2026 CVEs (page 29)
Page 29 of 661 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-88389 | Medium | 6.2 | 2026-09-25 | Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause… |
CVE-2026-84882 | High | 7.5 | 2026-09-25 | IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker c… |
CVE-2026-84862 | High | 7.2 | 2026-09-25 | IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerab… |
CVE-2026-98162 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2_tree_connect() See the procedure below: s… | |
CVE-2026-98161 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmem_submit_bio() records a REQ_PREFLUSH e… | |
CVE-2026-98160 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalDa… | |
CVE-2026-97865 | High | 7.3 | 2026-09-25 | A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Rem… |
CVE-2026-97864 | Medium | 5.3 | 2026-09-25 | A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAja… |
CVE-2026-97222 | Medium | 5.5 | 2026-09-25 | A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML pa… |
CVE-2026-93834 | High | 8.8 | 2026-09-25 | A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcr… |
CVE-2026-93647 | Critical | 9.3 | 2026-09-25 | An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS… |
CVE-2026-93643 | Critical | 9.8 | 2026-09-25 | When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsi… |
CVE-2026-93642 | Critical | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the at… |
CVE-2026-93641 | Critical | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the a… |
CVE-2026-85750 | High | 7.2 | 2026-09-25 | Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficien… |
CVE-2026-85542 | High | 8.8 | 2026-09-25 | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provid… |
CVE-2026-85029 | High | 7.5 | 2026-09-25 | IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to impro… |
CVE-2026-84893 | High | 7.6 | 2026-09-25 | IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sens… |
CVE-2026-84884 | High | 7.5 | 2026-09-25 | IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gai… |
CVE-2026-80431 | | 2026-09-25 | Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to writ… | |
CVE-2026-80430 | | 2026-09-25 | Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program w… | |
CVE-2026-100190 | | 2026-09-25 | The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from i… | |
CVE-2026-100187 | | 2026-09-25 | The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a len… | |
CVE-2026-100177 | | 2026-09-25 | The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attac… | |
CVE-2026-100176 | | 2026-09-25 | The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored w… | |
CVE-2026-100174 | | 2026-09-25 | The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a cu… | |
CVE-2026-100172 | | 2026-09-25 | The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for match… | |
CVE-2026-100079 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsi_register() creates per-inst… | |
CVE-2026-100078 | Medium | 5.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwl_mei_write… |
CVE-2026-100077 | Medium | 5.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire t… |
CVE-2026-100076 | Medium | 5.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths issue_beacon(… |
CVE-2026-100075 | Critical | 9.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partw… |
CVE-2026-100074 | Medium | 5.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf_refcount field as unique BPF_REFCOUNT is not marked as a unique field, whil… |
CVE-2026-100073 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix transaction overflow during writeback Commit 95ad8ee45cdb ("ext4: correct the r… | |
CVE-2026-100072 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpi_bus_get_primary_device() The acpi_get_first_physical_node() usag… | |
CVE-2026-100071 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a… | |
CVE-2026-100070 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_ad… | |
CVE-2026-95832 | | 2026-09-25 | Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49… | |
CVE-2026-88421 | High | 7.5 | 2026-09-25 | Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog e… |
CVE-2026-88420 | Medium | 5.4 | 2026-09-25 | A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers w… |
CVE-2026-79153 | High | 7.8 | 2026-09-25 | Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticat… |
CVE-2026-78902 | Medium | 6.1 | 2026-09-25 | Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package |
CVE-2026-52622 | High | 7.5 | 2026-09-25 | An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker… |
CVE-2026-51773 | High | 8.1 | 2026-09-25 | An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to… |
CVE-2026-51772 | Medium | 6.5 | 2026-09-25 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is e… |
CVE-2026-98159 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware… | |
CVE-2026-98158 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ppp_async: drop the errored frame instead of resetting its headroom ppp_receive_nonmp_fra… | |
CVE-2026-98157 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation The poll_msec sys… | |
CVE-2026-98156 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses… |
CVE-2026-98155 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5… | |
CVE-2026-98154 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a h… |
CVE-2026-98153 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path… | |
CVE-2026-98152 | Medium | 5.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting qu… |
CVE-2026-98151 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following un… | |
CVE-2026-98150 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_CPU stores the target CPU ID in th… |
CVE-2026-98149 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup s… | |
CVE-2026-98148 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUD_ROTATION_0 is present in supported rotations The rotation argument… | |
CVE-2026-98147 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthread_run failure. Since __kthread_create_on_node() returns -EINT… | |
CVE-2026-98146 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain struct amdxdna_cmd_chain… | |
CVE-2026-98145 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose command_coun… | |
CVE-2026-98144 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdna_cmd_set_error() looks up… | |
CVE-2026-98143 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPU_SET_{… |
CVE-2026-98142 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The `cirrus-qemu` driver relies on `CIRR… | |
CVE-2026-98141 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: propagate reparse index insertion failure update_reparse_data() ignores the return… | |
CVE-2026-98140 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmap_local leak in write_mft_record_nolock() error paths write_mft_record_noloc… | |
CVE-2026-98139 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfs_cluster_free_from_r… | |
CVE-2026-98138 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: do not mark the volume clean in sync_fs when errors were recorded ntfs_put_super()… | |
CVE-2026-98137 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfs_dio_zero_range() returns e… | |
CVE-2026-98136 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfs_attr_find_in_attrdef() walk… | |
CVE-2026-98135 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid sectors_per_cluster in the boot sector is_boot_sector_ntfs() checks… | |
CVE-2026-98134 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: check_cond_jmp_op(): properly infer if register is null Nicholas Carlini reported a… | |
CVE-2026-98133 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfs_set_ea(), the exit path unco… | |
CVE-2026-98132 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO states.c:__clean_func_sta… | |
CVE-2026-98131 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmac_tso_xmit() In stmmac_tso_xmit(), if the DMA m… | |
CVE-2026-98130 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks t… |
CVE-2026-98129 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() sas_port_alloc_num()… | |
CVE-2026-98128 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() mpi3mr_get_tgtdev_… | |
CVE-2026-98127 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3_insert_range() does not check if the n… | |
CVE-2026-98126 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOC_FL_ZERO_RANGE is used without FAL… | |
CVE-2026-98125 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3_insert_range() and smb3_co… | |
CVE-2026-98124 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3_zero_range(), smb3_pun… | |
CVE-2026-98123 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctp_verify_asconf() w… | |
CVE-2026-98122 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() vxlan_mdb_is_valid_source()… |
CVE-2026-98121 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313e_wdt_probe() doesn… | |
CVE-2026-98120 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfs_unbuffered_write() in the e… | |
CVE-2026-98119 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfs_alloc_subrequest() fails syzbot reported a null-… | |
CVE-2026-98118 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some… | |
CVE-2026-98117 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix potential UAF/KASAN warning Currently, trace_cachefiles_coherency() is be… | |
CVE-2026-98116 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params(… |
CVE-2026-98115 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one sess… |
CVE-2026-98114 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl() silently accepts truncated ACEs and all… | |
CVE-2026-98113 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but un… | |
CVE-2026-98112 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its lis… |
CVE-2026-98111 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifi… | |
CVE-2026-98110 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-t… | |
CVE-2026-98109 | Medium | 4.7 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix race condition during device registration In hci_register_dev()… |
CVE-2026-98108 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection(… |
CVE-2026-98107 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect l2cap_chan_connect() tri… | |
CVE-2026-98106 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Prevent double migration of device pages A device-private folio migrated to… | |
CVE-2026-98105 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oa_tc6: Improve the error recovery When oversubscribed traffic causes lot… |