE-2026-98866.md): sched/cache: Introduce task\_struct-\>sched\_cache\_grp to fix UAF (no CVSS, Linux)
- [CVE-2026-98865](https://cve.now/CVE-2026-98865.md): sched\_ext: Don't run ops.dequeue() with a DSQ lock held (no CVSS, Linux)
- [CVE-2026-98864](https://cve.now/CVE-2026-98864.md): sched\_ext: Wait for SCX\_OPSS\_DISPATCHING before reenqueueing a task (no CVSS, Linux)
- [CVE-2026-98863](https://cve.now/CVE-2026-98863.md): KVM: x86: Re-pend GET\_NESTED\_STATE\_PAGES if getting said pages fails (no CVSS, Linux)
- [CVE-2026-98862](https://cve.now/CVE-2026-98862.md): audit: fix exe mark UAF in kill\_rules() (no CVSS, Linux)
- [CVE-2026-98861](https://cve.now/CVE-2026-98861.md): fprobe: Use guard(rcu\_sched\_notrace) and check rcu\_is\_watching() (no CVSS, Linux)
- [CVE-2026-98860](https://cve.now/CVE-2026-98860.md): HID: bpf: cast size to ssize\_t when checking hid\_bpf\_hw\_request (no CVSS, Linux)
- [CVE-2026-98859](https://cve.now/CVE-2026-98859.md): HID: multitouch: stop the release timer from being rearmed on remove (no CVSS, Linux)
- [CVE-2026-98858](https://cve.now/CVE-2026-98858.md): io\_uring: fix task\_work add use-after-free with SQPOLL (no CVSS, Linux)
- [CVE-2026-98857](https://cve.now/CVE-2026-98857.md): ipvs: bound LBLCR and LBLC cache growth (no CVSS, Linux)
- [CVE-2026-98856](https://cve.now/CVE-2026-98856.md): kprobes: Skip disarmed probes when checking optkprobe overlap (no CVSS, Linux)
- [CVE-2026-98855](https://cve.now/CVE-2026-98855.md): of/overlay: put property on deadprops only after changeset add succeeds (no CVSS, Linux)
- [CVE-2026-98854](https://cve.now/CVE-2026-98854.md): of/overlay: only treat a positive changeset id as registered (no CVSS, Linux)
- [CVE-2026-98853](https://cve.now/CVE-2026-98853.md): net: gso: limit recursive IP-in-IP segmentation (no CVSS, Linux)
- [CVE-2026-98852](https://cve.now/CVE-2026-98852.md): net: extend IPv6 exthdr detection of tunneled packets (no CVSS, Linux)
- [CVE-2026-98851](https://cve.now/CVE-2026-98851.md): netfilter: nft\_flow\_offload: drop flowtable reference on init error path (no CVSS, Linux)
- [CVE-2026-98850](https://cve.now/CVE-2026-98850.md): net/packet: prevent TX\_RING byte count overflow (no CVSS, Linux)
- [CVE-2026-98849](https://cve.now/CVE-2026-98849.md): pfcp: fix socket lifetime on netdevice registration failure (no CVSS, Linux)
- [CVE-2026-98848](https://cve.now/CVE-2026-98848.md): rtc: ac100: Assign .num before accessing .hws (no CVSS, Linux)
- [CVE-2026-98847](https://cve.now/CVE-2026-98847.md): rtc: spear: initialize IRQ state before requesting alarm IRQ (no CVSS, Linux)
- [CVE-2026-98846](https://cve.now/CVE-2026-98846.md): sctp: check RCV\_SHUTDOWN after the sendmsg connect wait (no CVSS, Linux)
- [CVE-2026-98845](https://cve.now/CVE-2026-98845.md): tpm: Disable TPM on null key name mismatch (no CVSS, Linux)
- [CVE-2026-98844](https://cve.now/CVE-2026-98844.md): netfs: clear post-EOF pagecache when extending a file via write (no CVSS, Linux)
- [CVE-2026-98843](https://cve.now/CVE-2026-98843.md): netfs: zero gaps in read-gaps folio to avoid writing back stale data (no CVSS, Linux)
- [CVE-2026-98842](https://cve.now/CVE-2026-98842.md): module: fix lost error code from codetag\_load\_module() (no CVSS, Linux)
- [CVE-2026-98841](https://cve.now/CVE-2026-98841.md): virt: vmgenid: set driver\_data before registering notification handlers (no CVSS, Linux)
- [CVE-2026-98840](https://cve.now/CVE-2026-98840.md): vc\_screen: reload vc pointer before if (ret) in vcs\_write() to avoid UAF (no CVSS, Linux)
- [CVE-2026-98839](https://cve.now/CVE-2026-98839.md): vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste\_selection() (no CVSS, Linux)
- [CVE-2026-98838](https://cve.now/CVE-2026-98838.md): vt: skip screen update for DEC alignment test on backgroup consoles (no CVSS, Linux)
- [CVE-2026-98837](https://cve.now/CVE-2026-98837.md): ALSA: caiaq: unregister the input device when probe fails (no CVSS, Linux)
- [CVE-2026-98836](https://cve.now/CVE-2026-98836.md): ALSA: line6: reject oversized playback packets (no CVSS, Linux)
- [CVE-2026-98835](https://cve.now/CVE-2026-98835.md): iio: accel: kionix-kx022a: Fix array boundary check (no CVSS, Linux)
- [CVE-2026-98834](https://cve.now/CVE-2026-98834.md): mtd: core: avoid double-free of OTP NVMEM device (no CVSS, Linux)
- [CVE-2026-98833](https://cve.now/CVE-2026-98833.md): mtd: core: call \_get\_device() with the master MTD (no CVSS, Linux)
- [CVE-2026-98832](https://cve.now/CVE-2026-98832.md): blk-cgroup: save IRQ state in blkg\_tryget\_closest() (no CVSS, Linux)
- [CVE-2026-98831](https://cve.now/CVE-2026-98831.md): of/overlay: don't leak fragment references when changeset init fails (no CVSS, Linux)
- [CVE-2026-98830](https://cve.now/CVE-2026-98830.md): wifi: wfx: validate MIB read length before copying to caller (no CVSS, Linux)
- [CVE-2026-98829](https://cve.now/CVE-2026-98829.md): wifi: mac80211: drop oversized fragments to avoid extra\_len overflow (no CVSS, Linux)
- [CVE-2026-98828](https://cve.now/CVE-2026-98828.md): wifi: ath9k: reject short WMI command responses (no CVSS, Linux)
- [CVE-2026-98827](https://cve.now/CVE-2026-98827.md): wifi: ath9k\_htc: bound TX aggregation to MAX\_TX\_BUF\_SIZE (no CVSS, Linux)
- [CVE-2026-98826](https://cve.now/CVE-2026-98826.md): rtc: ac100: Fix clock provider use-after-free on probe failure (no CVSS, Linux)
- [CVE-2026-98825](https://cve.now/CVE-2026-98825.md): rtc: mpfs: fix unchecked devm\_clk\_get() error pointer in probe() (no CVSS, Linux)
- [CVE-2026-98824](https://cve.now/CVE-2026-98824.md): wifi: mac80211: validate TX status rate metadata (no CVSS, Linux)
- [CVE-2026-98823](https://cve.now/CVE-2026-98823.md): wifi: cfg80211: preserve hidden-group beacon IE ownership (no CVSS, Linux)
- [CVE-2026-98822](https://cve.now/CVE-2026-98822.md): wifi: mac80211: prevent AP VLAN tx from other interfaces (no CVSS, Linux)
- [CVE-2026-98821](https://cve.now/CVE-2026-98821.md): block: reject polled dio with user integrity metadata (no CVSS, Linux)
- [CVE-2026-98820](https://cve.now/CVE-2026-98820.md): blk-mq: set RQF\_USE\_SCHED when the operation is known (no CVSS, Linux)
- [CVE-2026-98819](https://cve.now/CVE-2026-98819.md): Bluetooth: btintel: validate DDC record lengths (no CVSS, Linux)
- [CVE-2026-98818](https://cve.now/CVE-2026-98818.md): mm/slab: do not wake up kswapd in \_\_kfree\_rcu\_sheaf() (no CVSS, Linux)
- [CVE-2026-98817](https://cve.now/CVE-2026-98817.md): ASoC: SDCA: Add better pm\_runtime error handling in func probe (no CVSS, Linux)
- [CVE-2026-98816](https://cve.now/CVE-2026-98816.md): bpf: Fix overflow of jump offset in constant blinding (no CVSS, Linux)
- [CVE-2026-98815](https://cve.now/CVE-2026-98815.md): nvme: fix cdev lifetime (no CVSS, Linux)
- [CVE-2026-98814](https://cve.now/CVE-2026-98814.md): nvme: fix command effects log lifetime for multipath heads (no CVSS, Linux)
- [CVE-2026-98813](https://cve.now/CVE-2026-98813.md): bpf: Hold map BTF for the memory allocator destructor record (no CVSS, Linux)
- [CVE-2026-98812](https://cve.now/CVE-2026-98812.md): net/mctp: publish the mctp\_dev only after it is initialised (no CVSS, Linux)
- [CVE-2026-98811](https://cve.now/CVE-2026-98811.md): net/sched: cls\_api: reclaim an empty proto on the error path (no CVSS, Linux)
- [CVE-2026-98810](https://cve.now/CVE-2026-98810.md): wifi: mac80211: fix slab-out-of-bounds read in ieee80211\_monitor\_select\_queue() (no CVSS, Linux)
- [CVE-2026-98809](https://cve.now/CVE-2026-98809.md): Bluetooth: hci\_sync: don't drain cmd\_sync backlog on unregister (no CVSS, Linux)
- [CVE-2026-98808](https://cve.now/CVE-2026-98808.md): net: systemport: Fix buffer overflow in bcm\_sysport\_get\_stats() (no CVSS, Linux)
- [CVE-2026-98807](https://cve.now/CVE-2026-98807.md): net/mlx5: Fix slab-out-of-bounds when handling team device events (no CVSS, Linux)
- [CVE-2026-98806](https://cve.now/CVE-2026-98806.md): octeontx2-pf: Fix aura BPID assignment when CONFIG\_DCB is enabled (no CVSS, Linux)
- [CVE-2026-98805](https://cve.now/CVE-2026-98805.md): tipc: prevent GCM nonce reuse on peer key changes (no CVSS, Linux)
- [CVE-2026-98804](https://cve.now/CVE-2026-98804.md): net: page\_pool: fix use-after-free in page\_pool\_recycle\_ring\_bulk() (no CVSS, Linux)
- [CVE-2026-98803](https://cve.now/CVE-2026-98803.md): net: stmmac: fix rx Scatter-Gather support (no CVSS, Linux)
- [CVE-2026-98802](https://cve.now/CVE-2026-98802.md): seg6: ensure packet data is writable before modifying SRH and IPv6 DA (no CVSS, Linux)
- [CVE-2026-98801](https://cve.now/CVE-2026-98801.md): net: restrict SO\_RESERVE\_MEM to TCP sockets and cap max value (no CVSS, Linux)
- [CVE-2026-98800](https://cve.now/CVE-2026-98800.md): bpf: Wait for an RCU tasks grace period before freeing trampoline progs (no CVSS, Linux)
- [CVE-2026-98799](https://cve.now/CVE-2026-98799.md): bpf: Skip detached progs in trampoline images that are still in use (no CVSS, Linux)
- [CVE-2026-98798](https://cve.now/CVE-2026-98798.md): net: bcmgenet: fix NULL dereference in set\_coalesce before first open (no CVSS, Linux)
- [CVE-2026-98797](https://cve.now/CVE-2026-98797.md): net: cap skb-\>queue\_mapping when the tx queue is picked (no CVSS, Linux)
- [CVE-2026-98796](https://cve.now/CVE-2026-98796.md): net: ethernet: mtk\_eth\_soc: allocate dummy netdev sooner (no CVSS, Linux)
- [CVE-2026-98795](https://cve.now/CVE-2026-98795.md): net: sparx5: skip ptp deinit if init was skipped (no CVSS, Linux)
- [CVE-2026-98794](https://cve.now/CVE-2026-98794.md): ipvs: filter some flags received in the backup server (no CVSS, Linux)
- [CVE-2026-98793](https://cve.now/CVE-2026-98793.md): netfilter: bpf: reject invalid NAT manipulation types (no CVSS, Linux)
- [CVE-2026-98792](https://cve.now/CVE-2026-98792.md): netfilter: flowtable: generalize pending status bit (no CVSS, Linux)
- [CVE-2026-98791](https://cve.now/CVE-2026-98791.md): net/mlx5e: Fix AF\_XDP TX timestamp teardown NULL dereference (no CVSS, Linux)
- [CVE-2026-98790](https://cve.now/CVE-2026-98790.md): perf: Fix race between perf\_event\_exit\_task() and perf\_pending\_task() (no CVSS, Linux)
- [CVE-2026-98789](https://cve.now/CVE-2026-98789.md): bpf: Fix objects stuck in free\_by\_rcu\_ttrace (no CVSS, Linux)
- [CVE-2026-98788](https://cve.now/CVE-2026-98788.md): futex: Fix private hash use-after-free on resize (no CVSS, Linux)
- [CVE-2026-98787](https://cve.now/CVE-2026-98787.md): bpf: Fix missing migration protection in \_\_rhtab\_map\_lookup\_and\_delete\_batch() (no CVSS, Linux)
- [CVE-2026-98786](https://cve.now/CVE-2026-98786.md): drm/amd/display: guard dc\_sink dereferences in MST mode validation (no CVSS, Linux)
- [CVE-2026-98785](https://cve.now/CVE-2026-98785.md): drm/amd/display: check dc\_state\_create\_copy() for NULL in dm\_suspend (no CVSS, Linux)
- [CVE-2026-98784](https://cve.now/CVE-2026-98784.md): drm/amdgpu/gfx6: fix firmware leak on teardown (no CVSS, Linux)
- [CVE-2026-98783](https://cve.now/CVE-2026-98783.md): drm/mediatek: Add missing IS\_ERR check for ovl\_adaptor platform device (no CVSS, Linux)
- [CVE-2026-98782](https://cve.now/CVE-2026-98782.md): drm/mediatek: Fix ovl adaptor platform device leak (no CVSS, Linux)
- [CVE-2026-98781](https://cve.now/CVE-2026-98781.md): drm/mediatek: Fix pdev reference leak in mtk\_drm\_bind() (no CVSS, Linux)
- [CVE-2026-98780](https://cve.now/CVE-2026-98780.md): drm/amdgpu: fix IP instance memory leak on kobject add failure (no CVSS, Linux)
- [CVE-2026-98779](https://cve.now/CVE-2026-98779.md): drm/amdgpu: fix ACP MFD device leak on init failure (no CVSS, Linux)
- [CVE-2026-98778](https://cve.now/CVE-2026-98778.md): binder: fix is\_failure flag for superseded transaction cleanup (no CVSS, Linux)
- [CVE-2026-98777](https://cve.now/CVE-2026-98777.md): binder: fix leaked fd fixups on TF\_UPDATE\_TXN supersede (no CVSS, Linux)
- [CVE-2026-98776](https://cve.now/CVE-2026-98776.md): binderfs: fix UAF write in binder\_add\_device (no CVSS, Linux)
- [CVE-2026-98775](https://cve.now/CVE-2026-98775.md): nitro\_enclaves: fix use-after-free on SLOT\_ALLOC failure (no CVSS, Linux)
- [CVE-2026-98774](https://cve.now/CVE-2026-98774.md): rust\_binder: cancel deferred work items in thread exit (no CVSS, Linux)
- [CVE-2026-98773](https://cve.now/CVE-2026-98773.md): USB: cdc-acm: skip URB restart in port\_shutdown if disconnected (no CVSS, Linux)
- [CVE-2026-98772](https://cve.now/CVE-2026-98772.md): USB: serial: fix port tear down use-after-free (no CVSS, Linux)
- [CVE-2026-98771](https://cve.now/CVE-2026-98771.md): usb: storage: sierra\_ms: reject short SWoC info transfers (no CVSS, Linux)
- [CVE-2026-98770](https://cve.now/CVE-2026-98770.md): usb: gadget: midi2: Fix the jack descriptor array sizes (no CVSS, Linux)
- [CVE-2026-98769](https://cve.now/CVE-2026-98769.md): usb: gadget: f\_uac1\_legacy: validate bRequest index in generic\_{set,get}\_cmd (no CVSS, Linux)
- [CVE-2026-98768](https://cve.now/CVE-2026-98768.md): usb: typec: anx7411 - stop the IRQ before destroying the workqueue (no CVSS, Linux)
- [CVE-2026-98767](https://cve.now/CVE-2026-98767.md): usb: dwc3: gadget: fix IRQ storm on invalid event buffer count (no CVSS, Linux)
- [CVE-2026-98766](https://cve.now/CVE-2026-98766.md): usb: gadget: aspeed-vhub: cancel wake work on device removal (no CVSS, Linux)
- [CVE-2026-98765](https://cve.now/CVE-2026-98765.md): USB: gadget: dummy-hcd: Fix wait for outstanding request completions (no CVSS, Linux)
- [CVE-2026-98764](https://cve.now/CVE-2026-98764.md): usb: gadget: f\_fs: Fix NULL pointer dereference in FUNCTIONFS\_ENDPOINT\_DESC (no CVSS, Linux)
- [CVE-2026-98763](https://cve.now/CVE-2026-98763.md): usb: core: clear both ep\_in and ep\_out for non-ep0 control endpoints (no CVSS, Linux)
- [CVE-2026-98762](https://cve.now/CVE-2026-98762.md): USB: dwc2: shut down wakeup timer before freeing HCD state (no CVSS, Linux)
- [CVE-2026-98761](https://cve.now/CVE-2026-98761.md): usb: typec: tcpm: recover after failure to start the frs ams (no CVSS, Linux)
- [CVE-2026-98760](https://cve.now/CVE-2026-98760.md): usb: typec: tipd: fix uninitialized typec\_partner\_desc in tps6598x\_connect() (no CVSS, Linux)
- [CVE-2026-98759](https://cve.now/CVE-2026-98759.md): usb: typec: tipd: fix uninitialized typec\_partner\_desc in cd321x\_update\_work() (no CVSS, Linux)
- [CVE-2026-98758](https://cve.now/CVE-2026-98758.md): usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (no CVSS, Linux)
- [CVE-2026-98757](https://cve.now/CVE-2026-98757.md): usb: cdns3: fix use-after-free in cdns3\_gadget\_exit() (no CVSS, Linux)
- [CVE-2026-98756](https://cve.now/CVE-2026-98756.md): usb: cdns3: Fix NULL pointer dereference in cdns3\_pci\_probe (no CVSS, Linux)
- [CVE-2026-98755](https://cve.now/CVE-2026-98755.md): tty: vcc: zero-initialize control packet in vcc\_send\_ctl() (no CVSS, Linux)
- [CVE-2026-98754](https://cve.now/CVE-2026-98754.md): tty: vcc: hold port lock when clearing tty pointer in vcc\_cleanup (no CVSS, Linux)
- [CVE-2026-98753](https://cve.now/CVE-2026-98753.md): tty: tty\_port: restore TTY\_IO\_ERROR on activation failure (no CVSS, Linux)
- [CVE-2026-98752](https://cve.now/CVE-2026-98752.md): tty: port: fix tty\_port\_tty\_vhangup() race (no CVSS, Linux)
- [CVE-2026-98751](https://cve.now/CVE-2026-98751.md): tty: abort break signalling on hangup (no CVSS, Linux)
- [CVE-2026-98750](https://cve.now/CVE-2026-98750.md): tty: fix saved termios reset race (no CVSS, Linux)
- [CVE-2026-98749](https://cve.now/CVE-2026-98749.md): tty: serial: max3100: shut down timer before freeing port (no CVSS, Linux)
- [CVE-2026-98748](https://cve.now/CVE-2026-98748.md): serial: 8250\_bcm7271: fix use-after-free in brcmuart\_remove() (no CVSS, Linux)
- [CVE-2026-98747](https://cve.now/CVE-2026-98747.md): serial: core: fix NULL pointer dereference in serial\_core\_unregister\_port() (no CVSS, Linux)
- [CVE-2026-98746](https://cve.now/CVE-2026-98746.md): serial: ma35d1: Fix clock reference leak in ma35d1serial\_probe() (no CVSS, Linux)
- [CVE-2026-98745](https://cve.now/CVE-2026-98745.md): arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems (no CVSS, Linux)
- [CVE-2026-98744](https://cve.now/CVE-2026-98744.md): ASoC: codecs: max98363: fix uninitialized stream\_config-\>type (no CVSS, Linux)
- [CVE-2026-98743](https://cve.now/CVE-2026-98743.md): ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream\_config-\>type (no CVSS, Linux)
- [CVE-2026-98742](https://cve.now/CVE-2026-98742.md): ALSA: seq: Serialize compat port-info ioctls (no CVSS, Linux)
- [CVE-2026-98741](https://cve.now/CVE-2026-98741.md): ALSA: ua101: reject mismatched capture/playback packet sizes (no CVSS, Linux)
- [CVE-2026-98740](https://cve.now/CVE-2026-98740.md): EDAC/altera: Drop \_\_init from ECC setup paths for re-probe safety (no CVSS, Linux)
- [CVE-2026-98739](https://cve.now/CVE-2026-98739.md): Bluetooth: RFCOMM: Fix initial port reference race (no CVSS, Linux)
- [CVE-2026-98738](https://cve.now/CVE-2026-98738.md): Bluetooth: Serialize SMP remote OOB data access (no CVSS, Linux)
- [CVE-2026-98737](https://cve.now/CVE-2026-98737.md): Bluetooth: hci\_sync: Fix inquiry cache use-after-free (no CVSS, Linux)
- [CVE-2026-98736](https://cve.now/CVE-2026-98736.md): Bluetooth: hci\_conn: Lock parent access during enhanced SCO setup (no CVSS, Linux)
- [CVE-2026-98735](https://cve.now/CVE-2026-98735.md): Bluetooth: hci\_core: Serialize ACL scheduling with channel deletion (no CVSS, Linux)
- [CVE-2026-98734](https://cve.now/CVE-2026-98734.md): Bluetooth: hci\_core: Serialize SCO and ISO scheduling with teardown (no CVSS, Linux)
- [CVE-2026-98733](https://cve.now/CVE-2026-98733.md): Bluetooth: hci\_core: Serialize fragmented ISO packet queueing (no CVSS, Linux)
- [CVE-2026-98732](https://cve.now/CVE-2026-98732.md): Bluetooth: btintel: fix buffer over-read in btintel\_hw\_error() (no CVSS, Linux)
- [CVE-2026-98731](https://cve.now/CVE-2026-98731.md): Bluetooth: btintel\_pcie: fix plen overflow in btintel\_pcie\_recv\_frame() (no CVSS, Linux)
- [CVE-2026-98730](https://cve.now/CVE-2026-98730.md): Bluetooth: btintel\_pcie: reject oversized TX packets in send\_frame() (no CVSS, Linux)
- [CVE-2026-98729](https://cve.now/CVE-2026-98729.md): x86/mm: Don't apply va\_align to hugetlb mappings on AMD F15h (no CVSS, Linux)
- [CVE-2026-98728](https://cve.now/CVE-2026-98728.md): tpm: fix off-by-four bounds check in tpm2\_get\_random() (no CVSS, Linux)
- [CVE-2026-98727](https://cve.now/CVE-2026-98727.md): nvme-multipath: set BLK\_FEAT\_ZONED only after the zone info is known (no CVSS, Linux)
- [CVE-2026-98726](https://cve.now/CVE-2026-98726.md): nvme-multipath: fix underflow in ANA log bounds checks (no CVSS, Linux)
- [CVE-2026-98725](https://cve.now/CVE-2026-98725.md): nvmet-auth: fix out-of-bounds write in nvmet\_auth\_challenge() (no CVSS, Linux)
- [CVE-2026-98724](https://cve.now/CVE-2026-98724.md): nvmet: pci-epf: reject too-short SGL segments (no CVSS, Linux)
- [CVE-2026-98723](https://cve.now/CVE-2026-98723.md): nvmet: copy the hostid into the ctrl before creating PR pc\_refs (no CVSS, Linux)
- [CVE-2026-98722](https://cve.now/CVE-2026-98722.md): mtd: block2mtd: Fix divide error when erase\_size is zero (no CVSS, Linux)
- [CVE-2026-98721](https://cve.now/CVE-2026-98721.md): mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (no CVSS, Linux)
- [CVE-2026-98720](https://cve.now/CVE-2026-98720.md): KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified (no CVSS, Linux)
- [CVE-2026-98719](https://cve.now/CVE-2026-98719.md): KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it (no CVSS, Linux)
- [CVE-2026-98718](https://cve.now/CVE-2026-98718.md): KVM: SEV: Do cache maintenance on the source VM \*before\* clearing SEV state (no CVSS, Linux)
- [CVE-2026-98717](https://cve.now/CVE-2026-98717.md): KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (no CVSS, Linux)
- [CVE-2026-98716](https://cve.now/CVE-2026-98716.md): KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted (no CVSS, Linux)
- [CVE-2026-98715](https://cve.now/CVE-2026-98715.md): KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN (no CVSS, Linux)
- [CVE-2026-98714](https://cve.now/CVE-2026-98714.md): KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded (no CVSS, Linux)
- [CVE-2026-98713](https://cve.now/CVE-2026-98713.md): KVM: arm64: Apply the fine-grained UNDEFs without FEAT\_FGT (no CVSS, Linux)
- [CVE-2026-98712](https://cve.now/CVE-2026-98712.md): KVM: arm64: vgic: Take a refcount on IRQs referenced by last\_lr\_irq (no CVSS, Linux)
- [CVE-2026-98711](https://cve.now/CVE-2026-98711.md): wifi: cw1200: fix TX padding OOB read leaking heap data to device (no CVSS, Linux)
- [CVE-2026-98710](https://cve.now/CVE-2026-98710.md): wifi: iwlegacy: 3945: free EEPROM data on remove (no CVSS, Linux)
- [CVE-2026-98709](https://cve.now/CVE-2026-98709.md): wifi: mac80211: count only matching reservations in reserved switch (no CVSS, Linux)
- [CVE-2026-98708](https://cve.now/CVE-2026-98708.md): wifi: mac80211: keep paired old chanctx alive (no CVSS, Linux)
- [CVE-2026-98707](https://cve.now/CVE-2026-98707.md): wifi: mac80211: shut down RX BA session timer on teardown (no CVSS, Linux)
- [CVE-2026-98706](https://cve.now/CVE-2026-98706.md): wifi: mac80211: drain PS delivery work during station teardown (no CVSS, Linux)
- [CVE-2026-98705](https://cve.now/CVE-2026-98705.md): wifi: mac80211: account proxy paths against the mesh path limit (no CVSS, Linux)
- [CVE-2026-98704](https://cve.now/CVE-2026-98704.md): wifi: mac80211: keep fallback association elements alive (no CVSS, Linux)
- [CVE-2026-98703](https://cve.now/CVE-2026-98703.md): wifi: mac80211: minstrel\_ht: validate fixed rate index (no CVSS, Linux)
- [CVE-2026-98702](https://cve.now/CVE-2026-98702.md): wifi: mac80211: reject invalid 320 MHz CSA bandwidth (no CVSS, Linux)
- [CVE-2026-98701](https://cve.now/CVE-2026-98701.md): wifi: mac80211: release mesh path quota on failed additions (no CVSS, Linux)
- [CVE-2026-98700](https://cve.now/CVE-2026-98700.md): wifi: mac80211: set info-\>band for 802.3 encap offload frames (no CVSS, Linux)
- [CVE-2026-98699](https://cve.now/CVE-2026-98699.md): wifi: mac80211: fix mesh fast xmit path deletion UAF (no CVSS, Linux)
- [CVE-2026-98698](https://cve.now/CVE-2026-98698.md): wifi: mac80211: handle empty FILS association request payload (no CVSS, Linux)
- [CVE-2026-98697](https://cve.now/CVE-2026-98697.md): USB: serial: fix dynamic id driver deregistration race (no CVSS, Linux)
- [CVE-2026-98696](https://cve.now/CVE-2026-98696.md): USB: serial: fix driver deregistration order (no CVSS, Linux)
- [CVE-2026-98695](https://cve.now/CVE-2026-98695.md): USB: serial: fix ioctl hangup race (no CVSS, Linux)
- [CVE-2026-98694](https://cve.now/CVE-2026-98694.md): thunderbolt: Fix KASAN reported use-after-free when request is canceled (no CVSS, Linux)
- [CVE-2026-98693](https://cve.now/CVE-2026-98693.md): thunderbolt: Hold a router reference for each allocated HopID (no CVSS, Linux)
- [CVE-2026-98692](https://cve.now/CVE-2026-98692.md): thunderbolt: Make the DP tunnel activation callback mandatory (no CVSS, Linux)
- [CVE-2026-98691](https://cve.now/CVE-2026-98691.md): thunderbolt: Tear down inactive DP tunnels when the domain is stopped (no CVSS, Linux)
- [CVE-2026-98690](https://cve.now/CVE-2026-98690.md): thunderbolt: Fix domain reference leak when DPRX read is canceled (no CVSS, Linux)
- [CVE-2026-98689](https://cve.now/CVE-2026-98689.md): thunderbolt: Don't access a DP tunnel after its DPRX read was canceled (no CVSS, Linux)
- [CVE-2026-98688](https://cve.now/CVE-2026-98688.md): thunderbolt: Fix NULL dereference in tb\_remove\_work() (no CVSS, Linux)
- [CVE-2026-98687](https://cve.now/CVE-2026-98687.md): thunderbolt: Reject oversized XDomain properties responses (no CVSS, Linux)
- [CVE-2026-98686](https://cve.now/CVE-2026-98686.md): smb: client: discard post-EOF pagecache when extending a file via zero range (no CVSS, Linux)
- [CVE-2026-98685](https://cve.now/CVE-2026-98685.md): smb: client: discard post-EOF pagecache when extending a file via clone range (no CVSS, Linux)
- [CVE-2026-98684](https://cve.now/CVE-2026-98684.md): smb: client: flush and commit data before querying allocated ranges (no CVSS, Linux)
- [CVE-2026-98683](https://cve.now/CVE-2026-98683.md): smb: client: flush dirty data before zeroing a range (no CVSS, Linux)
- [CVE-2026-98682](https://cve.now/CVE-2026-98682.md): smb: client: drain and invalidate before server-side copy/clone (no CVSS, Linux)
- [CVE-2026-98681](https://cve.now/CVE-2026-98681.md): smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (no CVSS, Linux)
- [CVE-2026-98680](https://cve.now/CVE-2026-98680.md): iio: accel: kionix-kx022a: Prevent memory leak and fix state (no CVSS, Linux)
- [CVE-2026-98679](https://cve.now/CVE-2026-98679.md): iio: accel: kxcjk-1013: reject duplicate event disable (no CVSS, Linux)
- [CVE-2026-98678](https://cve.now/CVE-2026-98678.md): iio: adc: ad4030: fix invalid oversampling\_ratio validation (no CVSS, Linux)
- [CVE-2026-98677](https://cve.now/CVE-2026-98677.md): iio: adc: ad\_sigma\_delta: fix use-after-free on unbind (no CVSS, Linux)
- [CVE-2026-98676](https://cve.now/CVE-2026-98676.md): iio: adc: ade9000: fix NULL pointer dereference in clkout registration (no CVSS, Linux)
- [CVE-2026-98675](https://cve.now/CVE-2026-98675.md): iio: adc: ade9000: handle Phase C dip events in IRQ1 handler (no CVSS, Linux)
- [CVE-2026-98674](https://cve.now/CVE-2026-98674.md): iio: adc: adi-axi-adc: Initialize state mutex (no CVSS, Linux)
- [CVE-2026-98673](https://cve.now/CVE-2026-98673.md): iio: adc: pac1934: check ACPI label duplication (no CVSS, Linux)
- [CVE-2026-98672](https://cve.now/CVE-2026-98672.md): iio: adc: stm32-adc: fix possible division by zero in processed channel (no CVSS, Linux)
- [CVE-2026-98671](https://cve.now/CVE-2026-98671.md): iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (no CVSS, Linux)
- [CVE-2026-98670](https://cve.now/CVE-2026-98670.md): iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (no CVSS, Linux)
- [CVE-2026-98669](https://cve.now/CVE-2026-98669.md): iio: buffer: serialize buffer teardown with mode claims (no CVSS, Linux)
- [CVE-2026-98668](https://cve.now/CVE-2026-98668.md): iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. (no CVSS, Linux)
- [CVE-2026-98667](https://cve.now/CVE-2026-98667.md): iio: frequency: adf4377: Fully initialize clk\_init\_data and clk\_parent\_data (no CVSS, Linux)
- [CVE-2026-98666](https://cve.now/CVE-2026-98666.md): iio: gyro: adis16136: fix unprotected debugfs reads (no CVSS, Linux)
- [CVE-2026-98665](https://cve.now/CVE-2026-98665.md): iio: health: max30102: fix NULL dereference in interrupt handler (no CVSS, Linux)
- [CVE-2026-98664](https://cve.now/CVE-2026-98664.md): iio: imu: adis16400: fix unprotected debugfs reads (no CVSS, Linux)
- [CVE-2026-98663](https://cve.now/CVE-2026-98663.md): iio: imu: adis16480: fix unprotected debugfs reads (no CVSS, Linux)
- [CVE-2026-98662](https://cve.now/CVE-2026-98662.md): iio: light: gp2ap020a00f: drain irq\_work after free\_irq (no CVSS, Linux)
- [CVE-2026-98661](https://cve.now/CVE-2026-98661.md): iio: light: rohm-bu27034: Fix infinite delay on error (no CVSS, Linux)
- [CVE-2026-98660](https://cve.now/CVE-2026-98660.md): iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (no CVSS, Linux)
- [CVE-2026-98659](https://cve.now/CVE-2026-98659.md): iio: pressure: rohm-bm1390: Return error when read fails (no CVSS, Linux)
- [CVE-2026-98658](https://cve.now/CVE-2026-98658.md): iio: proximity: aw96103: validate firmware data length (no CVSS, Linux)
- [CVE-2026-98657](https://cve.now/CVE-2026-98657.md): iio: proximity: pulsedlight: fix iio\_device left registered on PM setup failure (no CVSS, Linux)
- [CVE-2026-98656](https://cve.now/CVE-2026-98656.md): iio: trigger: cancel reenable\_work before freeing trigger (no CVSS, Linux)
- [CVE-2026-98655](https://cve.now/CVE-2026-98655.md): perf: Require kernel access for text poke events (no CVSS, Linux)
- [CVE-2026-98653](https://cve.now/CVE-2026-98653.md): KVM: s390: Fix \_gaccess\_shadow\_fault() (no CVSS, Linux)
- [CVE-2026-98652](https://cve.now/CVE-2026-98652.md): KVM: s390: Add missing srcu in kvm\_s390\_set\_irq\_state() (no CVSS, Linux)
- [CVE-2026-98651](https://cve.now/CVE-2026-98651.md): KVM: s390: Properly handle NULL pointer in dat\_cond\_set\_storage\_key() (no CVSS, Linux)
- [CVE-2026-98650](https://cve.now/CVE-2026-98650.md): KVM: s390: Fix potential races in dat skey functions (no CVSS, Linux)
- [CVE-2026-98649](https://cve.now/CVE-2026-98649.md): KVM: s390: Fix race in \_destroy\_pages\_crste() (no CVSS, Linux)
- [CVE-2026-98648](https://cve.now/CVE-2026-98648.md): s390/uv: Prevent potential out-of-bounds read (no CVSS, Linux)
- [CVE-2026-98647](https://cve.now/CVE-2026-98647.md): bpf: Fix divide-by-zero in btf\_struct\_walk() (no CVSS, Linux)
- [CVE-2026-98646](https://cve.now/CVE-2026-98646.md): tcp: Skip cond\_resched() in inet\_csk\_listen\_stop() under BPF context (no CVSS, Linux)
- [CVE-2026-98645](https://cve.now/CVE-2026-98645.md): HID: winwing: fix use-after-free in force feedback teardown (no CVSS, Linux)
- [CVE-2026-98644](https://cve.now/CVE-2026-98644.md): bpf: Avoid soft lockup in \_\_htab\_map\_lookup\_and\_delete\_batch() (no CVSS, Linux)
- [CVE-2026-98643](https://cve.now/CVE-2026-98643.md): bpf: Fix out-of-bounds read of rtt\_min in sock\_ops (no CVSS, Linux)
- [CVE-2026-98642](https://cve.now/CVE-2026-98642.md): bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc\_bulk (no CVSS, Linux)
- [CVE-2026-98641](https://cve.now/CVE-2026-98641.md): bpf, arm64: set up the frame pointer for the exception callback (no CVSS, Linux)
- [CVE-2026-98640](https://cve.now/CVE-2026-98640.md): HID: amd\_sfh: Validate PCI BAR size before mapping (no CVSS, Linux)
- [CVE-2026-98639](https://cve.now/CVE-2026-98639.md): KVM: riscv: Fix NACL hfence entry update order (no CVSS, Linux)
- [CVE-2026-98638](https://cve.now/CVE-2026-98638.md): KVM: arm64: Validate the SVE vector length in pkvm\_vcpu\_init\_sve() (no CVSS, Linux)
- [CVE-2026-98637](https://cve.now/CVE-2026-98637.md): KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (no CVSS, Linux)
- [CVE-2026-98636](https://cve.now/CVE-2026-98636.md): squashfs: Add dictionary size range check to prevent shift-out-of-bounds (no CVSS, Linux)
- [CVE-2026-98635](https://cve.now/CVE-2026-98635.md): scsi: block: Fix zones\_cond out-of-bounds write on zone report (no CVSS, Linux)
- [CVE-2026-98634](https://cve.now/CVE-2026-98634.md): scsi: sd\_zbc: Reject disks with too many zones (no CVSS, Linux)
- [CVE-2026-98633](https://cve.now/CVE-2026-98633.md): Bluetooth: btnxpuart: Fix skb leak in nxp\_process\_fw\_dump() (no CVSS, Linux)
- [CVE-2026-98632](https://cve.now/CVE-2026-98632.md): Bluetooth: mgmt: Dequeue pending mesh\_send\_sync entries on cancel (no CVSS, Linux)
- [CVE-2026-98631](https://cve.now/CVE-2026-98631.md): xsk: Use a 32-bit compare in xsk\_map\_gen\_lookup (no CVSS, Linux)
- [CVE-2026-98630](https://cve.now/CVE-2026-98630.md): eth: fbnic: Fix payload page pool error cleanup (no CVSS, Linux)
- [CVE-2026-98629](https://cve.now/CVE-2026-98629.md): net/sched: cls\_u32: fix manual hash table handle IDR aliasing (no CVSS, Linux)
- [CVE-2026-98628](https://cve.now/CVE-2026-98628.md): bpf: Make post-verification instruction rewrites killable (no CVSS, Linux)
- [CVE-2026-98627](https://cve.now/CVE-2026-98627.md): bpf: Preserve packet pointer class displacement in regsafe() (no CVSS, Linux)
- [CVE-2026-98626](https://cve.now/CVE-2026-98626.md): bpf: Restrict CO-RE poisoning to relocatable instructions (no CVSS, Linux)
- [CVE-2026-98625](https://cve.now/CVE-2026-98625.md): netfilter: flowtable: publish HW\_DEAD after worker is done (no CVSS, Linux)
- [CVE-2026-98624](https://cve.now/CVE-2026-98624.md): netfilter: nfnetlink\_queue: hold nfnl mutex in event notifier (no CVSS, Linux)
- [CVE-2026-98623](https://cve.now/CVE-2026-98623.md): drm/nouveau/clk: fix list cursor use after loop in nvkm\_clk\_ustate\_update (no CVSS, Linux)
- [CVE-2026-98622](https://cve.now/CVE-2026-98622.md): net/sched: act\_ct: don't WARN on benign flow\_offload\_alloc() failure (no CVSS, Linux)
- [CVE-2026-98621](https://cve.now/CVE-2026-98621.md): net: gue: reject invalid REMCSUM offsets (no CVSS, Linux)
- [CVE-2026-98620](https://cve.now/CVE-2026-98620.md): net: ethernet: mtk\_eth\_soc: unregister net\_devices in case of probe failure (no CVSS, Linux)
- [CVE-2026-98619](https://cve.now/CVE-2026-98619.md): net: ethtool: keep rtnl\_lock for the ioctl self test (no CVSS, Linux)
- [CVE-2026-98618](https://cve.now/CVE-2026-98618.md): eth: fbnic: Handle maximum standalone channels (no CVSS, Linux)
- [CVE-2026-98617](https://cve.now/CVE-2026-98617.md): eth: fbnic: use the Rx queue napi pointer to find the napi vector (no CVSS, Linux)
- [CVE-2026-98616](https://cve.now/CVE-2026-98616.md): eth: fbnic: reset num\_napi when the napi vectors are freed (no CVSS, Linux)
- [CVE-2026-98615](https://cve.now/CVE-2026-98615.md): eth: fbnic: Set AW\_FLUSH\_MODE alongside AW\_FLUSH when flushing the mailbox (no CVSS, Linux)
- [CVE-2026-98614](https://cve.now/CVE-2026-98614.md): sctp: avoid livelock while updating retransmit path (no CVSS, Linux)
- [CVE-2026-98613](https://cve.now/CVE-2026-98613.md): bpf: Bound ownership depth through local kptrs and graph roots (no CVSS, Linux)
- [CVE-2026-98612](https://cve.now/CVE-2026-98612.md): net: usb: catc: bound the RX packet length in catc\_rx\_done() (no CVSS, Linux)
- [CVE-2026-98611](https://cve.now/CVE-2026-98611.md): bpf: Check params size before reading reserved fields (no CVSS, Linux)
- [CVE-2026-98610](https://cve.now/CVE-2026-98610.md): net/sched: sch\_hfsc: bound the classify inner-filter walk with a drift budget (no CVSS, Linux)
- [CVE-2026-98609](https://cve.now/CVE-2026-98609.md): drm/virtio: fix object leak when drm\_gem\_handle\_create() fails (no CVSS, Linux)
- [CVE-2026-98608](https://cve.now/CVE-2026-98608.md): drm/virtio: fix object leak in virtio\_gpu\_resource\_create\_ioctl() (no CVSS, Linux)
- [CVE-2026-98607](https://cve.now/CVE-2026-98607.md): drm/virtio: fix object leaks in virtio\_gpu\_resource\_create\_blob\_ioctl() (no CVSS, Linux)
- [CVE-2026-98606](https://cve.now/CVE-2026-98606.md): drm/virtio: release the GEM object on virtio\_gpu\_vram\_create() errors (no CVSS, Linux)
- [CVE-2026-98605](https://cve.now/CVE-2026-98605.md): drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (no CVSS, Linux)
- [CVE-2026-98604](https://cve.now/CVE-2026-98604.md): ovpn: replace bind when learning local endpoint (no CVSS, Linux)
- [CVE-2026-98603](https://cve.now/CVE-2026-98603.md): ovpn: replace bind when clearing stale local source (no CVSS, Linux)
- [CVE-2026-98602](https://cve.now/CVE-2026-98602.md): Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (no CVSS, Linux)
- [CVE-2026-98601](https://cve.now/CVE-2026-98601.md): Bluetooth: btintel\_pcie: validate device-supplied DMA indices (no CVSS, Linux)
- [CVE-2026-98600](https://cve.now/CVE-2026-98600.md): Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm\_recv\_frame() (no CVSS, Linux)
- [CVE-2026-98599](https://cve.now/CVE-2026-98599.md): bpf: Reject non-negative offsets in stack\_slot\_obj\_get\_spi() (no CVSS, Linux)
- [CVE-2026-98598](https://cve.now/CVE-2026-98598.md): ipv6: Prevent rt6\_insert\_exception() for dying fib6\_info. (no CVSS, Linux)
- [CVE-2026-98597](https://cve.now/CVE-2026-98597.md): net: usb: sr9700: include receive overhead in the length check (no CVSS, Linux)
- [CVE-2026-98596](https://cve.now/CVE-2026-98596.md): ipv6: Fix dst leak for uncached routes. (no CVSS, Linux)
- [CVE-2026-98595](https://cve.now/CVE-2026-98595.md): udp: remove a disconnected socket from the 4-tuple hash table (no CVSS, Linux)
- [CVE-2026-98594](https://cve.now/CVE-2026-98594.md): tg3: clean up PHYLIB resources on probe failure (no CVSS, Linux)
- [CVE-2026-98593](https://cve.now/CVE-2026-98593.md): s390/debug: Fix NULL pointer dereference in debug\_info\_copy() (no CVSS, Linux)
- [CVE-2026-98592](https://cve.now/CVE-2026-98592.md): net: spacemit: clear TX descriptor on fragment mapping failure (no CVSS, Linux)
- [CVE-2026-98591](https://cve.now/CVE-2026-98591.md): bpf: Fix bounds check for skb-backed dynptrs (no CVSS, Linux)
- [CVE-2026-98590](https://cve.now/CVE-2026-98590.md): bpf: Fix bpf\_sock context code generation (no CVSS, Linux)
- [CVE-2026-98589](https://cve.now/CVE-2026-98589.md): bpf: Reject pkt arguments in mutating subprogs (no CVSS, Linux)
- [CVE-2026-98588](https://cve.now/CVE-2026-98588.md): bpf, sockmap: Reject max\_entries \> INT\_MAX in sock\_map\_alloc (no CVSS, Linux)
- [CVE-2026-98587](https://cve.now/CVE-2026-98587.md): firewire: cdev: fix back-transition for iso\_resource\_auto client resource (no CVSS, Linux)
- [CVE-2026-98586](https://cve.now/CVE-2026-98586.md): sctp: hold asoc or transport before mod\_timer() in timer handlers (no CVSS, Linux)
- [CVE-2026-98585](https://cve.now/CVE-2026-98585.md): eth: fbnic: Avoid rounding zero ring sizes (no CVSS, Linux)
- [CVE-2026-98584](https://cve.now/CVE-2026-98584.md): net/sched: fix potential stack infoleak in em\_text\_dump() (no CVSS, Linux)
- [CVE-2026-98583](https://cve.now/CVE-2026-98583.md): nfc: nfcmrvl: validate helper command length before pull (no CVSS, Linux)
- [CVE-2026-98582](https://cve.now/CVE-2026-98582.md): nfc: st21nfca: validate received frame size (no CVSS, Linux)
- [CVE-2026-98581](https://cve.now/CVE-2026-98581.md): nfc: llcp: Fix list corruption / refcount desync in nfc\_llcp\_recv\_dm() (no CVSS, Linux)
- [CVE-2026-98580](https://cve.now/CVE-2026-98580.md): nfc: llcp: Fix race condition in accept\_queue lifecycle (no CVSS, Linux)
- [CVE-2026-98579](https://cve.now/CVE-2026-98579.md): nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (no CVSS, Linux)
- [CVE-2026-98578](https://cve.now/CVE-2026-98578.md): nfc: st21nfca: validate ISO15693 inventory length (no CVSS, Linux)
- [CVE-2026-98577](https://cve.now/CVE-2026-98577.md): nfc: llcp: fix WKS SAP hijacking via prefix match in nfc\_llcp\_wks\_sap() (no CVSS, Linux)
- [CVE-2026-98576](https://cve.now/CVE-2026-98576.md): nfc: llcp: fix slab-out-of-bounds reads when logging service names (no CVSS, Linux)
- [CVE-2026-98575](https://cve.now/CVE-2026-98575.md): nfc: pn533: fix OOB read in pn533\_acr122\_is\_rx\_frame\_valid() (no CVSS, Linux)
- [CVE-2026-98574](https://cve.now/CVE-2026-98574.md): net: bcmgenet: stop Tx NAPI before disabling the queues (no CVSS, Linux)
- [CVE-2026-98573](https://cve.now/CVE-2026-98573.md): net: skbuff: fix pull-bound underflow in skb\_checksum\_setup\_ipv6() (no CVSS, Linux)
- [CVE-2026-98572](https://cve.now/CVE-2026-98572.md): bpf: Fix immediate JMP JEQ/JNE on MIPS32 (no CVSS, Linux)
- [CVE-2026-98571](https://cve.now/CVE-2026-98571.md): net: stmmac: clear stale buf-\>page after recycling on skb build failure (no CVSS, Linux)
- [CVE-2026-98570](https://cve.now/CVE-2026-98570.md): net: ipv6: keep room for the mac header in dst\_dev\_overhead() (no CVSS, Linux)
- [CVE-2026-98569](https://cve.now/CVE-2026-98569.md): ip\_gre: Reject enabling collect metadata through changelink (no CVSS, Linux)
- [CVE-2026-98568](https://cve.now/CVE-2026-98568.md): vxlan: use one headroom snapshot for neighbour replies (no CVSS, Linux)
- [CVE-2026-98567](https://cve.now/CVE-2026-98567.md): net: xps: reject an out of range traffic class (no CVSS, Linux)
- [CVE-2026-98566](https://cve.now/CVE-2026-98566.md): drm/imagination: clamp freelist reconstruction requests (no CVSS, Linux)
- [CVE-2026-98565](https://cve.now/CVE-2026-98565.md): net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 (no CVSS, Linux)
- [CVE-2026-98564](https://cve.now/CVE-2026-98564.md): net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq (no CVSS, Linux)
- [CVE-2026-98563](https://cve.now/CVE-2026-98563.md): net: phylink: record the PHY only once bringup cannot fail (no CVSS, Linux)
- [CVE-2026-98562](https://cve.now/CVE-2026-98562.md): net: libwx: fix races in Tx timestamp handling (no CVSS, Linux)
- [CVE-2026-98561](https://cve.now/CVE-2026-98561.md): nfp: hold IPsec RX state under the XArray lock (no CVSS, Linux)
- [CVE-2026-98560](https://cve.now/CVE-2026-98560.md): net/rds: size a connection's path set by the transport it ends up with (no CVSS, Linux)
- [CVE-2026-98559](https://cve.now/CVE-2026-98559.md): net/smc: fix UAF on lgr list traversal in smcr\_port\_err() (no CVSS, Linux)
- [CVE-2026-98558](https://cve.now/CVE-2026-98558.md): net: flush skb\_defer\_nodes in dev\_cpu\_dead() (no CVSS, Linux)
- [CVE-2026-98557](https://cve.now/CVE-2026-98557.md): gve: DQO: fix header length used by gve\_can\_send\_tso() for UDP GSO (no CVSS, Linux)
- [CVE-2026-98556](https://cve.now/CVE-2026-98556.md): gve: DQO: reject TSO packets with an out of range MSS (no CVSS, Linux)
- [CVE-2026-98555](https://cve.now/CVE-2026-98555.md): llc: fix skb UAF and leaks on llc\_mac\_hdr\_init() failure (CVSS 7.5, Linux)
- [CVE-2026-98554](https://cve.now/CVE-2026-98554.md): vlan: ensure sufficient headroom in vlan\_dev\_hard\_header() (no CVSS, Linux)
- [CVE-2026-98553](https://cve.now/CVE-2026-98553.md): autofs: fix sbi-\>pipe file reference leak in autofs\_kill\_sb() (no CVSS, Linux)
- [CVE-2026-98552](https://cve.now/CVE-2026-98552.md): perf/core: Fix a refcount leak in attach\_perf\_ctx\_data() (no CVSS, Linux)
- [CVE-2026-98551](https://cve.now/CVE-2026-98551.md): perf/core: Fill branch entries with a single assignment (no CVSS, Linux)
- [CVE-2026-98550](https://cve.now/CVE-2026-98550.md): tipc: reject invalid and unexpected GRP\_ACK\_MSG to prevent bc\_ackers underflow (CVSS 7.5, Linux)
- [CVE-2026-98549](https://cve.now/CVE-2026-98549.md): tcp: prevent collapsing skbs across boundary in rtx queue (CVSS 9.1, Linux)
- [CVE-2026-98548](https://cve.now/CVE-2026-98548.md): sctp: discard the rest of the packet on a stale-cookie error (CVSS 9.8, Linux)
- [CVE-2026-98547](https://cve.now/CVE-2026-98547.md): af\_packet: fix integer overflow in prb\_calc\_retire\_blk\_tmo() (no CVSS, Linux)
- [CVE-2026-98546](https://cve.now/CVE-2026-98546.md): arm64/boot: Disable trapping of PMZR\_EL0 writes to EL2 (no CVSS, Linux)
- [CVE-2026-98545](https://cve.now/CVE-2026-98545.md): ata: libata-scsi: bound the ATA passthru sense descriptor writes (no CVSS, Linux)
- [CVE-2026-98544](https://cve.now/CVE-2026-98544.md): bna: prevent IOC timer rearm during teardown (no CVSS, Linux)
- [CVE-2026-98543](https://cve.now/CVE-2026-98543.md): bpf: fs/xattr: don't assume the inode is locked in path\_unlink/path\_rmdir (CVSS 7.3, Linux)
- [CVE-2026-98542](https://cve.now/CVE-2026-98542.md): cgroup/cpuset: Return PERR\_NOCPUS in remote\_partition\_enable() on subpartitions\_cpus conflict (no CVSS, Linux)
- [CVE-2026-98541](https://cve.now/CVE-2026-98541.md): fou: reject omitted FOU\_ATTR\_IPPROTO on FOU\_ENCAP\_DIRECT (no CVSS, Linux)
- [CVE-2026-98540](https://cve.now/CVE-2026-98540.md): fprobe: Terminate the fgraph\_data list when the reservation is not filled (no CVSS, Linux)
- [CVE-2026-98539](https://cve.now/CVE-2026-98539.md): fs/ntfs3: use d\_instantiate\_new() in ntfs\_create\_inode() and murder syzbot's "WARNING in do\_new\_mount" saga (no CVSS, Linux)
- [CVE-2026-98538](https://cve.now/CVE-2026-98538.md): writeback: bound cleanup\_offline\_cgwb() rescans by rotating scanned inodes (no CVSS, Linux)
- [CVE-2026-98537](https://cve.now/CVE-2026-98537.md): workqueue: Fix NULL current\_pwq deref in flush dependency check (no CVSS, Linux)
- [CVE-2026-98536](https://cve.now/CVE-2026-98536.md): writeback: report a Tasks-RCU quiescent state per cgwb drain pass (no CVSS, Linux)
- [CVE-2026-98535](https://cve.now/CVE-2026-98535.md): fsl/fman: Fix clk reference leak in read\_dts\_node() (no CVSS, Linux)
- [CVE-2026-98534](https://cve.now/CVE-2026-98534.md): ipe: fix use-after-free when auditing a newly loaded policy (no CVSS, Linux)
- [CVE-2026-98533](https://cve.now/CVE-2026-98533.md): ipe: protect the dm-verity root hash with RCU (no CVSS, Linux)
- [CVE-2026-98532](https://cve.now/CVE-2026-98532.md): ipv6: do not let ipv6\_find\_hdr() return an offset past the packet end (CVSS 8.1, Linux)
- [CVE-2026-98531](https://cve.now/CVE-2026-98531.md): ipv6: sr: enforce exact attribute length for SEG6\_ATTR\_DST (no CVSS, Linux)
- [CVE-2026-98530](https://cve.now/CVE-2026-98530.md): kprobes: Fix permanent hang when flushing the kprobe optimizer (no CVSS, Linux)
- [CVE-2026-98529](https://cve.now/CVE-2026-98529.md): gpio: arizona: Fix runtime PM leak in arizona\_gpio\_direction\_out() (no CVSS, Linux)
- [CVE-2026-98528](https://cve.now/CVE-2026-98528.md): gpio: cdev: fix kernel stack leak to user-space in error path (no CVSS, Linux)
- [CVE-2026-98527](https://cve.now/CVE-2026-98527.md): gpio: zynq: fix runtime PM leak on request error path (no CVSS, Linux)
- [CVE-2026-98526](https://cve.now/CVE-2026-98526.md): llc: reserve device headroom for allocated frames (no CVSS, Linux)
- [CVE-2026-98525](https://cve.now/CVE-2026-98525.md): mctp: route: iterate socket tag list in mctp\_lookup\_prealloc\_tag() (no CVSS, Linux)
- [CVE-2026-98524](https://cve.now/CVE-2026-98524.md): rds: ib: Clear the sg list when mapping an MR fails (CVSS 7.8, Linux)
- [CVE-2026-98523](https://cve.now/CVE-2026-98523.md): drm/client: fix restore of partially initialized client (no CVSS, Linux)
- [CVE-2026-98522](https://cve.now/CVE-2026-98522.md): drm/imagination: Propagate map failures correctly from pvr\_mmu\_map\_sgl() (no CVSS, Linux)
- [CVE-2026-98521](https://cve.now/CVE-2026-98521.md): drm/i915: fix incorrect RCU teardown order (no CVSS, Linux)
- [CVE-2026-98520](https://cve.now/CVE-2026-98520.md): drm/amdkfd: fix use-after-free and multi-container gap in kfd\_dev\_mapping (CVSS 7.8, Linux)
- [CVE-2026-98519](https://cve.now/CVE-2026-98519.md): drm/amdgpu: Fix runtime PM leak in amdgpu\_debugfs\_test\_ib\_show() (no CVSS, Linux)
- [CVE-2026-98518](https://cve.now/CVE-2026-98518.md): drm/nouveau/dmem: pin VRAM for the whole registered range (CVSS 7.0, Linux)
- [CVE-2026-98517](https://cve.now/CVE-2026-98517.md): drm/nouveau/uvmm: fix UAF in nouveau\_uvmm\_sm when BO is in TTM\_PL\_SYSTEM (CVSS 7.8, Linux)
- [CVE-2026-98516](https://cve.now/CVE-2026-98516.md): drm/nouveau: Fix bridge reference leak in nv1a\_ram\_new() (no CVSS, Linux)
- [CVE-2026-98515](https://cve.now/CVE-2026-98515.md): drm/nouveau: fix double-free in nvif\_vmm\_dtor (CVSS 7.8, Linux)
- [CVE-2026-98514](https://cve.now/CVE-2026-98514.md): drm/nouveau: Fix gem reference leak in validate\_init() (no CVSS, Linux)
- [CVE-2026-98513](https://cve.now/CVE-2026-98513.md): drm/nouveau: Fix runtime PM leak in nouveau\_connector\_detect() (no CVSS, Linux)
- [CVE-2026-98512](https://cve.now/CVE-2026-98512.md): drm/nouveau: RCU-free the scheduler-containing nouveau\_sched (CVSS 7.1, Linux)
- [CVE-2026-98511](https://cve.now/CVE-2026-98511.md): drm/nouveau: don't bump pin count on failed re-pin in nouveau\_bo\_pin\_locked() (no CVSS, Linux)
- [CVE-2026-98510](https://cve.now/CVE-2026-98510.md): drm/xe/vm: nuke PTs only after unlinking contested VMAs (CVSS 7.8, Linux)
- [CVE-2026-98509](https://cve.now/CVE-2026-98509.md): drm/virtio: fix memory leak of fence event on execbuffer failure (no CVSS, Linux)
- [CVE-2026-98508](https://cve.now/CVE-2026-98508.md): drm/virtio: fix NULL pointer dereference on fence allocation failure (no CVSS, Linux)
- [CVE-2026-98507](https://cve.now/CVE-2026-98507.md): mm/rmap: fix missing barrier between anon\_vma init and vma-\>anon\_vma publish (CVSS 7.8, Linux)
- [CVE-2026-98506](https://cve.now/CVE-2026-98506.md): mm/hugetlb: do not dissolve gigantic pages without runtime support (no CVSS, Linux)
- [CVE-2026-98505](https://cve.now/CVE-2026-98505.md): mm/damon/vaddr: avoid hw-driven pte updates during damon\_hugetlb\_mkold() (no CVSS, Linux)
- [CVE-2026-98504](https://cve.now/CVE-2026-98504.md): PCI: of\_property: Omit bus properties without a subordinate bus (no CVSS, Linux)
- [CVE-2026-98503](https://cve.now/CVE-2026-98503.md): packet: use ubuf\_info completion for TX\_RING packets (no CVSS, Linux)
- [CVE-2026-98502](https://cve.now/CVE-2026-98502.md): HID: alps: unregister DualPoint Stick input device on remove (no CVSS, Linux)
- [CVE-2026-98501](https://cve.now/CVE-2026-98501.md): HID: alps: fix use-after-free on input2 registration failure (CVSS 7.1, Linux)
- [CVE-2026-98500](https://cve.now/CVE-2026-98500.md): HID: hid-oxp: use cancel\_delayed\_work\_sync() in remove (no CVSS, Linux)
- [CVE-2026-98499](https://cve.now/CVE-2026-98499.md): HID: wacom: fix OOB read in wacom\_wac\_pen\_serial\_enforce() (CVSS 8.1, Linux)
- [CVE-2026-98498](https://cve.now/CVE-2026-98498.md): net/mlx5: Fix rev\_entry reference leak in mlx5\_tc\_ct\_shared\_counter\_get() (no CVSS, Linux)
- [CVE-2026-98497](https://cve.now/CVE-2026-98497.md): net/mlx5e: fix swapped IPv6 IPsec policy masks (CVSS 7.5, Linux)
- [CVE-2026-98496](https://cve.now/CVE-2026-98496.md): net: airoha: npu: cancel wdt\_work after releasing the WDT IRQ (no CVSS, Linux)
- [CVE-2026-98495](https://cve.now/CVE-2026-98495.md): net: arp: terminate device name before lookup (no CVSS, Linux)
- [CVE-2026-98494](https://cve.now/CVE-2026-98494.md): net: atl1: fix soft lockup on out-of-range cmb\_tpd\_next\_to\_clean read (no CVSS, Linux)
- [CVE-2026-98493](https://cve.now/CVE-2026-98493.md): net: ipconfig: bound DHCP option construction (no CVSS, Linux)
- [CVE-2026-98492](https://cve.now/CVE-2026-98492.md): net: macb: fix dma\_alloc\_coherent() leak on macb\_alloc() error paths (no CVSS, Linux)
- [CVE-2026-98491](https://cve.now/CVE-2026-98491.md): net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (CVSS 7.8, Linux)
- [CVE-2026-98490](https://cve.now/CVE-2026-98490.md): net: openvswitch: conntrack: fix helper UAF due to extensions realloc (CVSS 9.8, Linux)
- [CVE-2026-98489](https://cve.now/CVE-2026-98489.md): net: atl1c: fix soft lockup on out-of-range tpd\_cons read (no CVSS, Linux)
- [CVE-2026-98488](https://cve.now/CVE-2026-98488.md): net: atl1e: fix soft lockup on out-of-range hw\_next\_to\_clean read (no CVSS, Linux)
- [CVE-2026-98487](https://cve.now/CVE-2026-98487.md): net: bridge: mdb: restart port group walk after deletion (CVSS 7.8, Linux)
- [CVE-2026-98486](https://cve.now/CVE-2026-98486.md): net: ena: fix MMIO read buffer leak on probe failure (no CVSS, Linux)
- [CVE-2026-98485](https://cve.now/CVE-2026-98485.md): netfilter: ip6t\_rt: fix zero-address non-strict match out-of-bounds read (CVSS 7.1, Linux)
- [CVE-2026-98484](https://cve.now/CVE-2026-98484.md): netfilter: nf\_tables: skip expired catchall elements on insert and delete (no CVSS, Linux)
- [CVE-2026-98483](https://cve.now/CVE-2026-98483.md): nfc: fix use-after-free in nfc\_get\_local\_general\_bytes (no CVSS, Linux)
- [CVE-2026-98482](https://cve.now/CVE-2026-98482.md): nfc: llcp: drop truncated I/RR/RNR PDUs in nfc\_llcp\_recv\_hdlc() (no CVSS, Linux)
- [CVE-2026-98481](https://cve.now/CVE-2026-98481.md): nfc: port100: reject frames whose declared length exceeds the received data (no CVSS, Linux)
- [CVE-2026-98480](https://cve.now/CVE-2026-98480.md): nfc: trf7970a: power down on startup RX gain failure (no CVSS, Linux)
- [CVE-2026-98479](https://cve.now/CVE-2026-98479.md): scsi: libiscsi\_tcp: Check the data direction of a Data-In PDU (CVSS 7.5, Linux)
- [CVE-2026-98478](https://cve.now/CVE-2026-98478.md): scsi: ufs: core: Keep internal commands dispatchable during error handling (no CVSS, Linux)
- [CVE-2026-98477](https://cve.now/CVE-2026-98477.md): perf/core: Fix NULL pmu\_ctx passed to pmu-\>sched\_task() (no CVSS, Linux)
- [CVE-2026-98476](https://cve.now/CVE-2026-98476.md): s390/cio: Fix NULL pointer dereference in ccw\_device\_get\_util\_str() (no CVSS, Linux)
- [CVE-2026-98475](https://cve.now/CVE-2026-98475.md): s390/cmf: Fix virtual vs physical address confusion (no CVSS, Linux)
- [CVE-2026-98474](https://cve.now/CVE-2026-98474.md): s390/pci: Fix missing device lock in zpci\_report\_status() (no CVSS, Linux)
- [CVE-2026-98473](https://cve.now/CVE-2026-98473.md): s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config (no CVSS, Linux)
- [CVE-2026-98472](https://cve.now/CVE-2026-98472.md): KVM: SEV: Free have\_run\_cpus during VM destruction even if VM is no longer SEV (no CVSS, Linux)
- [CVE-2026-98471](https://cve.now/CVE-2026-98471.md): KVM: SEV: Do cache maintenance on the source VM during intra-host migration (CVSS 7.1, Linux)
- [CVE-2026-98470](https://cve.now/CVE-2026-98470.md): KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode (no CVSS, Linux)
- [CVE-2026-98469](https://cve.now/CVE-2026-98469.md): KVM: arm64: Fix AArch32 DBGBXVR\<n\> handling (CVSS 7.1, Linux)
- [CVE-2026-98468](https://cve.now/CVE-2026-98468.md): KVM: arm64: Fix spurious warning for benign stage 2 teardown race (no CVSS, Linux)
- [CVE-2026-98467](https://cve.now/CVE-2026-98467.md): KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race (no CVSS, Linux)
- [CVE-2026-98466](https://cve.now/CVE-2026-98466.md): KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVSS 8.2, Linux)
- [CVE-2026-98465](https://cve.now/CVE-2026-98465.md): RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (CVSS 7.0, Linux)
- [CVE-2026-98464](https://cve.now/CVE-2026-98464.md): RISC-V: KVM: Synchronize hrtimer callback during teardown (CVSS 9.3, Linux)
- [CVE-2026-98463](https://cve.now/CVE-2026-98463.md): sched\_ext: Derive SCX\_RQ\_IN\_WAKEUP from the core enqueue flags (no CVSS, Linux)
- [CVE-2026-98462](https://cve.now/CVE-2026-98462.md): Bluetooth: hci\_conn: fix CIS hold ownership on reuse (no CVSS, Linux)
- [CVE-2026-98461](https://cve.now/CVE-2026-98461.md): Bluetooth: hci\_sock: validate event length before filtering (no CVSS, Linux)
- [CVE-2026-98460](https://cve.now/CVE-2026-98460.md): Bluetooth: hci\_sock: reject out-of-range OCF values (no CVSS, Linux)
- [CVE-2026-98459](https://cve.now/CVE-2026-98459.md): Bluetooth: ISO: balance the parent hold in hci\_bind\_bis() (no CVSS, Linux)
- [CVE-2026-98458](https://cve.now/CVE-2026-98458.md): Bluetooth: ISO: release unused CIS holds after channel attach (no CVSS, Linux)
- [CVE-2026-98457](https://cve.now/CVE-2026-98457.md): Bluetooth: L2CAP: validate frame length before control and FCS access (no CVSS, Linux)
- [CVE-2026-98456](https://cve.now/CVE-2026-98456.md): Bluetooth: mgmt: fix race in read\_unconf\_index\_list() (CVSS 7.0, Linux)
- [CVE-2026-98455](https://cve.now/CVE-2026-98455.md): Bluetooth: RFCOMM: fix NULL dereference of dlc-\>session in RFCOMM\_CONNINFO (no CVSS, Linux)
- [CVE-2026-98454](https://cve.now/CVE-2026-98454.md): smb: client: fix create context out-of-bounds reads (CVSS 8.1, Linux)
- [CVE-2026-98453](https://cve.now/CVE-2026-98453.md): smb: client: close handle after create-context parsing failure (no CVSS, Linux)
- [CVE-2026-98452](https://cve.now/CVE-2026-98452.md): smb: client: clean up failed cached directory opens (no CVSS, Linux)
- [CVE-2026-98451](https://cve.now/CVE-2026-98451.md): smb: client: use finish\_no\_open() for non-regular inodes (CVSS 8.8, Linux)
- [CVE-2026-98450](https://cve.now/CVE-2026-98450.md): smb: client: close completed creates on compound wait errors (no CVSS, Linux)
- [CVE-2026-98449](https://cve.now/CVE-2026-98449.md): smb: client: delete compound mids on send failure before unlock (no CVSS, Linux)
- [CVE-2026-98448](https://cve.now/CVE-2026-98448.md): xfs: release orphanage dir inode if chown fails (no CVSS, Linux)
- [CVE-2026-98447](https://cve.now/CVE-2026-98447.md): xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots (no CVSS, Linux)
- [CVE-2026-98446](https://cve.now/CVE-2026-98446.md): xfs: don't let hidden\_space go negative in xfs\_metafile\_resv\_init (no CVSS, Linux)
- [CVE-2026-98445](https://cve.now/CVE-2026-98445.md): xfs: don't let memory failures leak blocks and kill repairs (no CVSS, Linux)
- [CVE-2026-98444](https://cve.now/CVE-2026-98444.md): xfs: drop dquot flush lock when we can't find a buffer to flush (no CVSS, Linux)
- [CVE-2026-98443](https://cve.now/CVE-2026-98443.md): xfs: fix cursor and pointer handling when recovering iunlink buckets (CVSS 7.8, Linux)
- [CVE-2026-98442](https://cve.now/CVE-2026-98442.md): net/sched: act\_ct: fix helper UAF due to extensions realloc (CVSS 7.8, Linux)
- [CVE-2026-98441](https://cve.now/CVE-2026-98441.md): net/sched: act\_ct: avoid modifying shared unconfirmed ct entry (CVSS 7.8, Linux)
- [CVE-2026-98440](https://cve.now/CVE-2026-98440.md): KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction (CVSS 7.0, Linux)
- [CVE-2026-111991](https://cve.now/CVE-2026-111991.md): WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.\_\_init\_\_ code injection (CVSS 5.3, WongKinYiu yolov9)
- [CVE-2026-98439](https://cve.now/CVE-2026-98439.md): smb/server: cancel async requests when closing connection (no CVSS, Linux)
- [CVE-2026-98438](https://cve.now/CVE-2026-98438.md): mptcp: options: fix uninit-value in mptcp\_write\_data\_fin (no CVSS, Linux)
- [CVE-2026-98437](https://cve.now/CVE-2026-98437.md): media: qcom: iris: fix runtime PM reference leaks (no CVSS, Linux)
- [CVE-2026-98436](https://cve.now/CVE-2026-98436.md): accel/amdxdna: Disable device buffer exporting (CVSS 7.8, Linux)
- [CVE-2026-98435](https://cve.now/CVE-2026-98435.md): EDAC/altera: Use parent device for devres in altr\_portb\_setup() (no CVSS, Linux)
- [CVE-2026-111990](https://cve.now/CVE-2026-111990.md): kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli\_query sql injection (CVSS 6.9, kishan0725 Hospital Management System)
- [CVE-2026-98434](https://cve.now/CVE-2026-98434.md): sysctl: Check range in proc\_dointvec\_ms\_jiffies\_minmax (no CVSS, Linux)
- [CVE-2026-98433](https://cve.now/CVE-2026-98433.md): KVM: PPC: Book3S HV: fix secure device page leak on uv\_page\_in() failure (no CVSS, Linux)
- [CVE-2026-110024](https://cve.now/CVE-2026-110024.md): @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults (CVSS 6.8, @fastify/jwt)
- [CVE-2026-111988](https://cve.now/CVE-2026-111988.md): dyad-sh dyad OAuth Callback cross-site request forgery (CVSS 5.3, dyad-sh dyad)
- [CVE-2026-111987](https://cve.now/CVE-2026-111987.md): AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd\_models.py read\_metadata\_from\_safetensors cross site scripting (CVSS 5.3, AUTOMATIC1111 stable-diffusion-webui)
- [CVE-2026-111986](https://cve.now/CVE-2026-111986.md): AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd\_models.py get\_obj\_from\_str code injection (CVSS 5.3, AUTOMATIC1111 stable-diffusion-webui)
- [CVE-2026-112063](https://cve.now/CVE-2026-112063.md): libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM\_Hi (CVSS 6.0, libstrophe)
- [CVE-2026-112062](https://cve.now/CVE-2026-112062.md): lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler (CVSS 6.0, lwIP)
- [CVE-2026-112061](https://cve.now/CVE-2026-112061.md): librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp\_Decode (CVSS 5.3, RTMPDump librtmp)
- [CVE-2026-112060](https://cve.now/CVE-2026-112060.md): librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3\_Decode (CVSS 6.1, RTMPDump librtmp)
- [CVE-2026-112059](https://cve.now/CVE-2026-112059.md): libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR (CVSS 6.9, libLAS)
- [CVE-2026-112058](https://cve.now/CVE-2026-112058.md): libdvdnav through 7.0.0 Out-of-Bounds Read via set\_PTT JumpTT (CVSS 6.8, VideoLAN libdvdnav)
- [CVE-2026-112057](https://cve.now/CVE-2026-112057.md): libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav\_describe\_title\_chapters (CVSS 6.8, VideoLAN libdvdnav)
- [CVE-2026-112056](https://cve.now/CVE-2026-112056.md): wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH (CVSS 6.8, wvWare wv)
- [CVE-2026-112055](https://cve.now/CVE-2026-112055.md): wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX\_FKP and wvGetCHPX\_FKP (CVSS 6.8, wvWare wv)
- [CVE-2026-112054](https://cve.now/CVE-2026-112054.md): Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing (CVSS 6.8, schroedinger)
- [CVE-2026-112053](https://cve.now/CVE-2026-112053.md): Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro\_params\_set\_default\_quant\_matrix (CVSS 6.8, schroedinger)
- [CVE-2026-112052](https://cve.now/CVE-2026-112052.md): libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing (CVSS 6.9, libspatialite)
- [CVE-2026-112051](https://cve.now/CVE-2026-112051.md): Xinference through 4.0.1 Path Traversal via model\_name in Custom Model Registration (CVSS 8.3, xorbitsai inference)
- [CVE-2026-112050](https://cve.now/CVE-2026-112050.md): Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation (CVSS 2.3, gitify-app gitify)
- [CVE-2026-112049](https://cve.now/CVE-2026-112049.md): Vita3K before build 4187 Path Traversal via VPK Package Installation (CVSS 6.7, Vita3K)
- [CVE-2026-112048](https://cve.now/CVE-2026-112048.md): libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count (CVSS 6.9, libspatialite)
- [CVE-2026-112047](https://cve.now/CVE-2026-112047.md): OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions (CVSS 5.3, oneuptime)
- [CVE-2026-112046](https://cve.now/CVE-2026-112046.md): OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve() (CVSS 6.8, OW2 ASM)
- [CVE-2026-111985](https://cve.now/CVE-2026-111985.md): AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd\_models.py read\_metadata\_from\_safetensors allocation of resources (CVSS 5.3, AUTOMATIC1111 stable-diffusion-webui)
- [RUSTSEC-2026-0414](https://cve.now/RUSTSEC-2026-0414.md): Exponential event growth with \`ENABLE\_WIKILINKS\` (no CVSS, pulldown-cmark)
- [CVE-2026-111984](https://cve.now/CVE-2026-111984.md): AUTOMATIC1111 stable-diffusion-webui Card Builder ui\_extra\_networks.py create\_item\_html cross site scripting (CVSS 5.3, AUTOMATIC1111 stable-diffusion-webui)
- [CVE-2026-112021](https://cve.now/CVE-2026-112021.md): snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser \_xs\_json\_load\_lexer() (CVSS 8.7, grunfink snac2)
- [CVE-2026-112020](https://cve.now/CVE-2026-112020.md): LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced() (CVSS 6.9, lvandeve lodepng)
- [CVE-2026-112019](https://cve.now/CVE-2026-112019.md): cgltf through 1.15 Heap Out-of-Bounds Read via cgltf\_accessor\_unpack\_floats() (CVSS 6.9, jkuhlmann cgltf)
- [CVE-2026-112018](https://cve.now/CVE-2026-112018.md): cgltf through 1.15 Heap Out-of-Bounds Write via cgltf\_accessor\_unpack\_floats() (CVSS 7.3, jkuhlmann cgltf)
- [CVE-2026-112017](https://cve.now/CVE-2026-112017.md): JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass (CVSS 7.1, JeecgBoot)
- [CVE-2026-112016](https://cve.now/CVE-2026-112016.md): Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files (CVSS 6.9, Netcore NR256CN)
- [CVE-2026-112015](https://cve.now/CVE-2026-112015.md): Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os\_env.cwd (CVSS 7.7, omnigent-ai omnigent)
- [CVE-2026-112014](https://cve.now/CVE-2026-112014.md): LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export (CVSS 6.8, netease-youdao LobsterAI)
- [CVE-2026-112013](https://cve.now/CVE-2026-112013.md): libtta through 2.3 Divide by Zero via tta\_decoder\_init\_get\_info (CVSS 6.8, True Audio libtta)
- [CVE-2026-112012](https://cve.now/CVE-2026-112012.md): libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count (CVSS 4.8, True Audio libtta)
- [CVE-2026-112011](https://cve.now/CVE-2026-112011.md): libtta through 2.3 Integer Overflow via tta\_decoder\_init\_get\_info Seek Table (CVSS 5.8, True Audio libtta)
- [CVE-2026-112010](https://cve.now/CVE-2026-112010.md): smpeg through 2.0.0 Integer Underflow via stream\_header in MPEGsystem.cpp (CVSS 6.8, icculus smpeg)
- [CVE-2026-112009](https://cve.now/CVE-2026-112009.md): smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer (CVSS 6.8, icculus smpeg)
- [CVE-2026-112008](https://cve.now/CVE-2026-112008.md): libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng\_read\_ordr (CVSS 6.9, libmng)
- [CVE-2026-112007](https://cve.now/CVE-2026-112007.md): Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader (CVSS 6.9, schismtracker Schism Tracker)
- [CVE-2026-112006](https://cve.now/CVE-2026-112006.md): OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation (CVSS 8.3, opentelemetry-exporter-otlp-proto-http)
- [CVE-2026-112005](https://cve.now/CVE-2026-112005.md): WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor (CVSS 9.2, clidey whodb)
- [CVE-2026-112004](https://cve.now/CVE-2026-112004.md): Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint (CVSS 2.3, teableio teable)
- [CVE-2026-112003](https://cve.now/CVE-2026-112003.md): ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete (CVSS 6.0, ProjectSend)
- [CVE-2026-112002](https://cve.now/CVE-2026-112002.md): ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password (CVSS 7.6, ProjectSend)
- [CVE-2026-112001](https://cve.now/CVE-2026-112001.md): ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities (CVSS 8.6, ProjectSend)
- [CVE-2026-112000](https://cve.now/CVE-2026-112000.md): Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs (CVSS 7.2, vanus-labs vanus)
- [CVE-2026-111999](https://cve.now/CVE-2026-111999.md): Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver (CVSS 8.7, vanus-labs vanus)
- [CVE-2026-111998](https://cve.now/CVE-2026-111998.md): Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway (CVSS 9.3, vanus-labs vanus)
- [CVE-2026-78497](https://cve.now/CVE-2026-78497.md): JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval (CVSS 8.4, JQ-Lite)
- [CVE-2026-110895](https://cve.now/CVE-2026-110895.md): WordPress Support Genix plugin \<= 1.4.54 - SQL Injection vulnerability (CVSS 8.5, DevItems Support Genix)
- [CVE-2026-107436](https://cve.now/CVE-2026-107436.md): WordPress Strong Testimonials plugin \<= 3.3.12 - PHP Object Injection vulnerability (CVSS 8.8, WP Chill Strong Testimonials)
- [CVE-2026-110373](https://cve.now/CVE-2026-110373.md): WordPress Login with phone number plugin \<= 1.8.77 - Privilege Escalation vulnerability (CVSS 8.1, Hamid Alinia Login with phone number)
- [CVE-2026-110880](https://cve.now/CVE-2026-110880.md): WordPress Kit (formerly ConvertKit) plugin \<= 3.4.6 - Broken Access Control vulnerability (CVSS 6.5, Kit)
- [CVE-2026-110886](https://cve.now/CVE-2026-110886.md): WordPress Conversational Forms for ChatBot plugin \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 9.8, QuantumCloud Conversational Forms for ChatBot)
- [CVE-2026-109895](https://cve.now/CVE-2026-109895.md): WordPress Booktics plugin \<= 1.0.29 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Arraytics Booktics)
- [CVE-2026-109894](https://cve.now/CVE-2026-109894.md): WordPress Booktics plugin \<= 1.0.29 - SQL Injection vulnerability (CVSS 9.3, Arraytics Booktics)
- [CVE-2026-110883](https://cve.now/CVE-2026-110883.md): WordPress 2Way VideoCalls and Random Chat plugin \<= 6.1.5 - Broken Authentication vulnerability (CVSS 6.5, VideoWhisper.com 2Way VideoCalls and Random Chat)
- [CVE-2026-110383](https://cve.now/CVE-2026-110383.md): WordPress Electronic Signature Add-on for Fluent Forms plugin \<= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, WP E-Signature Electronic Signature Add-on for Fluent Forms)
- [CVE-2026-110897](https://cve.now/CVE-2026-110897.md): WordPress PowerPack Lite for Beaver Builder plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, IdeaBox Creations PowerPack Lite for Beaver Builder)
- [CVE-2026-110372](https://cve.now/CVE-2026-110372.md): WordPress OttoKit plugin \<= 1.1.40 - Privilege Escalation vulnerability (CVSS 9.8, Brainstorm Force OttoKit)
- [CVE-2026-110382](https://cve.now/CVE-2026-110382.md): WordPress Simply Schedule Appointments plugin \<= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NSquared Simply Schedule Appointments)
- [CVE-2026-108485](https://cve.now/CVE-2026-108485.md): WordPress eStore theme \<= 1.6.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGrill eStore)
- [CVE-2026-110885](https://cve.now/CVE-2026-110885.md): WordPress HivePress plugin \<= 1.7.32 - Content Injection vulnerability (CVSS 6.5, HivePress)
- [CVE-2026-110365](https://cve.now/CVE-2026-110365.md): WordPress Advanced File Manager plugin \<= 5.4.14 - Broken Access Control vulnerability (CVSS 6.5, WPExperts Advanced File Manager)
- [CVE-2026-111942](https://cve.now/CVE-2026-111942.md): hrisikeshpal Blood\_Bank\_Management\_System abs.php cross site scripting (CVSS 5.3, hrisikeshpal Blood\_Bank\_Management\_System)
- [CVE-2026-96534](https://cve.now/CVE-2026-96534.md): Modern Events Calendar (Lite & Pro) \< 7.37.0 - Subscriber+ SQLi via mec\_fes\_csv\_export (CVSS 7.7, Modern Events Calendar Lite · Modern Event Calendar Pro)
- [CVE-2026-111041](https://cve.now/CVE-2026-111041.md): AI Engine \< 3.7.9 - Editor+ Arbitrary Post Modification via update\_media\_metadata and approve\_media (CVSS 4.9, AI Engine)
- [CVE-2026-110981](https://cve.now/CVE-2026-110981.md): WP Photo Album Plus \< 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter (CVSS 7.1, WP Photo Album Plus)
- [CVE-2026-110976](https://cve.now/CVE-2026-110976.md): AI Engine \< 3.7.9 - Editor+ Arbitrary Post Deletion via reject\_media (CVSS 4.9, AI Engine)
- [CVE-2026-110070](https://cve.now/CVE-2026-110070.md): Modern Events Calendar Lite \< 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR (CVSS 6.5, Modern Events Calendar Lite)
- [CVE-2026-110069](https://cve.now/CVE-2026-110069.md): Modern Events Calendar Lite \< 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec\_event\_bookings and mec\_attendees AJAX Actions (CVSS 4.3, Modern Events Calendar Lite)
- [CVE-2026-110035](https://cve.now/CVE-2026-110035.md): Salon Booking System \< 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route (CVSS 4.3, Salon Booking System)
- [CVE-2026-110033](https://cve.now/CVE-2026-110033.md): Salon Booking System \< 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image\_url' (CVSS 6.8, Salon Booking System)
- [CVE-2026-110032](https://cve.now/CVE-2026-110032.md): Salon Booking System \< 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor (CVSS 5.5, Salon Booking System)
- [CVE-2026-110031](https://cve.now/CVE-2026-110031.md): Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key (CVSS 7.2, Salon Booking System)
- [CVE-2026-110026](https://cve.now/CVE-2026-110026.md): Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion (CVSS 4.9, Tasty Recipes Lite)
- [CVE-2026-109937](https://cve.now/CVE-2026-109937.md): Otter Blocks \< 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block (CVSS 5.4, Otter Blocks)
- [CVE-2026-87844](https://cve.now/CVE-2026-87844.md): Product Designer \<= 1.0.40 - Unauthenticated Design Template Data Injection (CVSS 5.3, PickPlugins Product Designer for WooCommerce)
- [CVE-2026-111877](https://cve.now/CVE-2026-111877.md): dext34-morgan Books4Cash search.php cross site scripting (CVSS 5.3, dext34-morgan Books4Cash)
- [CVE-2026-111876](https://cve.now/CVE-2026-111876.md): alexpasmantier television entry.rs output command injection (CVSS 4.8, alexpasmantier television)
- [CVE-2026-111875](https://cve.now/CVE-2026-111875.md): David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization (CVSS 5.1, David-Crty Databasement)
- [CVE-2026-111874](https://cve.now/CVE-2026-111874.md): OpenCATS Career Portal CareersUI.php processLogin excessive authentication (CVSS 6.3, OpenCATS)
- [CVE-2026-111873](https://cve.now/CVE-2026-111873.md): itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection (CVSS 6.9, itsmeravitejak Online-Examination-System)
- [CVE-2026-111872](https://cve.now/CVE-2026-111872.md): itsmeravitejak Online-Examination-System database.php getreport sql injection (CVSS 6.9, itsmeravitejak Online-Examination-System)
- [CVE-2026-111871](https://cve.now/CVE-2026-111871.md): itsmeravitejak Online-Examination-System subjectsdb.php sql injection (CVSS 6.9, itsmeravitejak Online-Examination-System)
- [CVE-2026-111870](https://cve.now/CVE-2026-111870.md): itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication (CVSS 6.9, itsmeravitejak Online-Examination-System)
- [CVE-2026-111869](https://cve.now/CVE-2026-111869.md): makeplane API Endpoint reliance on untrusted inputs in a security decision (CVSS 6.9, makeplane plane)
- [CVE-2026-111868](https://cve.now/CVE-2026-111868.md): datastax pulsar-jms PulsarObjectMessage.java decode deserialization (CVSS 5.3, datastax pulsar-jms)
- [CVE-2026-111997](https://cve.now/CVE-2026-111997.md): ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters (CVSS 6.3, beaugunderson ip-address · ip-address)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.