2026 CVEs (page 33)
Page 33 of 661 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-97576 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_co… |
CVE-2026-97575 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile… |
CVE-2026-97574 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_queue_mem_all… | |
CVE-2026-97573 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() fr… |
CVE-2026-97572 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_init_rx_rings() returns… | |
CVE-2026-97571 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() bnxt_alloc_on… | |
CVE-2026-97570 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so t… |
CVE-2026-97569 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Prevent queue stop with deferred completions When the driver receives a burst of… | |
CVE-2026-97568 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: syncookies: remember the request backup flag Instead of using an uninitialised bit… | |
CVE-2026-97567 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect() and rtx Sashiko noted that the two event can rac… | |
CVE-2026-97566 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 The in-kernel MPTCP path manag… | |
CVE-2026-97565 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead() CIFSSMBRead() reads DataLengthH… | |
CVE-2026-97564 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry a… | |
CVE-2026-97563 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() The SMB1 synchronous read h… | |
CVE-2026-97562 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superbl… |
CVE-2026-97561 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator… | |
CVE-2026-97560 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2_parse_native_symlink() When parsing a share-ro… | |
CVE-2026-97559 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replace_sids_and_copy_aces()… | |
CVE-2026-97558 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifs_close() defers a… | |
CVE-2026-97557 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifs_queue_oplock_break() cifs_queue_oplock_break(… |
CVE-2026-97556 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifs_sb_tlink() fails cifs_oplock_break() takes… | |
CVE-2026-97555 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewri… |
CVE-2026-97554 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() cifs_posix_to_fattr(… | |
CVE-2026-97553 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: lock the healthmon when inserting unmount event LOLLM complains that xfs_healthmon_u… | |
CVE-2026-97552 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfs_defer_finish_one() xfs_defer_finish_one() declares error wit… | |
CVE-2026-97551 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args->total for parent pointer updates xfs_parent_da_args_init() builds a… | |
CVE-2026-97550 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in per_binval computation LOLLM noticed that we're doing the un… | |
CVE-2026-97549 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on X… | |
CVE-2026-97548 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions The _maxlevels_ondisk func… |
CVE-2026-97547 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two… | |
CVE-2026-97546 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xre… | |
CVE-2026-97545 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails LOLLM observes that in xfs_btree… | |
CVE-2026-97544 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak dqacct if rhashtable insertion fails LOLLM observes that xqcheck_mod_live… | |
CVE-2026-97543 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: destroy seen inode bitmap when we fail to add a dirpath LOLLM observes a memory leak… | |
CVE-2026-97542 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: bail out on bitmap errors in xrep_agfl_fill LOLLM also points out that the xagb_bitm… | |
CVE-2026-97541 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: don't store usb_device_id usb_device_id is not guaranteed to live longer… | |
CVE-2026-97540 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken w… | |
CVE-2026-97539 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when d… | |
CVE-2026-97538 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_rog_ryujin) Validate HID report lengths rog_ryujin_raw_event() parses respon… | |
CVE-2026-97537 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking qla25xx_free_req_que()… | |
CVE-2026-97536 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-… |
CVE-2026-97535 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size The VP control IOCB select… | |
CVE-2026-97534 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: f2fs: accurately adjust free_sections during free_segment_range In free_segment_range()… | |
CVE-2026-97533 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF A previous commit… | |
CVE-2026-97532 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path When qla2x00_mem… | |
CVE-2026-97531 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acqui… |
CVE-2026-97530 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature qla27xx_copy_multiple_… | |
CVE-2026-97529 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] The FC BSG transport… | |
CVE-2026-97528 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rs… |
CVE-2026-97527 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport->unsol_ctx… |
CVE-2026-97526 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e pai_crypto/CRYPTO_ALL… | |
CVE-2026-97525 | High | 8.2 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated directly… |
CVE-2026-97524 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive pat… |
CVE-2026-97523 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp scheduler may race with su… |
CVE-2026-97522 | | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix bad accounting in __mptcp_subflow_push_pending() If __subflow_push_pending() e… | |
CVE-2026-97228 | Low | 2.7 | 2026-09-25 | Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/exp… |
CVE-2026-27867 | | 2026-09-25 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable f… | |
CVE-2026-97898 | | 2026-09-25 | Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplie… | |
CVE-2026-92106 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and s… | |
CVE-2026-97863 | | 2026-09-25 | The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager A… | |
CVE-2026-92573 | Medium | 6.5 | 2026-09-25 | Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP ma… |
CVE-2026-92564 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qp… |
CVE-2026-92560 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects… |
CVE-2026-92550 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects… |
CVE-2026-88848 | Medium | 4.2 | 2026-09-25 | The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor th… |
CVE-2026-86837 | Medium | 5.3 | 2026-09-25 | The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers… |
CVE-2026-80514 | Medium | 5.3 | 2026-09-25 | The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-vis… |
CVE-2026-6088 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6087 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6086 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6085 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6084 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6083 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inv… | |
CVE-2026-6082 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-96752 | High | 7.2 | 2026-09-25 | The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all… |
CVE-2026-96568 | High | 7.2 | 2026-09-25 | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to… |
CVE-2026-96448 | Medium | 6.6 | 2026-09-25 | A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the sys… |
CVE-2026-95866 | High | 7.2 | 2026-09-25 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-95864 | High | 7.2 | 2026-09-25 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 du… |
CVE-2026-94573 | High | 7.2 | 2026-09-25 | The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and i… |
CVE-2026-93901 | High | 7.3 | 2026-09-25 | The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlo… |
CVE-2026-93747 | Medium | 6.4 | 2026-09-25 | The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. Th… |
CVE-2026-93656 | Medium | 6.4 | 2026-09-25 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-93654 | High | 7.2 | 2026-09-25 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parame… |
CVE-2026-92713 | High | 8.1 | 2026-09-25 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
CVE-2026-92609 | Critical | 9.8 | 2026-09-25 | Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a se… |
CVE-2026-92608 | High | 7.5 | 2026-09-25 | Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQ… |
CVE-2026-89426 | High | 8.8 | 2026-09-25 | The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including… |
CVE-2026-89406 | High | 7.5 | 2026-09-25 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up… |
CVE-2026-88996 | Medium | 6.1 | 2026-09-25 | The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site… |
CVE-2026-84280 | High | 7.2 | 2026-09-25 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions u… |
CVE-2026-19804 | High | 8.8 | 2026-09-25 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote… |
CVE-2026-17602 | Medium | 4.9 | 2026-09-25 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.4… |
CVE-2026-17577 | Medium | 6.1 | 2026-09-25 | The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42… |
CVE-2026-13456 | High | 7.5 | 2026-09-25 | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all vers… |
CVE-2026-13179 | Medium | 6.4 | 2026-09-25 | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2026-12037 | Medium | 5.5 | 2026-09-25 | The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the '… |
CVE-2026-97846 | Medium | 6.8 | 2026-09-25 | Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding… |
CVE-2026-96766 | Medium | 6.4 | 2026-09-25 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bu… |
CVE-2026-96039 | High | 7.2 | 2026-09-25 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27… |