2026 CVEs (page 324)
Page 324 of 689 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64290 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failu… |
CVE-2026-64289 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_len iommufd_hwpt_inva… |
CVE-2026-64288 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs fro… |
CVE-2026-64287 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the ho… |
CVE-2026-64286 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU flush_hyp_vcpu() cop… |
CVE-2026-64285 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating… |
CVE-2026-64284 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the hand… |
CVE-2026-64283 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values When binding a mem… |
CVE-2026-64282 | Medium | 4.7 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier In the case that… |
CVE-2026-64281 | High | 7.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svc_rdma_sq_wait() o… |
CVE-2026-64280 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() ac… |
CVE-2026-64279 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2… |
CVE-2026-64278 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: mark I2C adapter when hardware is powered down On some i.MX platforms, ce… |
CVE-2026-64277 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes… |
CVE-2026-64276 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() al… |
CVE-2026-64275 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad… |
CVE-2026-64274 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodix_ts_read_input_report() cop… |
CVE-2026-64273 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index iforce_process_pack… |
CVE-2026-64272 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch co… |
CVE-2026-64271 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet tw_interrupt() accumula… |
CVE-2026-64270 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114_interrupt() reads a packet… |
CVE-2026-64269 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server ans… |
CVE-2026-64268 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/… |
CVE-2026-64267 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSE_NOTIFY_PRUNE validates the nodeid p… |
CVE-2026-64266 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the… |
CVE-2026-64265 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() move… |
CVE-2026-64264 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit copy_from_user() returns the number o… |
CVE-2026-64263 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to ent_in_userspace list fuse_uring_cancel() moves… |
CVE-2026-64262 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-uring cancel task work When io_uring delivers task work wi… |
CVE-2026-64261 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_qu… |
CVE-2026-64260 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are sever… |
CVE-2026-64259 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might… |
CVE-2026-64258 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref If a copy… |
CVE-2026-64257 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: c… |
CVE-2026-64256 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota ids in dqiterate LOLLM noticed that q_id is an unsigned 32-b… |
CVE-2026-16766 | Critical | 9.8 | 2026-07-25 | Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkht… |
CVE-2026-15425 | Medium | 6.4 | 2026-07-25 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name… |
CVE-2026-14955 | Medium | 6.5 | 2026-07-25 | The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the '… |
CVE-2026-10818 | High | 8.1 | 2026-07-25 | The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize f… |
CVE-2026-66374 | High | 8.1 | 2026-07-25 | Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path. |
CVE-2026-66373 | High | 7.5 | 2026-07-25 | Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same… |
CVE-2026-66339 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subseq… |
CVE-2026-66338 | Medium | 5.4 | 2026-07-24 | A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC… |
CVE-2026-66337 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing mu… |
CVE-2026-61892 | High | 8.8 | 2026-07-24 | Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. |
CVE-2026-61886 | Medium | 6.5 | 2026-07-24 | Weintek cMT3092X HMI stores user account passwords in plaintext. |
CVE-2026-60135 | Medium | 6.5 | 2026-07-24 | An attacker can modify data that should be restricted to read‑only access. |
CVE-2026-60134 | High | 8.8 | 2026-07-24 | Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges. |
CVE-2026-16280 | Critical | 9.8 | 2026-07-24 | An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This c… |
CVE-2026-61884 | Critical | 9.8 | 2026-07-24 | The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earli… |
CVE-2026-55985 | Medium | 4.3 | 2026-07-24 | The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessibl… |
CVE-2026-66041 | High | 8.8 | 2026-07-24 | FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt… |
CVE-2026-66040 | High | 8.8 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attacke… |
CVE-2026-66039 | High | 8.8 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt hea… |
CVE-2026-66038 | Medium | 6.5 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose u… |
CVE-2026-66037 | Medium | 6.5 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated a… |
CVE-2026-66036 | High | 8.8 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap… |
CVE-2026-62835 | Critical | 9.3 | 2026-07-24 | Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. |
CVE-2026-57531 | Medium | 5.4 | 2026-07-24 | Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute… |
CVE-2026-57530 | Medium | 5.4 | 2026-07-24 | Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows at… |
CVE-2026-54342 | High | 8.1 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a s… |
CVE-2026-48037 | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundatio… | |
CVE-2026-48036 | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers runnin… | |
CVE-2026-48035 | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using… | |
CVE-2026-48034 | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypas… | |
CVE-2026-48033 | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can… | |
CVE-2026-48032 | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy… | |
CVE-2026-48021 | Critical | 9.1 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake wi… |
CVE-2026-17107 | High | 8.5 | 2026-07-24 | A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE)… |
CVE-2026-66035 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt… |
CVE-2026-66034 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-lengt… |
CVE-2026-66033 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/opens… |
CVE-2026-66032 | High | 8.8 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH ser… |
CVE-2026-65711 | High | 7.2 | 2026-07-24 | sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web… |
CVE-2026-65710 | High | 7.1 | 2026-07-24 | sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigge… |
CVE-2026-65709 | High | 8.3 | 2026-07-24 | sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate accou… |
CVE-2026-65708 | High | 8.1 | 2026-07-24 | sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachm… |
CVE-2026-65707 | Medium | 6.5 | 2026-07-24 | Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting… |
CVE-2026-65623 | | 2026-07-24 | Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment… | |
CVE-2026-66027 | High | 8.3 | 2026-07-24 | Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue… |
CVE-2026-65693 | High | 7.2 | 2026-07-24 | Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command… |
CVE-2026-64255 | High | 8.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA sessio… |
CVE-2026-64254 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR When BAR_PE… |
CVE-2026-64253 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() PF_BLOCK_TS is only set in blk_time_get_… |
CVE-2026-64252 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations… |
CVE-2026-64251 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() d… |
CVE-2026-64250 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stop_this_cpu() This is a port of MIPS commit 9f3f3… |
CVE-2026-64249 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in child_regions_with_firmware() Move of_node_put(child_… |
CVE-2026-64248 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stop_this_cpu() smp_send_stop() parks all secondary… |
CVE-2026-64247 | High | 8.4 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP… |
CVE-2026-64246 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() … |
CVE-2026-64245 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() If mode_option is NULL, it is assigne… |
CVE-2026-64244 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->altmap after successful device registration If __add_memory… |
CVE-2026-64243 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simple_mux_control_put() rejects… |
CVE-2026-64242 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() install… |
CVE-2026-64241 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and reso… |
CVE-2026-64240 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc… |
CVE-2026-64239 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() DAMON sysfs maintains the… |
CVE-2026-64238 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 ("gpio: s… |
CVE-2026-64237 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - validate firmware size before use Ensure that the firmware file is larg… |