High-severity CVEs (page 26)
Page 26 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57990 | High | 7.4 | 2026-07-26 | Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-57989 | High | 7.4 | 2026-07-26 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-17497 | High | 8.3 | 2026-07-26 | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default deskto… |
CVE-2026-17496 | High | 8.1 | 2026-07-26 | NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in c… |
CVE-2024-14040 | High | 7.8 | 2026-07-26 | In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various… |
CVE-2026-63720 | High | 7.5 | 2026-07-26 | datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code… |
CVE-2026-15962 | High | 8.8 | 2026-07-26 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of… |
CVE-2026-64529 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a characte… |
CVE-2026-64524 | High | 7.7 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix WIN8 fallback A SYNTHVID_RESOLUTION_RESPONS… |
CVE-2026-64522 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() ha… |
CVE-2026-64520 | High | 8.4 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The register-based PARTITION_INFO… |
CVE-2026-64516 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW a… |
CVE-2026-64515 | High | 8.3 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element (MLE)… |
CVE-2026-64510 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after addi… |
CVE-2026-64502 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices ad_sigma_delta… |
CVE-2026-64501 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix CS held asserted and state leaks In ad_sigma_delta_single_c… |
CVE-2026-64496 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descript… |
CVE-2026-64490 | High | 8.4 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trust… |
CVE-2026-64485 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind snd_compr_task_new() allocates the driver… |
CVE-2026-64481 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whos… |
CVE-2026-64475 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the… |
CVE-2026-64469 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_thread_release() When a thread exits, binder_thread_release() w… |
CVE-2026-64468 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc… |
CVE-2026-64467 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks… |
CVE-2026-64463 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers th… |
CVE-2026-64460 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses… |
CVE-2026-64456 | High | 7.7 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores th… |
CVE-2026-64452 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks u… |
CVE-2026-64449 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buf… |
CVE-2026-64448 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_… |
CVE-2026-64447 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys… |
CVE-2026-64445 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bu… |
CVE-2026-64444 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRs… |
CVE-2026-64443 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in u… |
CVE-2026-64442 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two… |
CVE-2026-64441 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_… |
CVE-2026-64440 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->le… |
CVE-2026-64438 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt han… |
CVE-2026-64437 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f… |
CVE-2026-64436 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key_len for IPComp states pfkey_msg2xfrm_state() handles the… |
CVE-2026-64435 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() readers on audit_queue Multiple readers access a… |
CVE-2026-64434 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() run… |
CVE-2026-64432 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns In the analysis pass… |
CVE-2026-64431 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling post_write_mst_fixup() for invalid index_block ntfs_icx_ib_sync_write… |
CVE-2026-64430 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from hardirq context ntb_epf_vec_isr() calls pci… |
CVE-2026-64423 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is… |
CVE-2026-64422 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv… |
CVE-2026-64420 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cro… |
CVE-2026-64418 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion expand_shrinker_info() itera… |
CVE-2026-64414 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragment… |
CVE-2026-64413 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table t… |
CVE-2026-64412 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the… |
CVE-2026-64411 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and… |
CVE-2026-64408 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() re… |
CVE-2026-64406 | High | 8.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference bef… |
CVE-2026-64403 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt… |
CVE-2026-64402 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is use… |
CVE-2026-64401 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up a witnes… |
CVE-2026-64400 | High | 8.6 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup(… |
CVE-2026-64398 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in smb2_ioctl()… |
CVE-2026-64396 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blockin… |
CVE-2026-64395 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE p… |
CVE-2026-64394 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 ("… |
CVE-2026-64390 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-ran… |
CVE-2026-64389 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives t… |
CVE-2026-64388 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp… |
CVE-2026-64382 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return… |
CVE-2026-64380 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain… |
CVE-2026-64379 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active… |
CVE-2026-64378 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a conta… |
CVE-2026-64375 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (FD links) proc_pid_get_link() an… |
CVE-2026-64374 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT RT migration is done aggress… |
CVE-2026-64372 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc()… |
CVE-2026-64368 | High | 8.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zer… |
CVE-2026-64367 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodix_hid_set… |
CVE-2026-64366 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert wacom_wac_queue_insert… |
CVE-2026-64364 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsi… |
CVE-2026-64361 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_req… |
CVE-2026-64354 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btf_parse_struct_metas() walks u… |
CVE-2026-64333 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix write buffer corruption The digi_write_inb_command() is… |
CVE-2026-64324 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks th… |
CVE-2026-64323 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtu… |
CVE-2026-64322 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_… |
CVE-2026-64318 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partition() reads the physi… |
CVE-2026-64317 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_symlink_chunk() and the S… |
CVE-2026-64315 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use print_hex_dump_devel()… |
CVE-2026-64313 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails w… |
CVE-2026-64312 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_d… |
CVE-2026-64311 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: loongson - Remove broken and unused loongson-rng The loongson-rng rng_alg has sev… |
CVE-2026-64304 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c… |
CVE-2026-64300 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages… |
CVE-2026-64299 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessar… |
CVE-2026-64298 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permiss… |
CVE-2026-64296 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dir_entry(), each TY… |
CVE-2026-64293 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read The bound-check in iommu… |
CVE-2026-64287 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the ho… |
CVE-2026-64286 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU flush_hyp_vcpu() cop… |
CVE-2026-64284 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the hand… |
CVE-2026-64283 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values When binding a mem… |
CVE-2026-64281 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svc_rdma_sq_wait() o… |