2026 CVEs (page 67)
Page 67 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90121 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Clear per-CPU IRS data on teardown IRS affinity setup publishes an IRS po… | |
CVE-2026-90120 | High | 8.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing In gic_acpi… |
CVE-2026-90119 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup snd_ice1712_probe()… | |
CVE-2026-90118 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfs_decompress() The per-token range check in ntfs… |
CVE-2026-90117 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate usa_ofs before preserving the update sequence number When ntfs_mft_record_… | |
CVE-2026-90116 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown snd_mtpav_output_timer() rearms… | |
CVE-2026-90115 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in __xsk_rcv() In the __xsk_rcv() multi-buffer path, xs… | |
CVE-2026-90114 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel ID… | |
CVE-2026-90113 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: netdevsim: update queue NAPI association on queue reset In netdevsim, receive queues (str… | |
CVE-2026-90112 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads di… | |
CVE-2026-90111 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ip6mr: do not clone dst in ip6mr_cache_report() IPv6 input attaches a non-refcounted (NOR… |
CVE-2026-90110 | Critical | 9.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting syst… |
CVE-2026-90109 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gred_enqueue(), bfifo… | |
CVE-2026-90108 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition When… | |
CVE-2026-90107 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smc_llc_flow_stop() before memset smc_llc_flow_stop() res… | |
CVE-2026-90106 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha address is read direct… | |
CVE-2026-90105 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neigh_reduce read neigh ha directly which can l… | |
CVE-2026-90104 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates cs… |
CVE-2026-90103 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encode_layoutstats_maxsz budgets XDR_QUAD… |
CVE-2026-90102 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4_pnfs_ds_add() keys the per-… |
CVE-2026-90101 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix call to hardware monitoring event handler The first parameter of hwmon_notif… | |
CVE-2026-90100 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The max_period bo… | |
CVE-2026-90099 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifie… | |
CVE-2026-90098 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5_set_rx_mode() runs wi… | |
CVE-2026-90097 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition The VMBus mod… | |
CVE-2026-90096 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fuse: invalidate the correct range after O_APPEND direct write fuse_direct_write_iter() c… | |
CVE-2026-90095 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuse_uring_cmd(… | |
CVE-2026-90094 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLR_EL1.TCSO0 is set whe… | |
CVE-2026-90093 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Since commit b66774b48dd9 ("… |
CVE-2026-90092 | High | 8.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN New sk should not be added to… |
CVE-2026-90091 | High | 8.0 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan For L2CAP sockets wit… |
CVE-2026-90090 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdio_tx_packet() rou… | |
CVE-2026-90089 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxp_process_fw_dump() pulls the… |
CVE-2026-90088 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop rfcomm_appl… | |
CVE-2026-90087 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hci_conn when a second LE connect is rejected create_le_conn_co… | |
CVE-2026-90086 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDP_TX_METADATA in zero-copy path The zero-copy path reads TX metadata wheneve… | |
CVE-2026-90085 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvu_dbg_nix_tm_tree_display… | |
CVE-2026-90084 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-vf: fix workqueue and netdev race in probe/remove Initialize the VF workqueue b… | |
CVE-2026-90083 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Only operate on Ethernet frames act_ife encapsulates/decapsulates the… | |
CVE-2026-90082 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Cap MSI-X vectors to the device MSI-X table size mana_gd_query_max_resources()… | |
CVE-2026-90081 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/rds: use wq_has_sleeper() in rds_cong_map_updated() rds_cong_map_updated() runs after… | |
CVE-2026-90080 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup af_xdp_zc_qidx tracks receive… | |
CVE-2026-90079 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init() rvu_mbox_init() is c… | |
CVE-2026-90078 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: fix length calculations and avoid invalid header warnings syzbot r… | |
CVE-2026-90077 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: fix a resource leak in copy_net_ns() error handling path Currently, preinit_net() do… | |
CVE-2026-90076 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fq_init() computes quan… | |
CVE-2026-90075 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_codel: clamp default quantum and mtu fq_codel_init() sets q->quantum = psch… | |
CVE-2026-90074 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: clamp default quantum to avoid signed overflow fq_pie_init() sets q->q… | |
CVE-2026-90073 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhf_change() to avoid overflow hhf_init() sets q->qu… | |
CVE-2026-90072 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed overflow soft lockup sfq_init() sets q->qua… | |
CVE-2026-90071 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: restore skb->dev on the slave failure path teql_master_xmit() sets s… |
CVE-2026-90070 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24_status() ignores the result of… | |
CVE-2026-90069 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when cloning ACOMP_REQUEST_ON_STACK() rese… |
CVE-2026-90068 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The snd_soc_dapm_put_enum_dou… | |
CVE-2026-90067 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banne… |
CVE-2026-90066 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify ftrace_direct… | |
CVE-2026-90065 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure IPPROTO_SMC… | |
CVE-2026-90064 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Reject page faults from non-fault-mode scratch VMs Having scratch enabled does no… | |
CVE-2026-90063 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gso_segs The user can specify any gso_… | |
CVE-2026-90062 | High | 7.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: move hardware offload step after building the chain blob Allocate t… |
CVE-2026-90061 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip double clone set expressions on element insert Both the dynset… | |
CVE-2026-90060 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer trie… | |
CVE-2026-90059 | High | 7.5 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: restore NET_IP_ALIGN in the RX DMA offset Since the RX path was converted to… |
CVE-2026-90058 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup qdisc_get_stab() accepts a us… | |
CVE-2026-90057 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() Jaeyoung Chung and… |
CVE-2026-90056 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fec_ptp_init() is only called when fep->buf… | |
CVE-2026-90055 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid ci_range initialization syzbot reported a shift-out-of-boun… | |
CVE-2026-90054 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, w… | |
CVE-2026-90053 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_htb: limit htb_classify inner-class filter hops htb_classify() follows eac… | |
CVE-2026-90052 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc ("dm-integ… |
CVE-2026-90051 | High | 7.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however… |
CVE-2026-90050 | | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: clamp quantum and initial_quantum in change path The fq change path accept… | |
CVE-2026-8674 | Medium | 5.3 | 2026-09-17 | Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 cha… |
CVE-2026-85720 | Medium | 5.9 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |
CVE-2026-85716 | Low | 3.7 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12… |
CVE-2026-54587 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c u… | |
CVE-2026-54586 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fe… | |
CVE-2026-54585 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and dest… | |
CVE-2026-54583 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filename… | |
CVE-2026-54582 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed… | |
CVE-2026-54581 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap in… | |
CVE-2026-54580 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompres… | |
CVE-2026-54579 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the… | |
CVE-2026-54578 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed an… | |
CVE-2026-54577 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but pass… | |
CVE-2026-54576 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, do_actual_install() in libmport/bundle_read_install_pkg.c used path-based lstat(), chown(), stat(), a… | |
CVE-2026-54575 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/… | |
CVE-2026-28326 | High | 8.8 | 2026-09-17 | SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static… |
CVE-2026-93015 | Medium | 6.3 | 2026-09-17 | BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can… |
CVE-2026-93014 | High | 7.1 | 2026-09-17 | RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-lis… |
CVE-2026-93013 | Medium | 4.3 | 2026-09-17 | RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authe… |
CVE-2026-92881 | Medium | 4.3 | 2026-09-17 | A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the compo… |
CVE-2026-91039 | | 2026-09-17 | Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynami… | |
CVE-2026-89036 | High | 8.8 | 2026-09-17 | Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute a… |
CVE-2026-86864 | High | 8.8 | 2026-09-17 | pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare traili… |
CVE-2026-86863 | Critical | 9.8 | 2026-09-17 | pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered throug… |
CVE-2026-86862 | Medium | 6.5 | 2026-09-17 | pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql… |
CVE-2026-86861 | Medium | 5.9 | 2026-09-17 | pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permiss… |
CVE-2026-86040 | High | 7.5 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0… |
CVE-2026-86039 | High | 8.2 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses con… |