High-severity CVEs (page 65)
Page 65 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53277 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation w… |
CVE-2026-53276 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer In iso_sock_rebind_bc(), the… |
CVE-2026-53275 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query… |
CVE-2026-53273 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b… |
CVE-2026-53272 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race w… |
CVE-2026-53270 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the… |
CVE-2026-53268 | High | 8.2 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've… |
CVE-2026-53267 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: bail out on template ct in get eval I noticed this issue while looking… |
CVE-2026-53266 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the… |
CVE-2026-53265 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de ("dm cach… |
CVE-2026-53264 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER an… |
CVE-2026-53262 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock-… |
CVE-2026-53259 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under idev->lock syzbot reported a splat [1]… |
CVE-2026-53256 | High | 8.0 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channe… |
CVE-2026-53255 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads ea… |
CVE-2026-53254 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->… |
CVE-2026-53253 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU… |
CVE-2026-53250 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() The TX metadata are… |
CVE-2026-53248 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free in metadata dst teardown airoha_metadata_dst_free() runs… |
CVE-2026-53244 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: VFS: fix possible failure to unlock in nfsd4_create_file() atomic_create() in fs/namei.c… |
CVE-2026-53242 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_dr… |
CVE-2026-53240 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_p… |
CVE-2026-53239 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race b… |
CVE-2026-53235 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: add pskb_may_pull() to skb_gro_receive_list() skb_gro_receive_list() calls skb_pull(… |
CVE-2026-53234 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-free during device removal The driver was using devm_regist… |
CVE-2026-53233 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netdev: fix double-free in netdev_nl_bind_rx_doit() Sashiko flags that genlmsg_reply() al… |
CVE-2026-53232 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call… |
CVE-2026-53230 | High | 8.7 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_ma… |
CVE-2026-53229 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure In the XSK branch of ml… |
CVE-2026-53223 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTG… |
CVE-2026-53217 | High | 8.6 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the hardware packet offset mvpp2 programs the RX queue packet… |
CVE-2026-53212 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() call… |
CVE-2026-53209 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising… |
CVE-2026-53205 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write… |
CVE-2026-53203 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validation that the info s… |
CVE-2026-53202 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow wh… |
CVE-2026-53201 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" This rev… |
CVE-2026-53200 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already been extracted from i… |
CVE-2026-53199 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_to_send_buf() copie… |
CVE-2026-53198 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-r… |
CVE-2026-53195 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates… |
CVE-2026-53194 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer overflow klsi_105_prepare_write_buffer() is… |
CVE-2026-53193 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via… |
CVE-2026-53192 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a… |
CVE-2026-53191 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries When a bundle recv… |
CVE-2026-53189 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: update file PMD counter before folio_put() __split_huge_pmd_locked() upda… |
CVE-2026-53188 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ib_get_ucaps() Sashiko pointed out it is not s… |
CVE-2026-53187 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc The cpu_id attribute supplied… |
CVE-2026-53185 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or… |
CVE-2026-53184 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: udp: clear skb->dev before running a sockmap verdict On the UDP receive path skb->dev is… |
CVE-2026-53183 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: allow subflow rcv wnd to shrink In MPTCP connection, the `window` field in the TCP… |
CVE-2026-53182 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed… |
CVE-2026-53180 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix livelock in tmigr_handle_remote_up() tmigr_handle_remote_cpu() skip… |
CVE-2026-53179 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix buffer over-read in rtw_update_protection rtw_update_protection()… |
CVE-2026-53178 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Add guards t… |
CVE-2026-53174 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after successful ovl_cache_get() ovl_iterate_merged() stores PTR_ERR(c… |
CVE-2026-53173 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command strea… |
CVE-2026-53172 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region index out-of-bounds in command stream parser NPU_SET_IFM_REG… |
CVE-2026-53171 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic issues in dma_length() dma_length() derives DMA region usage… |
CVE-2026-53170 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA commands with uninitialized length cmd_state_init() initializes… |
CVE-2026-53165 | High | 7.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: iomap: avoid potential null folio->mapping deref during error reporting When a buffered r… |
CVE-2026-53162 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: memcg: use round-robin victim selection in refill_stock Harry Yoo reported that get_rando… |
CVE-2026-53161 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race be… |
CVE-2026-53160 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a… |
CVE-2026-53159 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses… |
CVE-2026-53157 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a… |
CVE-2026-53156 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix use-after-free bugs in error paths Fix several instances of error paths… |
CVE-2026-53153 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() cl… |
CVE-2026-53149 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does no… |
CVE-2026-53148 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_reques… |
CVE-2026-53147 | High | 8.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request(… |
CVE-2026-53146 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies re… |
CVE-2026-53145 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on… |
CVE-2026-53143 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD man… |
CVE-2026-53138 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk lo… |
CVE-2026-53137 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP… |
CVE-2026-53136 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VB… |
CVE-2026-53133 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix truncation for block sizes >= 4G When the iommu is used the linearization… |
CVE-2026-53132 | High | 7.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs-… |
CVE-2026-12937 | High | 7.5 | 2026-06-25 | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_… |
CVE-2026-9702 | High | 7.5 | 2026-06-25 | The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-… |
CVE-2026-5305 | High | 8.8 | 2026-06-25 | The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, whic… |
CVE-2026-12490 | High | 7.5 | 2026-06-25 | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client cert… |
CVE-2026-12246 | High | 8.1 | 2026-06-25 | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack w… |
CVE-2026-12245 | High | 7.5 | 2026-06-25 | NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivi… |
CVE-2026-12244 | High | 8.8 | 2026-06-25 | If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with… |
CVE-2026-13311 | High | 7.5 | 2026-06-25 | shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire gro… |
CVE-2026-12053 | High | 8.6 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access se… |
CVE-2026-10712 | High | 8.0 | 2026-06-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain… |
CVE-2026-10086 | High | 8.7 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain cond… |
CVE-2026-12077 | High | 7.5 | 2026-06-25 | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and inclu… |
CVE-2026-8666 | High | 7.7 | 2026-06-25 | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS… |
CVE-2026-8665 | High | 7.7 | 2026-06-25 | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands… |
CVE-2026-8660 | High | 7.7 | 2026-06-25 | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands vi… |
CVE-2026-8592 | High | 7.7 | 2026-06-25 | OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS co… |
CVE-2026-9155 | High | 8.8 | 2026-06-25 | OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the express… |
CVE-2026-9154 | High | 7.1 | 2026-06-25 | Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrar… |
CVE-2026-57589 | High | 7.4 | 2026-06-25 | sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsle… |
CVE-2026-9787 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-9786 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |