2026 CVEs (page 77)
Page 77 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89840 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVE_RANGE destination size F2FS_IOC_MOVE_RANGE checks the source range, b… |
CVE-2026-89839 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() f2fs_xattr_advis… | |
CVE-2026-89838 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as… |
CVE-2026-89837 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in find_in_level find_in_level() gets a dentry folio with f2f… | |
CVE-2026-89836 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folio_nr_pages() race after put in large folio invalidate Our v6.18 based Andro… |
CVE-2026-89835 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even w… | |
CVE-2026-89834 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range()… | |
CVE-2026-89833 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() There is potential deadl… | |
CVE-2026-89832 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to ch… |
CVE-2026-89831 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs store path already t… | |
CVE-2026-89830 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In __allocate_data_bloc… | |
CVE-2026-89829 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() Otherwise in f2fs_sanit… |
CVE-2026-89828 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() drmm_cgroup_register_region() is… | |
CVE-2026-89827 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized UVD rings uvd_v7_0_sw_init() does not in… | |
CVE-2026-89826 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthor_fw_read_build_info() checks… |
CVE-2026-89825 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthor_init_cs_iface() and pan… |
CVE-2026-89824 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter re… | |
CVE-2026-89823 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drm_dev_register() failure and ioctl If drm_dev_register()… |
CVE-2026-89822 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driver_data in i915_pci_probe() pci_match_device() can retur… | |
CVE-2026-89821 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid divide-by-zero in __is_lut_linear() __is_lut_linear() computes the… | |
CVE-2026-89820 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dc_lock leak on GPU reset error paths On GPU reset, dm_suspend() tak… | |
CVE-2026-89819 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC d… |
CVE-2026-89818 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2]… |
CVE-2026-89817 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gud_connector_add_tv_mode() rea… | |
CVE-2026-89816 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Commit 1c6ceeee6eb… | |
CVE-2026-89815 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt->restore after successful restore ttm_pool_restore_and_alloc() can succe… |
CVE-2026-89814 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev->isolation[] has… |
CVE-2026-89813 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the… | |
CVE-2026-89812 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm… | |
CVE-2026-89811 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler… |
CVE-2026-89810 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram If page migration from device to sy… |
CVE-2026-89809 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds Reading /sys/kernel/debu… | |
CVE-2026-89808 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram When migration… |
CVE-2026-89807 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch(… | |
CVE-2026-89806 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation The framebuffer size calcul… |
CVE-2026-89805 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Fix folio allocation fallback and use-after-put drm_pagemap_migrate_populate… |
CVE-2026-89804 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migra… |
CVE-2026-89803 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveau_channel_… |
CVE-2026-89802 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Each bind_job_op is zeroed… | |
CVE-2026-89801 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE In nouveau_uvmm_bin… |
CVE-2026-89800 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE A successful OP_… | |
CVE-2026-89799 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_get_stackid The get_perf_callchain call needs disabled pre… |
CVE-2026-89798 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notification rpcrdma_rn_register() inserts @rn… | |
CVE-2026-89797 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500_fg: fix use-after-free on remove ab8500_fg_remove() destroys the dr… | |
CVE-2026-89796 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamond_merge_regions() internal loop Patch series "mm/damo… | |
CVE-2026-89795 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a… |
CVE-2026-89794 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling extends the last respon… | |
CVE-2026-86585 | | 2026-09-16 | The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who control… | |
CVE-2026-86107 | Medium | 5.9 | 2026-09-16 | The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This… |
CVE-2026-86106 | Critical | 9.6 | 2026-09-16 | An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in… |
CVE-2026-14916 | | 2026-09-16 | A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway E… | |
CVE-2026-89793 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap re… |
CVE-2026-86792 | High | 8.8 | 2026-09-16 | Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables… |
CVE-2026-86474 | | 2026-09-16 | The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker t… | |
CVE-2026-86466 | High | 8.1 | 2026-09-16 | Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An at… |
CVE-2026-86443 | | 2026-09-16 | Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the devic… | |
CVE-2026-85628 | | 2026-09-16 | Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in v… | |
CVE-2026-84501 | Medium | 5.3 | 2026-09-16 | An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request… |
CVE-2026-84439 | Medium | 5.3 | 2026-09-16 | When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sendi… |
CVE-2026-82310 | High | 7.2 | 2026-09-16 | Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rej… |
CVE-2026-79993 | High | 7.5 | 2026-09-16 | The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes… |
CVE-2026-77190 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mod… |
CVE-2026-76187 | Critical | 9.8 | 2026-09-16 | Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak… |
CVE-2026-76186 | Critical | 9.1 | 2026-09-16 | Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keyclo… |
CVE-2026-76151 | | 2026-09-16 | Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 t… | |
CVE-2026-73469 | Medium | 5.8 | 2026-09-16 | When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the int… |
CVE-2026-73468 | Medium | 6.5 | 2026-09-16 | A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast tr… |
CVE-2026-73455 | High | 7.5 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to… |
CVE-2026-73453 | Critical | 10.0 | 2026-09-16 | An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions… |
CVE-2026-73440 | Medium | 4.2 | 2026-09-16 | On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a… |
CVE-2026-73438 | Medium | 5.3 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast… |
CVE-2026-73436 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor ma… |
CVE-2026-73435 | High | 8.2 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated… |
CVE-2026-59969 | High | 7.5 | 2026-09-16 | Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hos… |
CVE-2026-59739 | High | 7.5 | 2026-09-16 | Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registeri… |
CVE-2026-19640 | Medium | 4.2 | 2026-09-16 | On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization… |
CVE-2026-14917 | | 2026-09-16 | A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is… | |
CVE-2026-92081 | Medium | 5.9 | 2026-09-16 | fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is s… |
CVE-2026-89792 | High | 7.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configura… |
CVE-2026-89791 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() revival races with the last munmap() perf_mmap_… |
CVE-2026-89790 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6_multipath_rebalance rt6_multipath_rebalance() calculate… | |
CVE-2026-89789 | High | 7.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newl… |
CVE-2026-89788 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect(… |
CVE-2026-89787 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() For casef… | |
CVE-2026-89786 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a… |
CVE-2026-89785 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init ntfs_reparse_init()… | |
CVE-2026-89784 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 rpcb_register_in… | |
CVE-2026-89783 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check… |
CVE-2026-89782 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_… |
CVE-2026-89781 | High | 8.4 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() read_log_rec_buf() copies a log re… |
CVE-2026-89780 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() all… | |
CVE-2026-89779 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a no… |
CVE-2026-89778 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block(… |
CVE-2026-89777 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily… |
CVE-2026-89776 | | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter en… | |
CVE-2026-89775 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effe… |
CVE-2026-89774 | High | 8.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be don… |
CVE-2026-89186 | | 2026-09-16 | Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP… | |
CVE-2026-88255 | | 2026-09-16 | Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice wit… | |
CVE-2026-86465 | Medium | 6.5 | 2026-09-16 | Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag… |