2026 CVEs (page 516)
Page 516 of 672 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42467 | High | 7.5 | 2026-05-01 | An issue was discovered in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Binary_Data_Transfer_DM16 causing… |
CVE-2026-37541 | Critical | 10.0 | 2026-05-01 | Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properl… |
CVE-2026-37540 | High | 8.4 | 2026-05-01 | OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker… |
CVE-2026-37539 | Critical | 9.8 | 2026-05-01 | Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowi… |
CVE-2026-37538 | High | 7.5 | 2026-05-01 | Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or other unspecified impa… |
CVE-2026-37537 | High | 8.1 | 2026-05-01 | collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Trans… |
CVE-2026-37536 | High | 8.8 | 2026-05-01 | miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (… |
CVE-2026-37535 | High | 7.1 | 2026-05-01 | openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, whe… |
CVE-2026-37534 | Critical | 9.8 | 2026-05-01 | Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transport_Protocol_Data_T… |
CVE-2026-37532 | High | 7.1 | 2026-05-01 | AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_le… |
CVE-2026-37531 | Critical | 9.8 | 2026-05-01 | AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget ins… |
CVE-2026-37530 | High | 7.5 | 2026-05-01 | AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-b… |
CVE-2026-37526 | High | 7.8 | 2026-05-01 | AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, De… |
CVE-2026-37525 | High | 7.8 | 2026-05-01 | AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call fun… |
CVE-2026-7586 | Medium | 4.3 | 2026-05-01 | A weakness has been identified in Open5GS up to 2.7.7. Affected is the function ogs_id_get_value of the file /src/amf/nudm-handler.c of the component AMF. This… |
CVE-2026-7585 | Medium | 4.3 | 2026-05-01 | A vulnerability was determined in Open5GS up to 2.7.7. The impacted element is the function amf_nudm_sdm_handle_provisioned of the file /src/amf/nudm-handler.c… |
CVE-2026-42481 | Medium | 5.5 | 2026-05-01 | Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be triggered by crafted IGES or STEP fil… |
CVE-2026-42480 | Medium | 5.5 | 2026-05-01 | A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to… |
CVE-2026-42475 | Medium | 6.5 | 2026-05-01 | SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `on` array to the joinOn function in BuildHelper.php. |
CVE-2026-42474 | Medium | 6.5 | 2026-05-01 | SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php. |
CVE-2026-42473 | Critical | 9.8 | 2026-05-01 | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the F… |
CVE-2026-42472 | Critical | 9.8 | 2026-05-01 | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Redis in the RedisHandl… |
CVE-2026-42471 | High | 8.1 | 2026-05-01 | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) calls unserialize() on data received from… |
CVE-2026-37554 | High | 7.5 | 2026-05-01 | An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworkin… |
CVE-2026-37552 | High | 8.4 | 2026-05-01 | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it… |
CVE-2026-37505 | Medium | 4.9 | 2026-05-01 | SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directl… |
CVE-2026-37504 | Medium | 5.3 | 2026-05-01 | Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token… |
CVE-2026-37503 | Medium | 6.9 | 2026-05-01 | Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board… |
CVE-2026-23866 | Medium | 4.3 | 2026-05-01 | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26… |
CVE-2026-23863 | Medium | 6.5 | 2026-05-01 | An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL by… |
CVE-2026-22167 | High | 7.8 | 2026-05-01 | Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages. Under ce… |
CVE-2026-22166 | High | 8.1 | 2026-05-01 | A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared libra… |
CVE-2026-22165 | High | 8.1 | 2026-05-01 | A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a write UAF crash in the GPU GLES user-space shared lib… |
CVE-2026-7583 | Medium | 4.3 | 2026-05-01 | A flaw has been found in Open5GS up to 2.7.7. This issue affects the function bsf_sess_find_by_ipv6prefix of the file /src/bsf/context.c of the component BSF… |
CVE-2026-43507 | Medium | 5.3 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by XML pars… |
CVE-2026-43506 | Medium | 5.3 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused by memory l… |
CVE-2026-43505 | Medium | 6.5 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access con… |
CVE-2026-43504 | Medium | 6.5 | 2026-05-01 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access con… |
CVE-2026-43057 | High | 7.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback NETIF_F_IPV6_CSUM only a… |
CVE-2026-43056 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, a… |
CVE-2026-43055 | High | 7.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: file: Use kzalloc_flex for aio_cmd The target_core_file doesn't initialize… |
CVE-2026-43054 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcm_loop: Drain commands in target_reset handler tcm_loop_target_reset() vi… |
CVE-2026-43053 | Medium | 4.7 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: xfs: close crash window in attr dabtree inactivation When inactivating an inode with node… |
CVE-2026-43052 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check tdls flag in ieee80211_tdls_oper When NL80211_TDLS_ENABLE_LINK is c… |
CVE-2026-43051 | High | 8.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() funct… |
CVE-2026-43050 | High | 7.0 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sock_def_readable() A race condition exists between lec_a… |
CVE-2026-43049 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Pres… |
CVE-2026-43048 | High | 8.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: core: Mitigate potential OOB by removing bogus memset() The memset() in hid_report_r… |
CVE-2026-43047 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a… |
CVE-2026-43046 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: btrfs: reject root items with drop_progress and zero drop_level [BUG] When recovering rel… |
CVE-2026-43045 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: mshv: Fix error handling in mshv_region_pin The current error handling has two issues: F… |
CVE-2026-43044 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix DMA corruption on long hmac keys When a key longer than block size is… |
CVE-2026-43043 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: af-alg - fix NULL pointer dereference in scatterwalk The AF_ALG interface fails t… |
CVE-2026-43042 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mp… |
CVE-2026-43041 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak __radix_tree_cr… |
CVE-2026-43040 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prev… |
CVE-2026-43039 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch emac_dis… |
CVE-2026-43038 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: … |
CVE-2026-43037 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. … |
CVE-2026-43036 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: use skb_header_pointer() for TCPv4 GSO frag_off check Syzbot reported a KMSAN uninit… |
CVE-2026-43035 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an i… |
CVE-2026-43034 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: set backing store type from query type bnxt_hwrm_func_backing_store_qcaps_v2() s… |
CVE-2026-43033 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When de… |
CVE-2026-43032 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: NFC: pn533: bound the UART receive buffer pn532_receive_buf() appends every incoming byte… |
CVE-2026-43031 | High | 7.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets When a TX packet spans m… |
CVE-2026-43030 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix regsafe() for pointers to packet In case rold->reg->range == BEYOND_PKT_END && r… |
CVE-2026-43029 | High | 7.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix soft lockup in mptcp_recvmsg() syzbot reported a soft lockup in mptcp_recvmsg(… |
CVE-2026-43028 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names that lack a \0 characte… |
CVE-2026-43027 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregis… |
CVE-2026-43026 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ctnetlink_alloc_e… |
CVE-2026-43025 | High | 7.3 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master… |
CVE-2026-43024 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is always used from use… |
CVE-2026-43023 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_connect() checks sk_st… |
CVE-2026-43022 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists hci_cmd_sync_queu… |
CVE-2026-43021 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails When hci_cmd_sync_queue… |
CVE-2026-43020 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provid… |
CVE-2026-43019 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field a… |
CVE-2026-43018 | High | 8.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn look… |
CVE-2026-43017 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate mesh send advertising payload length mesh_send() currently boun… |
CVE-2026-43016 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). syzbo… |
CVE-2026-43015 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: macb: fix clk handling on PCI glue driver removal platform_device_unregister() may s… |
CVE-2026-43014 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: macb: properly unregister fixed rate clocks The additional resources allocated with… |
CVE-2026-43013 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: lag: Check for LAG device before creating debugfs __mlx5_lag_dev_add_mdev() may… |
CVE-2026-43012 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix switchdev mode rollback in case of failure If for some internal reason swit… |
CVE-2026-43011 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it c… |
CVE-2026-43010 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable kprobe_multi programs at attach time kprobe.multi programs run in a… |
CVE-2026-43009 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix incorrect pruning due to atomic fetch precision tracking When backtrack_insn enc… |
CVE-2026-43008 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio() devm_regmap_init_mmio()… |
CVE-2026-43007 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the de… |
CVE-2026-43006 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_a… |
CVE-2026-43005 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (tps53679) Fix array access with zero-length block read i2c_smbus_read_block_data(… |
CVE-2026-43004 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: spi: stm32-ospi: Fix resource leak in remove() callback The remove() callback returned ea… |
CVE-2026-42479 | Medium | 5.5 | 2026-05-01 | An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to caus… |
CVE-2026-42478 | High | 7.5 | 2026-05-01 | An issue was discovered in VrmlData_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows attackers to cause a den… |
CVE-2026-42477 | High | 7.1 | 2026-05-01 | A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 allows user-assisted at… |
CVE-2026-42476 | High | 7.1 | 2026-05-01 | Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii be… |
CVE-2026-31785 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/xe_pagefault: Disallow writes to read-only VMAs The page fault handler should reje… |
CVE-2026-31784 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/pxp: Clear restart flag in pxp_start after jumping back If we don't clear the flag… |
CVE-2026-31783 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback aml_… |
CVE-2026-31782 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: perf/x86: Fix potential bad container_of in intel_pmu_hw_config Auto counter reload may h… |