Critical-severity CVEs (page 24)
Page 24 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73043 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and… |
CVE-2026-73042 | Critical | 9.0 | 2026-08-15 | SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, vie… |
CVE-2026-73041 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious ma… |
CVE-2026-18855 | Critical | 9.1 | 2026-08-15 | The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function i… |
CVE-2026-19598 | Critical | 9.8 | 2026-08-15 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and inclu… |
CVE-2026-15689 | Critical | 9.8 | 2026-08-15 | Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_re… |
CVE-2026-74573 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE arm_vsmmu_vsid_to_… |
CVE-2026-74570 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runl… |
CVE-2026-74569 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tc… |
CVE-2026-74568 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race b… |
CVE-2026-74556 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_h… |
CVE-2026-74545 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase_start_xmit(), when t… |
CVE-2026-74521 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and ca… |
CVE-2026-74517 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Cancel (and flush)… |
CVE-2026-74495 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error is encountered while mapping TX buffe… |
CVE-2026-74493 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination __smc_lgr_terminate() dr… |
CVE-2026-74480 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() itera… |
CVE-2026-74478 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packe… |
CVE-2026-74476 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_… |
CVE-2026-74475 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use neigh_ha_snapshot() in route_shortcircuit() The neighbour hardware address n->… |
CVE-2026-74474 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_re… |
CVE-2026-74473 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently… |
CVE-2026-73194 | Critical | 9.1 | 2026-08-15 | DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse… |
CVE-2026-73193 | Critical | 9.8 | 2026-08-15 | DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. p… |
CVE-2026-16142 | Critical | 9.8 | 2026-08-15 | The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() A… |
CVE-2026-15826 | Critical | 9.8 | 2026-08-15 | The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due t… |
CVE-2026-74439 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device_pasi… |
CVE-2026-74436 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_acc… |
CVE-2026-74434 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc_recvmsg_oob() takes a… |
CVE-2026-74433 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgk_issue_challenge() Fix rxgk_issue_challenge() to free the page cont… |
CVE-2026-74428 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpc_recvmsg() Fix a double unlock in rxrpc_recvmsg() when d… |
CVE-2026-74427 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs ne… |
CVE-2026-74406 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udp_tunnel_sock_relea… |
CVE-2026-74401 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in send_queue ordered In a benchmark scenario triggering a lot of… |
CVE-2026-74398 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD addrconf_dad_fail… |
CVE-2026-74394 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-con… |
CVE-2026-74384 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvme_ns_head struct nvme_ns_head contains a… |
CVE-2026-74376 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio for discard put_all_bios() always drops de… |
CVE-2026-74361 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used… |
CVE-2026-74350 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2_validate_inode_block() alread… |
CVE-2026-74345 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoi… |
CVE-2026-74315 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() file_hash() digests the… |
CVE-2026-74310 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubuf_info per outs… |
CVE-2026-74309 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in oct… |
CVE-2026-74287 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctp_verify_asconf() and sctp_verify_par… |
CVE-2026-74280 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sg_cleanup path use… |
CVE-2026-74279 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sg_cleanup error path use… |
CVE-2026-74269 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test test_xdp_native_adjst_head_grow… |
CVE-2026-74268 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tcp: clear sock_ops cb flags before force-closing a child socket A child socket inherits… |
CVE-2026-74267 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring q… |
CVE-2026-74255 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipc_l2_send_msg() Syzbot reported a slab-use-after-free in ipvlan_hard_… |
CVE-2026-72496 | Critical | 9.2 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Proper rollback if the ioremap fails bnxt_qplib_alloc_dpi returns success e… |
CVE-2026-72495 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages Applications can request multi… |
CVE-2026-72494 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitq… |
CVE-2026-72493 | Critical | 9.9 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: serialize netif_running() check in enqueue_to_backlog() Syzbot reported a KASAN slab… |
CVE-2026-72491 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma->state in trans_rdma.c The rdma->state field is modifi… |
CVE-2026-72477 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call _ntfs_bad_inode() when failing to rename It is safe to call _ntfs_bad_inod… |
CVE-2026-72473 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl_kref formerly served two distinct… |
CVE-2026-72472 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal of the file lock list Lingfeng identified a bug… |
CVE-2026-72466 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma_is_bcall() decodes a reply's firs… |
CVE-2026-72463 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev… |
CVE-2026-72451 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code check… |
CVE-2026-72442 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf_flow_ip6_tunnel_prot… |
CVE-2026-72436 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko poin… |
CVE-2026-72429 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dst_entry IOAM uses a dummy dst_entry(null_dst) to mark… |
CVE-2026-72422 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE conn->preaut… |
CVE-2026-72421 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG_IP_MULTIPLE_TABLES… |
CVE-2026-72417 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() Add sanity check fo… |
CVE-2026-72412 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix handling of _PAGE_UNUSED pte bit The _PAGE_UNUSED softbit should not really… |
CVE-2026-72408 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint geneve_gro_receive() reads… |
CVE-2026-72407 | Critical | 10.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve_gro_complete() Even with both paths gated… |
CVE-2026-72399 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdp_frame The size of xdp_redirect_arr arr… |
CVE-2026-72398 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is i… |
CVE-2026-72393 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic_tx_lso() calls skb_cow_head() whi… |
CVE-2026-72381 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp->owner.name in durable handle owner check Two concurrent… |
CVE-2026-72366 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to handle async cache object creation netfs_create_wr… |
CVE-2026-72355 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest list Fix the barriering used when walking t… |
CVE-2026-72351 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote ch… |
CVE-2026-72348 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and r… |
CVE-2026-72339 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build_skb failure qede_rx_build_skb() and… |
CVE-2026-72329 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pci_dev LUT The PF SR-IOV enable path caches VF pci_dev poin… |
CVE-2026-72323 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() A race condition exists between de… |
CVE-2026-72322 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device… |
CVE-2026-72320 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_eva… |
CVE-2026-72319 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after s… |
CVE-2026-72318 | Critical | 9.4 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the respo… |
CVE-2026-72317 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt across the TLS connect_worker The TLS connect path has a use-a… |
CVE-2026-72299 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc_sk_enqueue() runs with sk->… |
CVE-2026-72296 | Critical | 9.1 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife_decode() ife decode may return after mak… |
CVE-2026-72291 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in try_get_locked_pte() Fix an unlikely race in try_get_lock… |
CVE-2026-72289 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_lis… |
CVE-2026-72288 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo… |
CVE-2026-72279 | Critical | 9.0 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR… |
CVE-2026-72278 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with… |
CVE-2026-72277 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR… |
CVE-2026-72251 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: reload possible stale data pointer quoting sashiko: -------------… |
CVE-2026-72249 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the… |
CVE-2026-72248 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel… |
CVE-2026-72239 | Critical | 9.3 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN" Revert 99cf1… |
CVE-2026-72234 | Critical | 9.8 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicast_ttvn skb->data only after skb realloc The pskb_may_pull() call… |