CVE-2026 list

CVE-2026 records published in October 2026

Page five of 14: records 4,001 to 5,000 of the 13,324 published in October 2026, newest first. The first page carries the figures for October 2026.

CVE-2026 records published in October 2026, newest first: records 4,001 to 5,000 of 13,324
CVE Summary CVSS EPSS Published Signals
CVE-2026-98752Linux kernel tty port use-after-free–0.2%2026-10-18Fix
CVE-2026-98751In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this race, but TCSBRK and TCSBRKP should stil–0.2%2026-10-18Fix
CVE-2026-98750Linux kernel tty use-after-free–0.2%2026-10-18Fix
CVE-2026-98749In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100_shutdo–0.2%2026-10-18Fix
CVE-2026-98748Linux kernel 8250_bcm7271 use-after-free–0.2%2026-10-18Fix
CVE-2026-98747Linux kernel serial core null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98746In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() of_clk_get() returns a clock with a reference that has to be released with clk_put(). ma35d1serial_probe() never does that, so the reference is leaked on the probe e–0.2%2026-10-18Fix
CVE-2026-98745In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When system_supports_sme() is true but system_supports_sve() is false, restoring a specifically crafted SVE signal context can result in the task erroneous–0.2%2026-10-18Fix
CVE-2026-98744In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_st–0.2%2026-10-18Fix
CVE-2026-98743In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_co–0.2%2026-10-18Fix
CVE-2026-98742In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat path invokes the same handlers through snd_seq_kernel_client_ctl()–0.2%2026-10-18Fix
CVE-2026-98741In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detect_usb_format() cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketS–0.2%2026-10-18Fix
CVE-2026-98740In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed __init memory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DE–0.2%2026-10-18Fix
CVE-2026-98739In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the initial tty_port reference. The release path te–0.2%2026-10-18Fix
CVE-2026-98738Linux kernel Bluetooth use-after-free–0.2%2026-10-18Fix
CVE-2026-98737Linux kernel hci_sync use-after-free–0.2%2026-10-18Fix
CVE-2026-98736Linux kernel hci_conn use-after-free–0.2%2026-10-18Fix
CVE-2026-98735Linux kernel hci_core use-after-free–0.2%2026-10-18Fix
CVE-2026-98734In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown hci_low_sent() selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used–0.2%2026-10-18Fix
CVE-2026-98733Linux kernel hci_core use-after-free–0.2%2026-10-18Fix
CVE-2026-98732Linux kernel btintel buffer over-read–0.2%2026-10-18Fix
CVE-2026-98731In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" ch–0.2%2026-10-18Fix
CVE-2026-98730In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4–0.2%2026-10-18Fix
CVE-2026-98729In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h get_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits() adds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge–0.2%2026-10-18Fix
CVE-2026-98728In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2_get_random() When the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random() skips the 4-byte parameter size field before locating the random data, but the bounds check still validat–0.2%2026-10-18Fix
CVE-2026-98727In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namesp–0.2%2026-10-18Fix
CVE-2026-98726In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups an–0.2%2026-10-18Fix
CVE-2026-98725Linux kernel nvmet-auth out-of-bounds write–0.2%2026-10-18Fix
CVE-2026-98724In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr_descs zero, so nvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outs–0.2%2026-10-18Fix
CVE-2026-98723In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second uuid_copy() of args->hostid near the end of nvmet_alloc_ctrl(),–0.2%2026-10-18Fix
CVE-2026-98722In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erase_size is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evaluates if (size % erase_size) with a zero divisor, whic–0.2%2026-10-18Fix
CVE-2026-98721In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending int–0.2%2026-10-18Fix
CVE-2026-98720In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the runtime eVMCS controls (pin, primary, secondary, etc.) are being updated. If L1 isn'–0.2%2026-10-18Fix
CVE-2026-98719Linux kernel SEV double free–0.2%2026-10-18Fix
CVE-2026-98718In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny win–0.2%2026-10-18Fix
CVE-2026-98717Linux kernel x86/mmu null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98716In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 if–0.2%2026-10-18Fix
CVE-2026-98715In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU performs the requested TLB flush if and onl–0.2%2026-10-18Fix
CVE-2026-98714In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the beha–0.2%2026-10-18Fix
CVE-2026-98713In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvm_calculate_traps–0.2%2026-10-18Fix
CVE-2026-98712In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the ref–0.2%2026-10-18Fix
CVE-2026-98711Linux kernel cw1200 out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98710In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945_pci_probe() calls il_eeprom_init(), which allocates memory for the EEPROM data. The probe failure paths release this allocation with il_eeprom_free(), but the remove path doe–0.2%2026-10-18Fix
CVE-2026-98709Linux kernel mac80211 use-after-free–0.2%2026-10-18Fix
CVE-2026-98708In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. However, the early free paths only consider a–0.2%2026-10-18Fix
CVE-2026-98707In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tid_rx. Later timer-wheel processing and the timer callback itself then run against freed memory–0.2%2026-10-18Fix
CVE-2026-98706In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update num_sta_ps and the power-–0.2%2026-10-18Fix
CVE-2026-98705In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH_MAX_MPATHS. mesh_path_free_rcu() decrements the interfac–0.2%2026-10-18Fix
CVE-2026-98704In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits–0.2%2026-10-18Fix
CVE-2026-98703In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel_ht: validate fixed rate index The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the value into mi->max_tp_rate[] and mi->m–0.2%2026-10-18Fix
CVE-2026-98702Linux kernel mac80211 kernel panic–0.2%2026-10-18Fix
CVE-2026-98701In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from–0.2%2026-10-18Fix
CVE-2026-98700In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info->band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee80211_8023_xmit() does not set info->band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211_get_tx_rates() use–0.2%2026-10-18Fix
CVE-2026-98699Linux kernel mac80211 use-after-free–0.2%2026-10-18Fix
CVE-2026-98698In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element. crypt_len is then zero and aes_siv_encrypt() is called–0.2%2026-10-18Fix
CVE-2026-98697In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "new_id" attribute to avoid leaking any id added by a racing write to the attribute.–0.2%2026-10-18Fix
CVE-2026-98696Linux kernel serial use-after-free–0.2%2026-10-18Fix
CVE-2026-98695In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing c–0.2%2026-10-18Fix
CVE-2026-98694Linux kernel thunderbolt use-after-free–0.2%2026-10-18Fix
CVE-2026-98693In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tb_stop() drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprx_work still in flight (which holds its own tunnel reference) an–0.2%2026-10-18Fix
CVE-2026-98692In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tb_tunnel_alloc_dp() takes an optional callback which is run from dprx_work once the DPRX capabilities read has completed. Without that callback tb_dp_dprx_start() read–0.2%2026-10-18Fix
CVE-2026-98691In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tb_stop() only tears down DMA tunnels so a DP tunnel that is still waiting for dprx_work to complete keeps that work queued while the routers are removed and th–0.2%2026-10-18Fix
CVE-2026-98690In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tb_tunnel_one_dp() takes a domain reference which is only dropped once tb_dp_tunnel_active() has run on the work queue. If that work is cancelled that reference is–0.2%2026-10-18Fix
CVE-2026-98689In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it misses a tb_dp_dprx_stop() that could not cancel the already running work. It then poll–0.2%2026-10-18Fix
CVE-2026-98688Linux kernel thunderbolt null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98687Linux kernel thunderbolt out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98686In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3_zero_range() removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold da–0.2%2026-10-18Fix
CVE-2026-98685In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifs_remap_file_range() discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio strad–0.2%2026-10-18Fix
CVE-2026-98684In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills–0.2%2026-10-18Fix
CVE-2026-98683In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3_zero_range() emulates FALLOC_FL_ZERO_RANGE by invalidating the page cache over the target range with truncate_pagecache_range() and then issuing FSCTL_SET_ZERO_DATA to the–0.2%2026-10-18Fix
CVE-2026-98682In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifs_file_copychunk_range() and the clone (FICLONE) path of cifs_remap_file_range() do not serialise the destination page cache against the server-side copy the way t–0.2%2026-10-18Fix
CVE-2026-98681In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplock_break_cancelled, offload, and status_file_deleted fields are stored in the same bitfield byte in struct cifsFileInfo, but–0.2%2026-10-18Fix
CVE-2026-98680Linux kernel kionix-kx022a memory leak–0.2%2026-10-18Fix
CVE-2026-98679In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013_write_event_config() already ignores repeated enable requests, but a repeated disable re–0.2%2026-10-18Fix
CVE-2026-98678In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid oversampling_ratio validation In ad4030_set_avg_frame_len(), the logarithm is calculated before input validation. Passing zero or negative values leads to an undefined result from ilog2(). Validate t–0.2%2026-10-18Fix
CVE-2026-98677Linux kernel ad_sigma_delta use-after-free–0.2%2026-10-18Fix
CVE-2026-98676Linux kernel ade9000 null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98675In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: handle Phase C dip events in IRQ1 handler ADE9000_ST1_CROSSING_DEPTH is the exclusive upper bound for scanning the STATUS1 event bits, so a value of 25 left out the highest event bit, ADE9000_ST1_DIPC_BIT (bit 2–0.2%2026-10-18Fix
CVE-2026-98674In the Linux kernel, the following vulnerability has been resolved: iio: adc: adi-axi-adc: Initialize state mutex The AXI ADC register access paths serialize transactions with st->lock, but probe does not initialize it. Initialize the mutex before registering the backend.–0.2%2026-10-18Fix
CVE-2026-98673In the Linux kernel, the following vulnerability has been resolved: iio: adc: pac1934: check ACPI label duplication A label duplication failure currently reaches the terminating-byte write. Release the ACPI result and abort before accessing the missing label; earlier labels are managed by devres.–0.2%2026-10-18Fix
CVE-2026-98672Linux kernel stm32-adc divide by zero–0.2%2026-10-18Fix
CVE-2026-98671In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure If devm_thermal_of_zone_register() fails, probe returns without unregistering the IIO map array or disabling runtime PM. Jump to err_map to release them.–0.2%2026-10-18Fix
CVE-2026-98670In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via schedule_delayed_work(); that work is cleared by a devm callback. Register the devm callback–0.2%2026-10-18Fix
CVE-2026-98669In the Linux kernel, the following vulnerability has been resolved: iio: buffer: serialize buffer teardown with mode claims Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take info_exist_lock followed by mlock in–0.2%2026-10-18Fix
CVE-2026-98668Linux kernel buffer uninitialized memory use–0.2%2026-10-18Fix
CVE-2026-98667Linux kernel adf4377 crash–0.2%2026-10-18Fix
CVE-2026-98666In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serial_number file operations are open coded and never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. debugfs_remove_recursive() therefore does not wai–0.2%2026-10-18Fix
CVE-2026-98665Linux kernel max30102 null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98664In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400_serial_number_fops is open coded and never calls debugfs_file_get(), so debugfs_remove_recursive() does not wait for a read in progress and unbind frees the iio_dev unde–0.2%2026-10-18Fix
CVE-2026-98663In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmware_revision and firmware_date file operations are open coded and never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. debugfs_remove_recursive() t–0.2%2026-10-18Fix
CVE-2026-98662Linux kernel gp2ap020a00f use-after-free–0.2%2026-10-18Fix
CVE-2026-98661In the Linux kernel, the following vulnerability has been resolved: iio: light: rohm-bu27034: Fix infinite delay on error When reading an integration-time fails, the code will use error code to compute the sleep time. Fix this by using the smallest integration time as a default if reading fails.–0.2%2026-10-18Fix
CVE-2026-98660Linux kernel bmp280 out-of-bounds access–0.2%2026-10-18Fix
CVE-2026-98659In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read fail–0.2%2026-10-18Fix
CVE-2026-98658In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond–0.2%2026-10-18Fix
CVE-2026-98657In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure pm_runtime_set_active() failing in probe() jumps to error_unreg_buffer, which only calls iio_triggered_buffer_cleanup() -- it does not undo the iio_de–0.2%2026-10-18Fix
CVE-2026-98656In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_work before freeing trigger iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger through container_of()–0.2%2026-10-18Fix
CVE-2026-98655In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with exclude_kernel=1 can be opened without kernel perf access. However, exclude_kernel does not suppress text-poke sideband records. Every PERF_RECORD_TEXT_POKE is mark–0.2%2026-10-18Fix
CVE-2026-98654In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atomize IRQ register read/modify/write ops [Why] The OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for the output timing generator (OTG). VUPDATE_NO_LOCK is one of them. To enable the IRQ, driv––2026-10-18
CVE-2026-98653In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix _gaccess_shadow_fault() In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. dat_entry_walk() will not find any leaf entry–0.2%2026-10-18Fix
CVE-2026-98652In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() Like kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the kvm->srcu or the slots lock when performing the Store status operation. Fix by taking kvm->srcu in kvm_s–0.2%2026-10-18Fix
CVE-2026-98651Linux kernel s390 null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98650Linux kernel s390 crash–0.2%2026-10-18Fix
CVE-2026-98649In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in _destroy_pages_crste() Use READ_ONCE() in _destroy_pages_crste() to read the crste, avoid dereferencing the pointer multiple times.–0.2%2026-10-18Fix
CVE-2026-98648Linux kernel s390/uv out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98647Linux kernel bpf divide by zero–0.2%2026-10-18Fix
CVE-2026-98646In the Linux kernel, the following vulnerability has been resolved: tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context bpf_sock_destroy() runs from the tcp iterator, under rcu_read_lock(). If the sock is a listener that still has children in its accept queue, tcp_abort() ends up–0.2%2026-10-18Fix
CVE-2026-98645Linux kernel winwing use-after-free–0.2%2026-10-18Fix
CVE-2026-98644In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() __htab_map_lookup_and_delete_batch() has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPF_MA–0.2%2026-10-18Fix
CVE-2026-98643Linux kernel bpf out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98642Linux kernel bpf use-after-free–0.2%2026-10-18Fix
CVE-2026-98641In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so build_prologue() takes the exception_cb path and never calls push_callee_regs(). That is t–0.2%2026-10-18Fix
CVE-2026-98640Linux kernel amd_sfh out-of-bounds access–0.2%2026-10-18Fix
CVE-2026-98639In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification (section 15.1.2) requires a nested HFENCE entry to be populated as follows: 1) find an unused entry with Config.Pending == 0 2) update the Page_Number and P–0.2%2026-10-18Fix
CVE-2026-98638In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and the WARN_ON() th–0.2%2026-10-18Fix
CVE-2026-98637In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure pkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE in kvm->arch.vcpu_features when it fails, but vcpu_has_sve() tests KVM_ARCH_FLAG_GUEST_HAS_SVE, which is left set. Late–0.2%2026-10-18Fix
CVE-2026-98636In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift expo–0.2%2026-10-18Fix
CVE-2026-98635Linux kernel block out-of-bounds write–0.2%2026-10-18Fix
CVE-2026-98634In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts–0.2%2026-10-18Fix
CVE-2026-98633In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxp_set_ind_reset() from–0.2%2026-10-18Fix
CVE-2026-98632Linux kernel mgmt use-after-free–0.2%2026-10-18Fix
CVE-2026-98631In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk_map_gen_lookup xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a max_entries value of 0x80000000 or higher b–0.2%2026-10-18Fix
CVE-2026-98630In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to page_pool_destroy() instead of destroying the header–0.2%2026-10-18Fix
CVE-2026-98629In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle ('tc filter add ... handle 801: u32 divisor N') keys its IDR entry on the raw handle, while the destroy paths free it u–0.2%2026-10-18Fix
CVE-2026-98628In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining i–0.2%2026-10-18Fix
CVE-2026-98627In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe() regsafe() maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, howev–0.2%2026-10-18Fix
CVE-2026-98626In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpf_core_patch_insn() currently poisons its target before checking whether t–0.2%2026-10-18Fix
CVE-2026-98625Linux kernel flowtable use-after-free–0.2%2026-10-18Fix
CVE-2026-98624In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close() which can call the release function while unrelated socket–0.2%2026-10-18Fix
CVE-2026-98623Linux kernel drm/nouveau/clk out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98622Linux kernel act_ct kernel panic–0.2%2026-10-18Fix
CVE-2026-98621In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb-–0.2%2026-10-18Fix
CVE-2026-98620In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure If register_netdev() fails for one of the MTK_MAX_DEVS devices in mtk_probe(), the error path jumps to err_deinit_ppe, skipping mtk_unreg_dev(). The previ–0.2%2026-10-18Fix
CVE-2026-98619In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl_lock for the ioctl self test An offline self test that brings the interface down and back up with netif_close() / netif_open() requires rtnl_lock for both. Since the ethtool IOCTL path became rtnl-optional–0.2%2026-10-18Fix
CVE-2026-98618In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNIC_MAX_TXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128 v–0.2%2026-10-18Fix
CVE-2026-98617In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn->napi[idx % fbn->num_napi]; The issue is this is only correct in the cases where the–0.2%2026-10-18Fix
CVE-2026-98616In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset num_napi when the napi vectors are freed fbn->num_napi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnic_pm_suspend() tears the datapath d–0.2%2026-10-18Fix
CVE-2026-98615In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnic_mbx_reset_desc_ring() writes AW_CFG with FLUSH set and everything else, BME included, cleared. Clearing BME–0.2%2026-10-18Fix
CVE-2026-98614In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctp_assoc_update_retran_path() can loop forever when every remaining transport, including retran_path, is SCTP_UNCONFIRMED: the state check runs before the wraparound test, so t–0.2%2026-10-18Fix
CVE-2026-98613In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpf_obj_free_fields() follows those pointers through __bpf_obj_drop_impl() synchronousl–0.2%2026-10-18Fix
CVE-2026-98612In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc_rx_done() catc_rx_done() walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pkt_len > urb->actual_length, ignores the header offset and compar–0.2%2026-10-18Fix
CVE-2026-98611In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpf_crypto_ctx_create() is a kfunc whose second argument is declared with the __sz annotation, so the verifier only guarantees that params__sz bytes of params are valid. The f–0.2%2026-10-18Fix
CVE-2026-98610In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget hfsc_classify() applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a fl–0.2%2026-10-18Fix
CVE-2026-98609In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm_gem_handle_create() fails virtio_gpu_gem_create() owns the reference taken by virtio_gpu_object_create(). On the drm_gem_handle_create() error path it calls drm_gem_object_release() instead of–0.2%2026-10-18Fix
CVE-2026-98608In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() virtio_gpu_resource_create_ioctl() calls drm_gem_object_release() on the drm_gem_handle_create() error path instead of dropping the reference it owns, so obj->funcs–0.2%2026-10-18Fix
CVE-2026-98607In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on both the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create() error paths i–0.2%2026-10-18Fix
CVE-2026-98606In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio_gpu_vram_create() errors virtio_gpu_vram_create() frees the object with a bare kfree(vram) on both error paths after drm_gem_private_object_init() has run, and on the second one after d–0.2%2026-10-18Fix
CVE-2026-98605In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiod_get_optional() to devm_gpiod_get_optional() while keeping–0.2%2026-10-18Fix
CVE-2026-98604In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn_bind is published through peer->bind with RCU, but local endpoint learning updates bind->local in place under peer->lock. UDP TX reads the field without that lock. In par–0.2%2026-10-18Fix
CVE-2026-98603In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind->local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an–0.2%2026-10-18Fix
CVE-2026-98602In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),–0.2%2026-10-18Fix
CVE-2026-98601In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate device-supplied DMA indices In btintel_pcie_msix_rx_handle(), the driver processes RX completion descriptors (urbd1) written by the PCIe device into DMA-coherent memory. urbd1->frbd_tag (a 16-bit–0.2%2026-10-18Fix
CVE-2026-98600In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() While rfcomm_recv_frame() verifies that skb->len is at least sizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame with an extended 2-byte length–0.2%2026-10-18Fix
CVE-2026-98599In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack–0.2%2026-10-18Fix
CVE-2026-98598In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6_insert_exception() for dying fib6_info. Before the cited commit, fib6_nh_flush_exceptions() always set from->exception_bucket_flushed = 1 under rt6_exception_lock to prevent rt6_insert_exception() from inserting–0.2%2026-10-18Fix
CVE-2026-98597In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The followin–0.2%2026-10-18Fix
CVE-2026-98596In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check() detect an uncached route by list_empty(&rt->dst.rt_uncached), which replaced the static DST_NOCACHE flag check in commit a4c–0.2%2026-10-18Fix
CVE-2026-98595In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects t–0.2%2026-10-18Fix
CVE-2026-98594In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3_get_invariants() can register an MDIO bus and connect a PHY for USE_PHYLIB devices. If tg3_init_one() later fails, its common error path releases the mappings and netdev without–0.2%2026-10-18Fix
CVE-2026-98593Linux kernel s390/debug null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98592In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for every slot beyond old_head as soon as that slot's memset()'d local copy is committed with "*tx_desc–0.2%2026-10-18Fix
CVE-2026-98591In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb_pointer_if_linear() function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. T–0.2%2026-10-18Fix
CVE-2026-98590In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sock context code generation Currently, the ctx access code reads the rx_queue_mapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, th–0.2%2026-10-18Fix
CVE-2026-98589In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTR_TO_PACKET registers' bounds are modified across subprog boundaries. PTR_TO_PACKET registers are actually passed as PTR_TO_MEM, which is assumed–0.2%2026-10-18Fix
CVE-2026-98588In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc sock_map_alloc() only rejects max_entries == 0 and otherwise allows any u32 value. sock_map_free() then walks the sks[] array with a signed int iterator: int i; for (–0.2%2026-10-18Fix
CVE-2026-98587In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso_resource_auto client resource The todo member of iso_resource_auto structure represents the state of the client resource and normally transitions in the following order: ISO_RES_AUT–0.2%2026-10-18Fix
CVE-2026-98586In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod_timer() in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls mod_timer() before taking the reference needed b–0.2%2026-10-18Fix
CVE-2026-98585In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes roundup_pow_of_two() is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonze–0.2%2026-10-18Fix
CVE-2026-98584In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in em_text_dump() em_text_dump() allocates struct tcf_em_text on the stack without zeroing it. strscpy() writes the algorithm name and a NUL terminator into conf.algo[], leaving the remaini–0.2%2026-10-18Fix
CVE-2026-98583In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach–0.2%2026-10-18Fix
CVE-2026-98582In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it u–0.2%2026-10-18Fix
CVE-2026-98581In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() nfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still linked on local->connecting_sockets: it looks the socket up with nfc_llcp_connecting_–0.2%2026-10-18Fix
CVE-2026-98580Linux kernel llcp race condition–0.2%2026-10-18Fix
CVE-2026-98579In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc ENOMEM, nfc_llcp_send_snl_s–0.2%2026-10-18Fix
CVE-2026-98578In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID. Require the prefix–0.2%2026-10-18Fix
CVE-2026-98577In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() nfc_llcp_wks_sap() compares only service_name_len bytes, so a short service_name like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring–0.2%2026-10-18Fix
CVE-2026-98576Linux kernel llcp out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98575Linux kernel pn533 out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98574Linux kernel bcmgenet use-after-free–0.2%2026-10-18Fix
CVE-2026-98573In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() skb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max argument and passes the result to __pskb_pull_tail() as a signed int. The function does not–0.2%2026-10-18Fix
CVE-2026-98572In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was neg–0.2%2026-10-18Fix
CVE-2026-98571In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf->page after recycling on skb build failure In stmmac_rx(), when napi_build_skb() fails the descriptor page is recycled back to the page pool with page_pool_recycle_direct(), but buf->page is left point–0.2%2026-10-18Fix
CVE-2026-98570In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overhead() The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as the length they are about to push plus dst_dev_overhead(), then push the new headers and rebuild–0.2%2026-10-18Fix
CVE-2026-98569In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect metadata through changelink ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Convertin–0.2%2026-10-18Fix
CVE-2026-98568Linux kernel vxlan time-of-check time-of-use race condition–0.2%2026-10-18Fix
CVE-2026-98567In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev->num_tc are valid in dev->tc_to_txq[], and dev->prio_tc_map[] may only name classes below it. netdev_set_num_tc() lowers dev->num_tc without touching either–0.2%2026-10-18Fix
CVE-2026-98566In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the c–0.2%2026-10-18Fix
CVE-2026-98565Linux kernel mt7530 null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98564In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530_remove_common() disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is o–0.2%2026-10-18Fix
CVE-2026-98563In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylink_bringup_phy() stores the PHY in pl->phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phy_eee_rx_clock_stop() can fail with a real MD–0.2%2026-10-18Fix
CVE-2026-98562In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from submitting–0.2%2026-10-18Fix
CVE-2026-98561In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfp_net_ipsec_rx() drops the XArray lock before taking a reference to the xfrm_state it found. The delete path can erase the entry and drop the last state reference in that interval.–0.2%2026-10-18Fix
CVE-2026-98560In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with __rds_conn_create() computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by t–0.2%2026-10-18Fix
CVE-2026-98559Linux kernel net/smc use-after-free–0.2%2026-10-18Fix
CVE-2026-98558In the Linux kernel, the following vulnerability has been resolved: net: flush skb_defer_nodes in dev_cpu_dead() When a CPU goes offline, dev_cpu_dead() drains its softnet queues (completion_queue, output_queue, poll_list, process_queue, and input_pkt_queue), but leaves net_hotdata.skb_defer_nodes–0.2%2026-10-18Fix
CVE-2026-98557In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO gve_can_send_tso() computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in–0.2%2026-10-18Fix
CVE-2026-98556In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gve_prep_tso() notes that the device requires the MSS to be len and gso_segs, never gso_size. Such a packet reaches gve_tx_fill_tso_ctx_desc(), which puts gso_size into the ms–0.2%2026-10-18Fix
CVE-2026-98555Linux kernel llc use-after-free–0.2%2026-10-18Fix
CVE-2026-98554In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlan_dev_hard_header() Callers that only reserve ETH_HLEN or less (such as llc_alloc_frame()), or skbs allocated before dynamic device/headroom changes (e.g. toggling VLAN_FLAG_REORDER_HDR or bo–0.2%2026-10-18Fix
CVE-2026-98553In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi->pipe file reference leak in autofs_kill_sb() When autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for example, when find_get_pid() fails on an invalid pgrp mount option, or when an fs_context is cl–0.2%2026-10-18Fix
CVE-2026-98552Linux kernel perf/core resource leak–0.2%2026-10-18Fix
CVE-2026-98551In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perf_clear_branch_entry_bitfields() clears the bitfields of struct perf_branch_entry one by one and leaves from/to alone, since callers overwrite those straight away. The lis–0.2%2026-10-18Fix
CVE-2026-98550In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow Commit 48a5fe38772b ("tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG") rejected duplicate/stale ACKs in tipc_group_proto_rcv() by returning ear–0.2%2026-10-18Fix
CVE-2026-98549In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on tcp_write_queue_tail(sk) to prevent skbs queued after a switch to device encryption from being collapsed into ea–0.1%2026-10-18Fix
CVE-2026-98548In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary addresses, processing the ERROR–0.2%2026-10-18Fix
CVE-2026-98547Linux kernel af_packet integer overflow–0.2%2026-10-18Fix
CVE-2026-98546Linux kernel arm64/boot kernel panic–0.2%2026-10-18Fix
CVE-2026-98545In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata_scsi_set_passthru_sense_fields() trusts i–0.2%2026-10-18Fix
CVE-2026-98544In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer–0.2%2026-10-18Fix
CVE-2026-98543In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir bpf_lsm_has_d_inode_locked() makes the verifier rewrite bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume that the caller already holds–0.2%2026-10-18Fix
CVE-2026-98542In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict When a remote partition is created underneath an existing local partition via a non-partition (PRS_MEMBER) intermediate cgroup, update_p–0.2%2026-10-18Fix
CVE-2026-98541In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT Commit 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.") added NLA_POLICY_MIN(NLA_U8, 1) to fou_nl_policy[FOU_ATTR_IPPROTO], which rejects an explicitly supplied FOU–0.2%2026-10-18Fix
CVE-2026-98540In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraph_data list when the reservation is not filled fprobe_fgraph_entry() reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. fgraph_r–0.2%2026-10-18Fix
CVE-2026-98539In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga ntfs_create_inode() creates a new inode via ntfs_new_inode(). It hashes it with insert_inode_locked() and so it's marked a–0.2%2026-10-18Fix
CVE-2026-98538In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes cleanup_offline_cgwb() prepares at most WB_MAX_INODES_PER_ISW inodes per call and is called again until the dying wb is drained, but every call walks wb->b–0.2%2026-10-18Fix
CVE-2026-98537In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in flush dependency check check_flush_dependency() uses current_wq_worker() to determine whether the caller is a workqueue worker and then dereferences worker->current_pwq to test whether the–0.2%2026-10-18Fix
CVE-2026-98536In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling cleanup_offline_cgwb() until it returns false, with a cond_resched() between passes. On a CONFIG_PREE–0.2%2026-10-18Fix
CVE-2026-98535In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read_dts_node() of_clk_get() returns a clock with its reference count incremented, but read_dts_node() only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere,–0.2%2026-10-18Fix
CVE-2026-98534Linux kernel ipe use-after-free–0.2%2026-10-18Fix
CVE-2026-98533In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RC–0.2%2026-10-18Fix
CVE-2026-98532Linux kernel ipv6 use-after-free–0.2%2026-10-18Fix
CVE-2026-98531Linux kernel sr out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98530In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobe_sysctl_mutex held, s–0.2%2026-10-18Fix
CVE-2026-98529In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmap_update_bits() fails the re–0.2%2026-10-18Fix
CVE-2026-98528In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we return immediately before zeroing the info struct we'll end up passing to the user-space later–0.2%2026-10-18Fix
CVE-2026-98527In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and zynq_gpio_request() returns the error without dropping it. gpiolib does not call ->free() wh–0.2%2026-10-18Fix
CVE-2026-98526In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llc_alloc_frame() reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlan_dev_hard_header() pushes a–0.2%2026-10-18Fix
CVE-2026-98525In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() When a socket transmits a packet with MCTP_TAG_PREALLOC set, mctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list and matches netid, req_tag, pee–0.2%2026-10-18Fix
CVE-2026-98524Linux kernel ib local privilege escalation–0.2%2026-10-18Fix
CVE-2026-98523Linux kernel drm/client null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98522Linux kernel drm/imagination crash–0.2%2026-10-18Fix
CVE-2026-98521In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915_gem_busy_ioctl uses dma_resv_for_each_fence_unlocked() to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here–0.2%2026-10-18Fix
CVE-2026-98520Linux kernel drm/amdkfd use-after-free–0.2%2026-10-18Fix
CVE-2026-98519In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() amdgpu_debugfs_test_ib_show() resumes the device with pm_runtime_get_sync() before taking the reset domain semaphore with down_write_killable(). If the write lock a–0.2%2026-10-18Fix
CVE-2026-98518In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 ("gpu/drm/nouveau: enable THP support for GPU memory migration") grew the device-private region that nouveau_dmem_chunk_alloc() registers from DMEM_CHUN–0.2%2026-10-18Fix
CVE-2026-98517Linux kernel drm/nouveau/uvmm use-after-free–0.2%2026-10-18Fix
CVE-2026-98516In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1a_ram_new() pci_get_domain_bus_and_slot() takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference befo–0.2%2026-10-18Fix
CVE-2026-98515Linux kernel drm/nouveau double free–0.2%2026-10-18Fix
CVE-2026-98514In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate_init() On the ttm_bo_reserve() failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm_gem_ob–0.2%2026-10-18Fix
CVE-2026-98513In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() If nvif_outp_edid_get() fails, nouveau_connector_detect() returns early without dropping the runtime PM reference taken at the start of the function, keeping the devic–0.2%2026-10-18Fix
CVE-2026-98512In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveau_sched struct nouveau_sched embeds a struct drm_gpu_scheduler (base). nouveau_sched_destroy() calls nouveau_sched_fini() (which does drm_sched_fini(&sched->base)) and then free–0.2%2026-10-18Fix
CVE-2026-98511In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() nouveau_bo_pin_locked() checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible,–0.2%2026-10-18Fix
CVE-2026-98510In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously–0.2%2026-10-18Fix
CVE-2026-98509Linux kernel drm/virtio memory leak–0.2%2026-10-18Fix
CVE-2026-98508Linux kernel drm/virtio null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98507In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish On arm64 server, we find that a task trying to grab the anon_vma lock triggers hungtask. INFO: task main:2354726 blocked for more than 120 seconds.–0.2%2026-10-18Fix
CVE-2026-98506In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_folio()/ update_and_free_hugetlb_folio() silently bail for such–0.2%2026-10-18Fix
CVE-2026-98505In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() damon_hugetlb_mkold() reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the up–0.2%2026-10-18Fix
CVE-2026-98504Linux kernel of_property null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98503In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion for TX_RING packets tpacket_snd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called. A call to skb_orphan calls skb->destructor before the skb is–0.2%2026-10-18Fix
CVE-2026-98502In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove hand–0.2%2026-10-18Fix
CVE-2026-98501Linux kernel alps use-after-free–0.2%2026-10-18Fix
CVE-2026-98500In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed_work_sync() in remove oxp_hid_remove() uses cancel_delayed_work() for all three delayed work items. cancel_delayed_work() only dequeues a pending work item without waiting for a currently executin–0.2%2026-10-18Fix
CVE-2026-98499Linux kernel wacom out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98498In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() When the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() i–0.2%2026-10-18Fix
CVE-2026-98497In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5e_ipsec_policy_mask() builds the corresponding masks independently, but setup_fte_addr6() installs each–0.2%2026-10-18Fix
CVE-2026-98496In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq() and is freed only after .–0.2%2026-10-18Fix
CVE-2026-98495Linux kernel arp out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98494In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): the hardware can report an out-of-range–0.2%2026-10-18Fix
CVE-2026-98493In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-I–0.2%2026-10-18Fix
CVE-2026-98492In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths Fix 3 leaks in macb_alloc() error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer alloca–0.2%2026-10-18Fix
CVE-2026-98491Linux kernel conntrack use-after-free–0.2%2026-10-18Fix
CVE-2026-98490Linux kernel conntrack use-after-free–0.2%2026-10-18Fix
CVE-2026-98489In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would–0.2%2026-10-18Fix
CVE-2026-98488In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): the hardware can report an out-of-range hw_n–0.2%2026-10-18Fix
CVE-2026-98487Linux kernel mdb use-after-free–0.2%2026-10-18Fix
CVE-2026-98486In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena_device_init() initializes the MMIO read mechanism with ena_com_mmio_reg_read_request_init(), which allocates a coherent DMA buffer for MMIO read responses. The normal remov–0.2%2026-10-18Fix
CVE-2026-98485Linux kernel ip6t_rt out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98484In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip expired catchall elements on insert and delete nft_setelem_catchall_insert() looks up duplicates with nft_set_elem_active() only, while nft_set_catchall_lookup() and the dump path additionally skip expir–0.2%2026-10-18Fix
CVE-2026-98483Linux kernel nfc use-after-free–0.2%2026-10-18Fix
CVE-2026-98482Linux kernel llcp uninitialized memory use–0.2%2026-10-18Fix
CVE-2026-98481In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. d–0.2%2026-10-18Fix
CVE-2026-98480In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970a_startup() powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's un–0.2%2026-10-18Fix
CVE-2026-98479In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the co–0.2%2026-10-18Fix
CVE-2026-98478In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") switched UFS internal commands to allocate requests on hba->host->pseudo_sdev->r–0.2%2026-10-18Fix
CVE-2026-98477Linux kernel perf/core null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98476Linux kernel s390/cio null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98475In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_t to enable automatic detection of incorrect assignments. Also–0.2%2026-10-18Fix
CVE-2026-98474In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpci_report_status() When pdev is non-NULL, zpci_report_status() accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expand–0.2%2026-10-18Fix
CVE-2026-98473In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned–0.2%2026-10-18Fix
CVE-2026-98472Linux kernel SEV use-after-free–0.2%2026-10-18Fix
CVE-2026-98471In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed.–0.2%2026-10-18Fix
CVE-2026-98470In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvm_pkvm_ioctl_allowed() WARNs when kvm_get_cap_for_kvm_ioctl() doesn't find the ioctl number in vm_ioctl_caps[], and kvm_arch_vm_ioctl() calls it for every number th–0.2%2026-10-18Fix
CVE-2026-98469In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR handling The consolidation of the breakpoint and watchpoint register accessors switched DBGBXVR from trap_bvr() to trap_dbg_wb_reg(). The latter selects backing storage with demux_wb_reg(), which on–0.2%2026-10-18Fix
CVE-2026-98468In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all o–0.2%2026-10-18Fix
CVE-2026-98467Linux kernel nv null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98466In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none.–0.2%2026-10-18Fix
CVE-2026-98465In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVM_RUN. As a result, kvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concu–0.2%2026-10-18Fix
CVE-2026-98464In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU. If teardown observes next_set as false while the callback is still running, kvm_–0.2%2026-10-18Fix
CVE-2026-98463In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags schedule_deferred_locked() skips scheduling a deferred action while SCX_RQ_IN_WAKEUP is set and relies on the task_woken_scx() call that follows a wakeup enqueue to ru–0.2%2026-10-18Fix
CVE-2026-98462In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix CIS hold ownership on reuse Commit 69997d50ec57 ("Bluetooth: ISO: handle bound CIS cleanup via hci_conn") made hci_bind_cis() and hci_connect_cis() return a connection with one hold for the ISO layer. hci–0.2%2026-10-18Fix
CVE-2026-98461Linux kernel hci_sock out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98460In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi–0.2%2026-10-18Fix
CVE-2026-98459In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational hold on the child. hci_conn_unlink() later balances both a hold–0.2%2026-10-18Fix
CVE-2026-98458In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn–0.2%2026-10-18Fix
CVE-2026-98457Linux kernel L2CAP out-of-bounds read–0.2%2026-10-18Fix
CVE-2026-98456Linux kernel mgmt out-of-bounds write–0.2%2026-10-18Fix
CVE-2026-98455Linux kernel RFCOMM null pointer dereference–0.2%2026-10-18Fix
CVE-2026-98454In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose b–0.2%2026-10-18Fix
CVE-2026-98453In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_o–0.2%2026-10-18Fix
CVE-2026-98452In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so commo–0.2%2026-10-18Fix
CVE-2026-98451In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no C–0.2%2026-10-18Fix
CVE-2026-98450In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already–0.2%2026-10-18Fix
CVE-2026-98449In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server wi–0.2%2026-10-18Fix
CVE-2026-98448In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that.–0.2%2026-10-18Fix
CVE-2026-98447Linux kernel xfs memory corruption–0.2%2026-10-18Fix
CVE-2026-98446In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go negative in xfs_metafile_resv_init LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hidden_space–0.2%2026-10-18Fix
CVE-2026-98445In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrep_newbt_add_blocks results in online repair leaking blocks that were previously allocated to write a new btree, but–0.2%2026-10-18Fix
CVE-2026-98444In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is–0.2%2026-10-18Fix
CVE-2026-98443Linux kernel xfs use-after-free–0.2%2026-10-18Fix
CVE-2026-98442Linux kernel act_ct use-after-free–0.2%2026-10-18Fix
CVE-2026-98441Linux kernel act_ct use-after-free–0.2%2026-10-18Fix
CVE-2026-98440In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callbac–0.2%2026-10-18Fix
CVE-2026-98439In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis–0.1%2026-10-18Fix
CVE-2026-98438In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcp_write_data_fin When sending a DATA_FIN without data, and because the DATA_FIN occupies 1 octet of the connection-level sequence space [1], it is then required to add a DSS mapping with spe–0.1%2026-10-18Fix
CVE-2026-98437In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pm_runtime_resume_and_get() in iris_enable_power_domains() to avoid leaking a runtime PM usage count on failure. Also ensure pm_runtime_put_sync() is always called in iris_dis–0.2%2026-10-18Fix
CVE-2026-98436In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly.–0.1%2026-10-18Fix
CVE-2026-98435In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altr_portb_setup() Anchor the devres group and the devm-managed IRQ requests in altr_portb_setup() to the actual parent device (device->edac->dev) instead of the embedded struct device–0.2%2026-10-18Fix
CVE-2026-98434In the Linux kernel, the following vulnerability has been resolved: sysctl: Check range in proc_dointvec_ms_jiffies_minmax Add the range check to do_proc_int_conv_ms_jiffies_minmax that commit d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions") incorrectly removed.–0.1%2026-10-18Fix
CVE-2026-98433In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released. kvmppc_uvmem_get_page(–0.2%2026-10-18Fix
CVE-2026-97859Gitea API disclosure of private user social graph, keys and stars6.5CISA ADP v3.10.2%2026-10-18Fix
CVE-2026-97204Gitea label deletion across repository and organization IDs3.1CISA ADP v3.10.2%2026-10-18Fix
CVE-2026-96534Modern Events Calendar (Lite and Pro) WordPress plugin Subscriber+ SQLi via mec_fes_csv_export7.7CISA ADP v3.10.2%2026-10-18Fix
CVE-2026-87844Product Designer WordPress plugin unauthenticated Design Template data injection5.3CISA ADP v3.10.2%2026-10-18
CVE-2026-78497Perl JQ::Lite eval injection8.4CISA ADP v3.10.2%2026-10-18Fix
CVE-2026-111934Coder IP spoofing via X-Forwarded-For header6.3CNA v4.00.1%2026-10-17Fix
CVE-2026-111933coder observable discrepancy6.3CNA v4.00.2%2026-10-17Fix
CVE-2026-111932Coder Stored HTML injection via Appearance settings4.8CNA v4.00.2%2026-10-17Fix
CVE-2026-111931Coder open redirect via Workspace App Proxy5.3CNA v4.00.2%2026-10-17Fix
CVE-2026-111930Coder from information disclosure via Workspace ACL endpoint5.3CNA v4.00.2%2026-10-17Fix
CVE-2026-111929Coder Cross-Organization File Disclosure via DownloadFile RPC6.0CNA v4.00.2%2026-10-17Fix
CVE-2026-111928Coder authorization bypass via User-Level ACL in RBAC Policy5.3CNA v4.00.1%2026-10-17Fix
CVE-2026-111927Coder Credential Theft via Workspace Proxy Hostname Prefix Match8.7CNA v4.00.2%2026-10-17Fix
CVE-2026-111926Coder from information disclosure via agent /debug/manifest4.8CNA v4.00.1%2026-10-17Fix
CVE-2026-111924Fleet denial of service via Unbounded Gzip Decompression8.7CNA v4.00.4%2026-10-17Fix
CVE-2026-111923Fleet Unauthenticated DoS via Apple MDM Enrollment Plist Parsing8.7CNA v4.00.4%2026-10-17Fix
CVE-2026-111922Vikunja Permissive CORS Policy Trusting Localhost Origins7.2CNA v4.00.1%2026-10-17Fix
CVE-2026-111921Vikunja incorrect authorization in Link Share Deletion5.3CNA v4.00.2%2026-10-17Fix
CVE-2026-111920Vikunja broken access control via Inherited Project Permissions5.3CNA v4.00.2%2026-10-17
CVE-2026-111919Vikunja Improper Access Revocation via Webhooks7.1CNA v4.00.3%2026-10-17Fix
CVE-2026-111918Vikunja Cross-Tenant Task Position Writes via Saved Filter Creation5.3CNA v4.00.2%2026-10-17Fix
CVE-2026-111917Vikunja WebSocket Authentication Ignores Session Revocation7.1CNA v4.00.3%2026-10-17Fix
CVE-2026-111916Admidio information disclosure via rss/links.php Weblinks Feed6.9CNA v4.00.3%2026-10-17Fix
CVE-2026-111914Admidio broken access control via inventory_data.php7.1CNA v4.00.2%2026-10-17Fix
CVE-2026-111913Admidio authorization bypass via pdfl Mode in lists_show.php5.3CNA v4.00.2%2026-10-17Fix
CVE-2026-111912Admidio IDOR via Forum Topic Update7.1CNA v4.00.2%2026-10-17Fix
CVE-2026-111911phpMyFAQ authentication bypass via WebAuthn Credential injection9.3CNA v4.00.4%2026-10-17Fix
CVE-2026-111910phpMyFAQ and authorization bypass via attachment.php Downloads7.1CNA v4.00.2%2026-10-17Fix
CVE-2026-111909phpMyFAQ missing authorization allows Superadmin Deletion via deleteUser API7.2CNA v4.00.3%2026-10-17Fix
CVE-2026-111908phpMyFAQ and BOLA in FAQ Update via REST API8.7CNA v4.00.3%2026-10-17Fix
CVE-2026-111907phpMyFAQ CSRF via /admin/API/update-database7.1CNA v4.00.1%2026-10-17Fix
CVE-2026-111906phpMyFAQ and CSRF in Elasticsearch/OpenSearch Admin API Index Operations7.1CNA v4.00.1%2026-10-17Fix
CVE-2026-111905phpMyFAQ and IDOR leaks TOTP secret via /admin/API/user/data7.0CNA v4.00.3%2026-10-17Fix
CVE-2026-111904phpMyFAQ information disclosure via open-questions API6.9CNA v4.00.3%2026-10-17Fix
CVE-2026-111903phpMyFAQ stored XSS via SVG DTD Entity Bypass5.1CNA v4.00.2%2026-10-17Fix
CVE-2026-111902phpMyFAQ authorization bypass via Comments and Attachments API6.9CNA v4.00.3%2026-10-17Fix
CVE-2026-111901phpMyFAQ unauthenticated DoS via API Pagination8.7CNA v4.00.3%2026-10-17Fix
CVE-2026-111900phpMyFAQ and Draft FAQ Attachment Disclosure via attachment.php5.3CNA v4.00.2%2026-10-17Fix
CVE-2026-111898phpMyFAQ account takeover via Keycloak Implicit Account Linking7.7CNA v4.00.3%2026-10-17Fix
CVE-2026-111897phpMyFAQ authorization bypass in Attachment Administration endpoints7.1CNA v4.00.3%2026-10-17Fix
CVE-2026-111896phpMyFAQ stored XSS via SVG Upload Sanitizer Bypass5.1CNA v4.00.2%2026-10-17Fix
CVE-2026-111895phpMyFAQ and account takeover via Entra ID preferred_username7.6CNA v4.00.3%2026-10-17Fix
CVE-2026-111894phpMyFAQ and stored XSS via iframe data: URI5.1CNA v4.00.2%2026-10-17Fix
CVE-2026-111893phpMyFAQ privilege escalation via Group Category Restrictions API8.5CNA v4.00.3%2026-10-17Fix
CVE-2026-111892phpMyFAQ Missing Rate Limiting on Password-Reset endpoints6.9CNA v4.00.3%2026-10-17Fix
CVE-2026-111891phpMyFAQ from privilege escalation via Group Permissions API7.0CNA v4.00.2%2026-10-17Fix
CVE-2026-111890phpMyFAQ privilege escalation via updateUserRights7.0CNA v4.00.2%2026-10-17Fix
CVE-2026-111889phpMyFAQ and missing authorization via Admin Dashboard5.3CNA v4.00.2%2026-10-17Fix
CVE-2026-111888phpMyFAQ incorrect authorization via news update API5.1CNA v4.00.2%2026-10-17Fix
CVE-2026-111887phpMyFAQ and Account Enumeration via Guest Comment endpoint6.9CNA v4.00.3%2026-10-17Fix
CVE-2026-111886phpMyFAQ 2FA brute-force via remove-twofactor endpoint7.1CNA v4.00.2%2026-10-17Fix
CVE-2026-111885phpMyFAQ missing authorization via deleteGroup API7.0CNA v4.00.3%2026-10-17Fix
CVE-2026-111884phpMyFAQ and Missing Current-Password Step-Up on E-mail Change enables account takeover8.7CNA v4.00.3%2026-10-17Fix
CVE-2026-111882phpMyFAQ and TOTP 2FA Bypass via SSO Callbacks8.6CNA v4.00.4%2026-10-17Fix
CVE-2026-111881FreeRDP integer underflow in BMP Writer via Clipboard7.2CNA v4.00.2%2026-10-17Fix
CVE-2026-111880FreeRDP heap out-of-bounds write via NTLM MIC Offset8.3CNA v4.00.3%2026-10-17Fix
CVE-2026-111866nemoTyrant manong func.php arr2sql SQL injection6.9CNA v4.00.4%2026-10-17
CVE-2026-111865THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection4.8CNA v4.00.1%2026-10-17
CVE-2026-111855Tektronix 3 Series MDO path traversal7.5CNA v3.10.5%2026-10-17Fix
CVE-2026-111854Tektronix 3 Series MDO path traversal8.1CNA v3.10.4%2026-10-17Fix
CVE-2026-111853Tektronix 3 Series MDO OS command injection8.8CNA v3.10.9%2026-10-17Fix
CVE-2026-111726Themify Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-17Fix
CVE-2026-111602Appointment Booking WordPress plugin unauthenticated sensitive information disclosure3.7CNA v3.10.3%2026-10-17Fix
CVE-2026-111601Hippoo Mobile App for WooCommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2026-10-17Fix
CVE-2026-111110Payment forms WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2026-10-17Fix
CVE-2026-110889Gantry 5 Framework WordPress plugin sensitive data exposure7.5CNA v3.10.3%2026-10-17Fix
CVE-2026-110882SMS Alert Order Notifications WordPress plugin broken access control4.3CNA v3.10.2%2026-10-17Fix
CVE-2026-110653Appointment Booking WordPress plugin unauthenticated authentication bypass9.1CNA v3.10.4%2026-10-17Fix
CVE-2026-110527WP User Manager - Unauthenticated Account Creation via Stripe Registration Payment Bypass5.3CISA ADP v3.10.2%2026-10-17Fix
CVE-2026-110384Fancy Comments WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-17
CVE-2026-110268Post Export Import with Media WordPress plugin path traversal4.9CNA v3.10.8%2026-10-17Fix
CVE-2026-110253weForms WordPress plugin unauthenticated limited Media file deletion via wpuf_files parameter5.4CNA v3.10.3%2026-10-17Fix
CVE-2026-109989Themify Popup WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-17Fix
CVE-2026-109985The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authen6.4CNA v3.10.2%2026-10-17Fix
CVE-2026-109983YMC Filter WordPress plugin stored DOM-based cross-site scripting6.4CNA v3.10.2%2026-10-17Fix
CVE-2026-109701PAYCOMET for WooCommerce WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-17Fix
CVE-2026-109369WP Booking System WordPress plugin missing authorization authenticated privilege escalation6.8CNA v3.10.3%2026-10-17Fix
CVE-2026-109368WP Booking System WordPress plugin information disclosure6.5CNA v3.10.3%2026-10-17Fix
CVE-2026-109208LearnPress WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-17Fix
CVE-2026-108123WP Booking System WordPress plugin authorization bypass7.5CNA v3.10.3%2026-10-17Fix
CVE-2026-107763Fastcache by Host.it WordPress plugin authorization bypass4.3CNA v3.10.2%2026-10-17Fix
CVE-2026-107762Kirki WordPress plugin insecure direct object reference7.5CNA v3.10.4%2026-10-17Fix
CVE-2026-107752Welcart e-Commerce WordPress plugin SQL injection4.9CNA v3.10.3%2026-10-17Fix
CVE-2026-107744LearnPress WordPress plugin missing authorization authenticated email Address enumeration6.5CNA v3.10.3%2026-10-17Fix
CVE-2026-106470WP Data Access for WordPress Subscriber+ SSRF5.0CISA ADP v3.10.1%2026-10-17Fix
CVE-2026-104736LearnPress WordPress plugin unauthenticated PHP object injection via checkout-email parameter9.8CNA v3.10.4%2026-10-17Reported exploitedExploit codeFix
CVE-2026-104734Kirki WordPress plugin PHP object injection7.2CNA v3.10.5%2026-10-17Fix
CVE-2026-104246Contact Form 7 Signature Addon for WordPress unauthenticated arbitrary file read5.9CISA ADP v3.10.3%2026-10-17
CVE-2026-104122Ukr-To-Lat for WordPress Contributor+ SQLi via Term Name6.8CISA ADP v3.10.2%2026-10-17
CVE-2026-103899EU VAT Assistant for WooCommerce WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-17Fix
CVE-2026-103376PeachPay - unauthenticated order key disclosure via ConvesioPay BTCPay Status Check5.3CISA ADP v3.10.2%2026-10-17Fix
CVE-2026-100316European VAT Compliance Assistant for WooCommerce WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2026-10-17Fix
CVE-2026-97314ThirstyAffiliates WordPress plugin information disclosure6.5CISA ADP v3.10.2%2026-10-17Fix
CVE-2026-96660User Registration and Membership WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-17Fix
CVE-2026-92978User Registration and Membership WordPress plugin cross-site request forgery to trigger_bulk_action4.3CNA v3.10.2%2026-10-17Fix
CVE-2026-92798wpeverest User Registration and Membership UR_Smart_Tags::process code injection8.1CNA v3.10.4%2026-10-17Fix
CVE-2026-92715Tutor LMS WordPress plugin insecure direct object reference4.3CNA v3.10.2%2026-10-17Fix
CVE-2026-92433Patreon WordPress plugin Patreon Integration takeover via CSRF6.5CISA ADP v3.10.1%2026-10-17Fix
CVE-2026-92432Patreon WordPress plugin open redirect via state parameter4.3CISA ADP v3.10.2%2026-10-17Fix
CVE-2026-92431Patreon WordPress plugin unauthenticated Taxonomy and Term enumeration3.7CISA ADP v3.10.2%2026-10-17Fix
CVE-2026-91074BSK PDF Manager WordPress plugin Contributor+ SQLi via tags_specific shortcode attribute6.8CISA ADP v3.10.2%2026-10-17
CVE-2026-81344Frontend Admin by DynamiApps WordPress plugin Admin+ PHP object injection6.6CISA ADP v3.10.4%2026-10-17Fix
CVE-2026-81343DynamiApps ACF Frontend Admin form-submission action vulnerability5.3CISA ADP v3.10.2%2026-10-17Fix
CVE-2026-111823mage-ai OAuth provider vulnerability9.8CNA v3.10.4%2026-10-16Exploit code
CVE-2026-111802Red Hat Enterprise Linux 10 nautilus: Nautilus: Arbitrary file deletion via trash symlink6.6CNA v3.10.1%2026-10-16
CVE-2026-111793Openwave Messaging (Ireland) Webtop Media Transcoder incorrect resource transfer4.3CNA v3.10.2%2026-10-16Fix
CVE-2026-111728Seanime argument injection via TranscodeHwAccelCustomSettings5.3CNA v4.00.3%2026-10-16Fix
CVE-2026-111723LingGuo-Drama through commit 8a6924a broken access control via /admin/v1/admins API8.7CNA v4.00.3%2026-10-16
CVE-2026-111722LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API8.6CNA v4.00.3%2026-10-16
CVE-2026-111721jingsewu open-wes open WES broken access control via GlobalGatewayFilter Warehouse Scoping5.3CNA v4.00.2%2026-10-16
CVE-2026-111720fish-island-backend through commit 7c61b78 SSRF via /API/web/parse6.9CNA v4.00.3%2026-10-16
CVE-2026-111719Roncoo-pay through commit 9428382 information disclosure via /f2fPay/order/query8.2CNA v4.00.3%2026-10-16
CVE-2026-111718AipexBase through commit 690adb9 SQL injection via /API/data/invoke7.1CNA v4.00.3%2026-10-16
CVE-2026-111717Arkon missing authorization via Skills Versions API5.3CNA v4.00.3%2026-10-16
CVE-2026-111716Arkon broken access control via Sources By-ID Routes5.3CNA v4.00.2%2026-10-16
CVE-2026-111715Arkon missing authorization via Wiki Graph Neighborhood API5.3CNA v4.00.2%2026-10-16
CVE-2026-111714tarteaucitron.js ReDoS via Unescaped Cookie Name in cookie.purge2.3CNA v4.00.2%2026-10-16Fix
CVE-2026-111713tarteaucitron.js XSS via getElemAttr Attribute Validation Mismatch5.1CNA v4.00.2%2026-10-16Fix
CVE-2026-111712Netcore NR256CN authentication bypass via CGI Path Prefix6.9CNA v4.00.2%2026-10-16
CVE-2026-111711Netcore NR256CN Pre-Auth stack overflow via Boa user_ok9.3CNA v4.00.5%2026-10-16
CVE-2026-111710Netcore NR256CN Boa Web Server null pointer dereference DoS8.7CNA v4.00.3%2026-10-16
CVE-2026-111709canove WhaTicket Community ShowTicketService insecure direct object reference5.3CNA v4.00.2%2026-10-16
CVE-2026-111708canove WhaTicket Community /auth/signup authentication bypass9.3CNA v4.00.6%2026-10-16
CVE-2026-11170799AI IDOR via /API/chatLog/querySingleChat Chat Message Disclosure6.9CNA v4.00.3%2026-10-16
CVE-2026-11170699AI unauthenticated information disclosure via chatLog exportExcel8.7CNA v4.00.3%2026-10-16
CVE-2026-111705Fuint through commit 57ec018 IDOR via bookId in myBookDetail5.3CNA v4.00.2%2026-10-16
CVE-2026-111704LangChat through commit 2a6285a missing authentication on REST API Controllers9.3CNA v4.00.5%2026-10-16
CVE-2026-111703guchengwuyue yshop-crm CRM customer by-id endpoints insecure direct object reference5.3CNA v4.00.2%2026-10-16
CVE-2026-111702sugarforever chat-ollama ChatOllama through commit 96c3ce5 IDOR exposes Private Knowledge Bases8.7CNA v4.00.4%2026-10-16
CVE-2026-111701OtterMind Nubase missing authentication in Storage Object API8.3CNA v4.00.3%2026-10-16
CVE-2026-111700WebVella ERP SQL injection via EQL Query API7.1CNA v4.00.2%2026-10-16
CVE-2026-111699Niefy wx-api authentication bypass via Unverified openid Cookie6.3CNA v4.00.3%2026-10-16
CVE-2026-111698roinli HUIZHI-ChargeOS-cloud HUIZHI ChargeOS cloud Unpaid Wallet Credit via /pay/xcxRecharge7.1CNA v4.00.3%2026-10-16
CVE-2026-111697roinli HUIZHI-ChargeOS-cloud HUIZHI ChargeOS cloud IDOR via hcp-mp Member and Order APIs7.1CNA v4.00.4%2026-10-16
CVE-2026-111696data-platform-open through commit efeacd3 Hard-coded AES Key for Datasource Passwords7.1CNA v4.00.3%2026-10-16
CVE-2026-111695Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API7.1CNA v4.00.3%2026-10-16
CVE-2026-111694qKnow missing authentication via /flyflow Workflow endpoints6.9CNA v4.00.4%2026-10-16
CVE-2026-111693DataBuff ai-apm-web Hard-Coded Default Admin Credentials9.3CNA v4.00.4%2026-10-16
CVE-2026-111692DataBuff ai-apm-web authentication bypass via Hard-coded HMAC Secret9.3CNA v4.00.6%2026-10-16
CVE-2026-111691WIMOOR through commit ec86736 authentication bypass via Forged X-USERINFO header9.1CNA v4.00.4%2026-10-16
CVE-2026-111690suyuan32 simple-admin-core Simple Admin Core Hard-Coded JWT Secret authentication bypass9.3CNA v4.00.4%2026-10-16
CVE-2026-111689XBoot authorization bypass via getByDepartmentId endpoint5.3CNA v4.00.3%2026-10-16
CVE-2026-111688Exrick XBoot Data-Scope Bypass via openDataFilter parameter5.3CNA v4.00.3%2026-10-16
CVE-2026-111687WeRSS (we-mp-rss) RCE via template parameter in /rss endpoint9.3CNA v4.01.0%2026-10-16
CVE-2026-111686IceCMS SQL injection via /WebArticle/findarticlesbynum8.7CNA v4.00.4%2026-10-16
CVE-2026-111685IceCMS SQL injection via /WebResource/findresourcebynum8.7CNA v4.00.4%2026-10-16
CVE-2026-111684Magistrala Cross-Tenant authorization bypass in Certs service7.2CNA v4.00.2%2026-10-16
CVE-2026-111683Allegro Ralph missing authorization in Data Center Rack API5.3CNA v4.00.2%2026-10-16
CVE-2026-111682EFAK missing authorization via /API/model-config exposes API Keys7.1CNA v4.00.4%2026-10-16
CVE-2026-111681EFAK privilege escalation via /API/users REST API8.7CNA v4.00.3%2026-10-16
CVE-2026-111680APIPark Cross-Team authorization bypass via Team Query parameter7.2CNA v4.00.3%2026-10-16
CVE-2026-111679EKKOLearnAI ekko-studio ekko Studio missing authorization via /API/auth/locked-ips5.3CNA v4.00.2%2026-10-16
CVE-2026-111678Antiword Stack out-of-bounds read via prop8.c FKP Parsing4.8CNA v4.00.2%2026-10-16
CVE-2026-111677Antiword Heap out-of-bounds read via vGet8LstInfo in prop8.c6.8CNA v4.00.2%2026-10-16
CVE-2026-111676Faveo Helpdesk /ticket/tooltip endpoint broken access control5.3CNA v4.00.3%2026-10-16
CVE-2026-111675Course-tencent-cloud Verification Code brute force account takeover9.1CNA v4.00.4%2026-10-16
CVE-2026-111674Tbed missing authorization via setImgFileName endpoint5.3CNA v4.00.2%2026-10-16
CVE-2026-111673IceCMS missing authentication via /User Administrative endpoints9.3CNA v4.00.6%2026-10-16
CVE-2026-111672Cube-studio IDOR via Pipeline view and Copy endpoints5.3CNA v4.00.3%2026-10-16
CVE-2026-111671Cube-studio IDOR via Notebook and Serving Lifecycle endpoints7.1CNA v4.00.3%2026-10-16
CVE-2026-111670ClickVisual missing authorization in apiv2 Report module5.3CNA v4.00.3%2026-10-16
CVE-2026-111669ZR.Admin.NET SQL injection via PagerInfo.Sort ORDER BY7.1CNA v4.00.3%2026-10-16
CVE-2026-111668AIHelms missing authorization in Efficiency Analytics API5.3CNA v4.00.2%2026-10-16
CVE-2026-111667REBUILD missing authorization via /project/comments/list endpoint5.3CNA v4.00.3%2026-10-16
CVE-2026-111666Steedos Platform Cross-Tenant information disclosure via Reports API5.3CNA v4.00.3%2026-10-16
CVE-2026-111665Piranha CMS missing authorization in Manager Language API5.3CNA v4.00.3%2026-10-16
CVE-2026-111664Safing Portmaster Unauthenticated Forced Downgrade via /API/v1/updates/from-url4.8CNA v4.00.1%2026-10-16Fix
CVE-2026-111663Chaskiq SSRF via createUrlUpload GraphQL Mutation9.2CNA v4.00.3%2026-10-16
CVE-2026-111662Chaskiq Unauthenticated SSRF via /oembed endpoint6.9CNA v4.00.4%2026-10-16
CVE-2026-111661waynboot-mall missing authentication via /callback/email Mail endpoint6.9CNA v4.00.4%2026-10-16
CVE-2026-111660waynboot-mall missing authentication via /callback/order/unpaid6.9CNA v4.00.4%2026-10-16
CVE-2026-111659Waynboot-mall Unauthenticated Order Forgery via /callback/order/submit6.9CNA v4.00.3%2026-10-16
CVE-2026-111658SiteServer SSCMS Cross-site authorization bypass via Channels API5.1CNA v4.00.3%2026-10-16
CVE-2026-111657BeikeShop IDOR via RMA mark_as_shipped endpoint5.3CNA v4.00.3%2026-10-16
CVE-2026-111656ChatWiki Cross-Tenant IDOR via Form Filter Management endpoints5.3CNA v4.00.2%2026-10-16
CVE-2026-111655ThinkAdmin think-plugs-admin IDOR via admin/file.edit5.1CNA v4.00.2%2026-10-16
CVE-2026-111654FastBee IDOR via /iot/group By-ID endpoints5.3CNA v4.00.3%2026-10-16
CVE-2026-11165353AIHub missing authentication via PUT /API/enterprises/:id6.9CNA v4.00.4%2026-10-16
CVE-2026-111652Engineercms missing authorization via AttachController.Attachment6.9CNA v4.00.4%2026-10-16
CVE-2026-111651Risesoft Digital-Infrastructure Cross-Tenant data exposure via DownloadController7.1CNA v4.00.3%2026-10-16
CVE-2026-111650ChronoFrame missing authentication via Setup Wizard API8.8CNA v4.00.3%2026-10-16
CVE-2026-111649Rocboss paopao-ce IDOR via DownloadAttachment endpoint7.1CNA v4.00.3%2026-10-16
CVE-2026-111648BuildAdmin IDOR via routine/adminInfo/edit id parameter5.1CNA v4.00.3%2026-10-16
CVE-2026-111647PickMall lilishop ReceiptServiceImpl insecure direct object reference5.3CNA v4.00.3%2026-10-16
CVE-2026-111646SurveyKing Unauthenticated File Download via /API/public/preview8.2CNA v4.00.4%2026-10-16Fix
CVE-2026-111645MrDoc missing authorization via API/import_local_doc/ endpoint5.3CNA v4.00.2%2026-10-16
CVE-2026-111644l429609201 misaka_danmu_server Misaka Danmu Server missing authentication on /API/UI Routes6.9CNA v4.00.4%2026-10-16
CVE-2026-111643l429609201 misaka_danmu_server Misaka Danmu Server authentication bypass via Config-History Rollback9.3CNA v4.00.4%2026-10-16
CVE-2026-111642FastapiAdmin Hard-Coded JWT Secret privilege escalation8.7CNA v4.00.4%2026-10-16
CVE-2026-111641FastapiAdmin authentication bypass via Auto-Login endpoints9.3CNA v4.00.4%2026-10-16
CVE-2026-111640DooTask missing authorization in OKR Comment Dialogs5.3CNA v4.00.2%2026-10-16
CVE-2026-111639bbs-go account takeover via Google One Tap Login8.6CNA v4.00.4%2026-10-16
CVE-2026-111638sshportal missing authorization in key show command exposes Private Keys8.3CNA v4.00.3%2026-10-16
CVE-2026-111637NexoPOS Unauthenticated Transaction Disclosure via /API/fields endpoint6.9CNA v4.00.5%2026-10-16
CVE-2026-111636OpenBMB StaffDeck authentication bypass via Hard-Coded Session Secret9.2CNA v4.00.4%2026-10-16
CVE-2026-111635helicalinsight helical Insight path traversal via /getExternalResource5.3CNA v4.00.3%2026-10-16
CVE-2026-111634helicalinsight Helical Insight SQL injection via /executeDatasource8.6CNA v4.00.3%2026-10-16
CVE-2026-111633ZKEACMS authentication bypass via Hard-Coded JWT Signing Key8.8CNA v4.00.3%2026-10-16
CVE-2026-111632aureuserp aureus ERP Multi-Company authorization bypass via company_id5.3CNA v4.00.3%2026-10-16
CVE-2026-111631Distributor missing authorization in External Connection AJAX Actions5.3CNA v4.00.2%2026-10-16Fix
CVE-2026-111630abp-next-admin IDOR in AIManagement Chat Conversations5.3CNA v4.00.2%2026-10-16
CVE-2026-111629IoTSharp Cross-Tenant data exposure via Customers and Devices APIs5.3CNA v4.00.3%2026-10-16
CVE-2026-11162810up Distributor PHP object injection via set_meta2.3CNA v4.00.3%2026-10-16Fix
CVE-2026-111627HestiaCP Protected Admin Bypass via Cron Job Creation8.6CNA v4.00.6%2026-10-16Fix
CVE-2026-111626Webreaper Damselfly missing authentication on REST API Controllers9.3CNA v4.00.4%2026-10-16
CVE-2026-11162510up Distributor missing authorization via dt_push AJAX action5.3CNA v4.00.2%2026-10-16Fix
CVE-2026-111624Umbraco CMS and missing authorization on SignalR Hubs6.3CNA v4.00.3%2026-10-16Fix
CVE-2026-111623Xiaozhi-esp32-server-java authentication bypass via OTA Endpoint Token Issuance6.3CNA v4.00.4%2026-10-16
CVE-2026-111622Smart-SSO OAuth2 Authorization Code Theft via Unvalidated redirectUri7.6CNA v4.00.4%2026-10-16
CVE-2026-111621TDuckCloud tduck-survey-form missing authorization5.3CNA v4.00.3%2026-10-16
CVE-2026-111620O2OA Cross-Work Attachment Read via Attachment Download endpoint6.0CNA v4.00.3%2026-10-16
CVE-2026-111619FilePress SQL injection via asc parameter in filelist.php7.1CNA v4.00.3%2026-10-16
CVE-2026-111618CoAI unauthenticated path traversal via Archive Download endpoints6.9CNA v4.00.4%2026-10-16
CVE-2026-111617WHartTest missing authentication on UI-Automation WebSocket endpoints6.9CNA v4.00.4%2026-10-16
CVE-2026-111616Oqtane Framework Cross-Site Settings Disclosure via Setting API6.9CNA v4.00.3%2026-10-16
CVE-2026-111615Mall4cloud IDOR Exposing Buyer Addresses via order_addr endpoint7.1CNA v4.00.3%2026-10-16
CVE-2026-111614DataCap IDOR via BaseController.getInfoForPath exposes Credentials7.1CNA v4.00.3%2026-10-16
CVE-2026-111613AllData Unauthenticated JDBC injection via /jobJdbcDatasource/test8.7CNA v4.00.5%2026-10-16
CVE-2026-111612netdisk-fast-download credential disclosure via /v2/randomAuth8.7CNA v4.00.5%2026-10-16
CVE-2026-111611roncoo-education IDOR via Order Pay Cancel and Continue endpoints5.3CNA v4.00.2%2026-10-16
CVE-2026-111610B3log Solo missing authorization in ArticleConsole5.3CNA v4.00.2%2026-10-16
CVE-2026-111609PKP Open Journal Systems Cross-Journal Subscription IDOR via updateSubscription5.1CNA v4.00.2%2026-10-16
CVE-2026-111608jeequan jeepay insecure direct object reference2.3CNA v4.00.2%2026-10-16
CVE-2026-111607Jeepay IDOR via POST /API/mch/payConfigs7.1CNA v4.00.2%2026-10-16
CVE-2026-111606Huly Platform account takeover via mergeSpecifiedPersons RPC8.6CNA v4.00.2%2026-10-16
CVE-2026-111605Jpom Cross-Workspace authorization bypass via SshFileController8.6CNA v4.00.3%2026-10-16
CVE-2026-111604eladmin broken access control via /API/users Update and Delete5.1CNA v4.00.3%2026-10-16
CVE-2026-111603PlayEdu missing authorization via Student CourseController endpoints5.3CNA v4.00.3%2026-10-16
CVE-2026-111581Red Hat libblockdev ntfs and vfat label-setting helpers argument injection3.3CNA v3.10.1%2026-10-16
CVE-2026-111555Red Hat Enterprise Linux 10 luksmeta: Missing slot-range validation permits out-of-gap device i/o6.0CNA v3.10.1%2026-10-16Fix
CVE-2026-111472SQL injection in TSG Profleet9.3CNA v4.00.2%2026-10-16Fix
CVE-2026-111458ssldump heap buffer overflow in FAN/1 X.509 Fingerprint Formatting6.8CNA v4.00.1%2026-10-16
CVE-2026-111451Wheels CLI OS command injection7.8CNA v3.10.1%2026-10-16Fix
CVE-2026-111450Wheels use of a less trusted source5.9CNA v3.10.1%2026-10-16Fix
CVE-2026-111449Wheels race condition5.9CNA v3.10.2%2026-10-16Fix
CVE-2026-111448Wheels case sensitivity bypass3.7CNA v3.10.2%2026-10-16Fix
CVE-2026-111447Wheels web parameter tampering8.1CNA v3.10.3%2026-10-16Fix
CVE-2026-111446Wheels incorrect authorization8.6CNA v3.10.3%2026-10-16Fix
CVE-2026-111445Wheels incorrect resource transfer8.1CNA v3.10.3%2026-10-16Fix
CVE-2026-111444Wheels SQL injection9.8CNA v3.10.3%2026-10-16Exploit codeFix
CVE-2026-111443Wheels use of a less trusted source6.5CNA v3.10.2%2026-10-16Fix
CVE-2026-111442backdropcms Backdrop cross-site scripting5.3CNA v4.00.2%2026-10-16Fix
CVE-2026-111413aThemeArt theme Helper WordPress plugin cross-site request forgery (CSRF)8.8CNA v3.10.1%2026-10-16
CVE-2026-111409YITH PayPal Express Checkout for WooCommerce WordPress plugin broken access control5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-111405MapSVG WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-16Fix
CVE-2026-111400PowerPack Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-16Fix
CVE-2026-111399MapSVG WordPress plugin SQL injection8.5CNA v3.10.3%2026-10-16Fix
CVE-2026-111397MapSVG WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-111396Advanced Post Manager WordPress plugin broken access control7.1CNA v3.10.2%2026-10-16Fix
CVE-2026-111392SGLang KV cache poisoning via mm_hashes in /generate6.3CNA v4.00.2%2026-10-16
CVE-2026-111391SGLang code injection via Debug Dumper Filter9.2CNA v4.00.5%2026-10-16
CVE-2026-111390Erupt HQL injection via linkTreeVal in Data Table API6.0CNA v4.00.3%2026-10-16
CVE-2026-111389Frappe HRMS SQL injection via Missing Validation8.3CNA v4.00.2%2026-10-16Exploit codeFix
CVE-2026-111388Frappe restrict_ip Allowlist Bypass via API Key, OAuth Authentication5.3CNA v4.00.2%2026-10-16Fix
CVE-2026-111387Nezha information disclosure via DDNS List endpoint7.1CNA v4.00.3%2026-10-16Fix
CVE-2026-111386Nezha Cross-Tenant Server-ID Enumeration via getServerConfig5.3CNA v4.00.2%2026-10-16Fix
CVE-2026-111385Nezha host header injection via MCP Transfer tools6.3CNA v4.00.2%2026-10-16Fix
CVE-2026-111384Nezha memory exhaustion via File Manager WebSocket7.1CNA v4.00.3%2026-10-16Fix
CVE-2026-111383Nezha denial of service via /API/v1/ws/transfer WebSocket7.1CNA v4.00.3%2026-10-16Fix
CVE-2026-111382FreeRDP heap out-of-bounds write in AVC444 YUV444 Combine8.7CNA v4.00.3%2026-10-16Fix
CVE-2026-111381FreeRDP heap buffer overflow via Persistent Cache v2 parser7.0CNA v4.00.1%2026-10-16Fix
CVE-2026-111380FreeRDP heap overflow via audin Apple Backends8.7CNA v4.00.3%2026-10-16Fix
CVE-2026-111379FreeRDP heap buffer overflow via persistent_cache_read_entry_v37.0CNA v4.00.1%2026-10-16Fix
CVE-2026-111378FreeRDP unauthenticated memory exhaustion via NLA Frame parser8.7CNA v4.00.3%2026-10-16Fix
CVE-2026-111377FreeRDP memory exhaustion via Static Channel Reassembly7.1CNA v4.00.3%2026-10-16Fix
CVE-2026-111376FreeRDP Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE2.3CNA v4.00.1%2026-10-16Fix
CVE-2026-111375FreeRDP out-of-bounds read via RAIL Window Title6.3CNA v4.00.3%2026-10-16Fix
CVE-2026-111374FreeRDP from resource exhaustion via rdpecam StartStreamsRequest6.0CNA v4.00.3%2026-10-16Fix
CVE-2026-111373FreeRDP null dereference via Zero-Length WebSocket Ping6.9CNA v4.00.3%2026-10-16Fix
CVE-2026-111311DoubleScale All-in-One CRM WordPress plugin arbitrary file upload8.8CNA v3.10.5%2026-10-16Fix
CVE-2026-111237Ultralytics FastSAM AutoBackend Model Loading eval injection4.8CNA v4.00.1%2026-10-16
CVE-2026-111212ImprintLab Medical-SAM-Adapter AutoBackend Model Loading eval injection2.4CNA v4.00.1%2026-10-16
CVE-2026-111210bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery6.9CNA v4.00.3%2026-10-16
CVE-2026-111178WP Booking System WordPress plugin SQL injection4.9CNA v3.10.3%2026-10-16Fix
CVE-2026-111122SiteOrigin CSS WordPress plugin unauthenticated stored DOM-based cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-111114Nexter Extension WordPress plugin privilege escalation to reset-view parameter7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-111106Mail Mint WordPress plugin authenticated (Custom+) SQL injection via filters parameter6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-111069GeoDirectory WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-111044Disabled Sunshine clients can bypass revocation with a derived client certificate7.6CNA v3.10.2%2026-10-16Fix
CVE-2026-110903The Events Calendar WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-16Fix
CVE-2026-110901SmartCrawl WordPress plugin insecure direct object references (IDOR)5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-110900BookIt WordPress plugin broken access control5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-110896Passster WordPress plugin broken access control5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-110806Devolutions Server add-on properties incorrect authorization6.5CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-110805Devolutions Server PingOne groups endpoint server-side request forgery2.6CISA ADP v3.10.1%2026-10-16Fix
CVE-2026-110804Devolutions Server mass assignment4.3CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-110759Perl Text::CSV_XS parse improper syntax validation9.8CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110758Perl Text::CSV_XS strip_trail_whitespace buffer under-read7.5CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110757Perl Text::CSV_XS combine function improper output encoding9.8CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110756Perl Text::CSV_XS improper output encoding9.8CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110755Perl Text::CSV_XS getline algorithmic complexity7.5CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110754Text::CSV_XS versions for Perl leak the parsed fields of a record that fails to parse in getline6.5CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-110753Perl Text::CSV_XS getline use-after-free9.8CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110752Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column7.5CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110721NotificationX WordPress plugin missing authorization unauthenticated arbitrary content injection5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-110703GeoDirectory WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-110701CP Multi View Events Calendar WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-110664Premium Packages WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-110590Klarna for WooCommerce WordPress plugin authorization bypass7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-110380WP Event Solution WordPress plugin broken access control5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-110366Site Reviews WordPress plugin broken access control5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-110290WebberZone Top 10 WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-110287Devolutions Server asset contact password improper access control4.3CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-110252WPeMatico RSS Feed Fetcher WordPress plugin unauthenticated stored cross-site scripting5.4CNA v3.10.3%2026-10-16Fix
CVE-2026-110191Product Delivery Date for WooCommerce Lite for WordPress order information disclosure2.7CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-110179affiliate-toolkit for WordPress Editor+ SQL injection via orderby parameter6.8CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110135OTP Login and Register Woocommerce for WordPress unauthenticated account takeover7.4CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-110039Smush for WordPress Admin+ Network-Wide plugin settings update on Multisite2.7CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-110029Squeeze for WordPress Subscriber+ missing authorization via squeeze_restore_attachment5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-110019Bulk Page Generator WordPress plugin authorization bypass4.3CNA v3.10.2%2026-10-16Fix
CVE-2026-110017Quick PayPal Payments: Payment Button and Form WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-110015Salon Booking System for WordPress Administrator account creation via CSRF8.8CISA ADP v3.10.1%2026-10-16Fix
CVE-2026-110014Salon Booking System incorrect authorization5.3CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-110013Salon Booking System plugin booking API vulnerability4.8CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-110012Salon Booking System for WordPress Subscriber+ Booking PII disclosure via REST bookings/upcoming4.3CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-109998Mang Board WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-109990The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for un7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-109982MB Custom Post Types and Custom Taxonomies for WordPress missing authorization4.2CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-109930MAIO for WordPress unauthenticated Crawl Analytics disclosure via Hard-coded API Key5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-109839IBM Db2 Genius Hub missing cryptographic step3.1CNA v3.10.6%2026-10-16Fix
CVE-2026-109838IBM Db2 Genius Hub improper verification of cryptographic signature5.1CNA v3.10.1%2026-10-16Fix
CVE-2026-109813Moxa AIG-302 Series Shared Hard-coded Root CA Private Key8.6CNA v4.00.2%2026-10-16Fix
CVE-2026-109812Moxa AIG-302 Series missing authorization on Secret endpoints6.9CNA v4.00.1%2026-10-16Fix
CVE-2026-109588Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel9.3CNA v4.00.1%2026-10-16Fix
CVE-2026-109587Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel9.3CNA v4.00.1%2026-10-16Fix
CVE-2026-109515MailOptin WordPress plugin privilege escalation9.8CNA v3.10.4%2026-10-16Reported exploitedFix
CVE-2026-109513NotificationX WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-109512Mang Board WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-109461Microsoft Authentication Library (MSAL) for Node.js information disclosure5.9CNA v3.10.3%2026-10-16Fix
CVE-2026-109447User Profile Builder WordPress plugin unauthenticated privilege escalation to role parameter8.1CNA v3.10.3%2026-10-16Fix
CVE-2026-109414Vitepos WordPress plugin SQL injection6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-109401WP Mail Logging WordPress plugin information disclosure2.7CNA v3.10.3%2026-10-16Fix
CVE-2026-109400InstaWP Connect WordPress plugin privilege escalation7.5CNA v3.10.4%2026-10-16Fix
CVE-2026-109388HivePress WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-10-16Fix
CVE-2026-109382WSP MCP WordPress plugin sensitive information disclosure6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-109232Salon Booking System WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-109224SureCart WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-109221Groundhogg WordPress plugin arbitrary file deletion8.1CNA v3.10.8%2026-10-16Fix
CVE-2026-109219Mang Board - unauthenticated arbitrary file upload via image_path parameter9.8CNA v3.10.7%2026-10-16Fix
CVE-2026-109207RSS Aggregator by Feedzy WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-109193HivePress WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-10-16Fix
CVE-2026-109191Image Hub WordPress plugin sensitive information exposure in admin page HTML4.3CNA v3.10.3%2026-10-16Fix
CVE-2026-109119Missing authorization in rdiffweb8.8CNA v3.10.4%2026-10-16Fix
CVE-2026-109118Improper limitation of a pathname to a restricted directory (path traversal) in rdiffweb4.6CNA v3.10.2%2026-10-16Fix
CVE-2026-108743Apache Kylin: Spark job OS command injection8.8CISA ADP v3.11.9%2026-10-16Fix
CVE-2026-108709Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)9.8CISA ADP v3.10.7%2026-10-16Fix
CVE-2026-108374ERPNext: Unauthorised status modification due to missing validation7.7CNA v3.10.2%2026-10-16Fix
CVE-2026-108373ERPNext: Unauthorised access to financial data due to missing validation6.5CNA v3.10.2%2026-10-16Fix
CVE-2026-108372LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files7.1CNA v4.00.2%2026-10-16Fix
CVE-2026-107777Thermo Fisher Torrent Suite Software path traversal7.1CNA v4.00.3%2026-10-16Fix
CVE-2026-107770Photo Engine (Media Organizer and Lightroom) WordPress plugin authorization bypass6.8CNA v3.10.5%2026-10-16Fix
CVE-2026-107768TranslatePress WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-107764SiteOrigin CSS WordPress plugin unauthenticated stored DOM-based cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-107758Colibri Page Builder WordPress plugin unauthenticated stored cross-site scripting via comments7.2CNA v3.10.4%2026-10-16Fix
CVE-2026-107748User Profile Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-107746FunnelKit WordPress plugin missing authorization unauthenticated sensitive information disclosure7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-107674IBM i is affected by a denial of service in Digital Certificate Manager5.1CNA v3.10.1%2026-10-16Fix
CVE-2026-107659Modula Image Gallery WordPress plugin information disclosure7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-107649Events Made Easy WordPress plugin unauthenticated stored cross-site scripting5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-107648WP Sessions Time Monitoring Full Automatic WordPress plugin stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-107646HUSKY WordPress plugin information disclosure5.3CNA v3.10.3%2026-10-16Fix
CVE-2026-107621J4Care dcm4che loop with unreachable exit condition8.7CNA v4.00.3%2026-10-16Fix
CVE-2026-107617Guangzhou Juan IoT Technology EseeCloud use of hard-coded credentials9.3CNA v4.00.3%2026-10-16
CVE-2026-107564Gocsaf/csaf: Csaf_provider prone to uncontrolled resource consumption8.7CNA v4.00.3%2026-10-16Fix
CVE-2026-106705ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither v8.8CNA v3.10.2%2026-10-16
CVE-2026-106030Missing authorization in NordVPN for Windows6.8CNA v4.00.1%2026-10-16Fix
CVE-2026-105974Visual Form Builder for WordPress Subscriber+ sensitive data disclosure via Dashboard widget4.3CISA ADP v3.10.2%2026-10-16
CVE-2026-105973Visual Form Builder for WordPress arbitrary form field Reordering via missing authorization4.3CISA ADP v3.10.2%2026-10-16
CVE-2026-105959Red Hat Enterprise Linux 6 spice-server: Spice: Heap buffer overflow7.5CNA v3.10.4%2026-10-16
CVE-2026-105958Red Hat Enterprise Linux 6 spice-server: Spice: Heap OOB read/write7.5CNA v3.10.2%2026-10-16
CVE-2026-105667J4Care dcm4che missing authentication for critical function8.7CNA v4.00.2%2026-10-16Fix
CVE-2026-105664Guangzhou Juan IoT Technology EseeCloud observable response discrepancy6.9CNA v4.00.3%2026-10-16
CVE-2026-105279J4Care dcm4che missing authentication for critical function9.3CNA v4.00.2%2026-10-16Fix
CVE-2026-105273J4Care dcm4che loop with unreachable exit condition8.7CNA v4.00.3%2026-10-16Fix
CVE-2026-105228ISPSoft out-of-bounds read7.0CNA v4.00.3%2026-10-16Fix
CVE-2026-105227ISPSoft out-of-bounds read7.0CNA v4.00.3%2026-10-16Fix
CVE-2026-104932Search Regex Authenticated remote code execution8.0CNA v3.10.3%2026-10-16Fix
CVE-2026-104798My Calendar WordPress plugin unauthenticated privilege escalation to mcs parameter9.8CNA v3.10.9%2026-10-16Fix
CVE-2026-104769Debloat WordPress plugin unauthenticated arbitrary file read5.9CNA v3.10.8%2026-10-16Fix
CVE-2026-104755WP Compress WordPress plugin privilege escalation4.8CNA v3.10.3%2026-10-16Fix
CVE-2026-104745Customer Email Verification for WooCommerce WordPress plugin privilege escalation8.1CNA v3.10.5%2026-10-16Exploit codeFix
CVE-2026-104730Sunshine Photo Cart WordPress plugin unauthenticated PHP object injection via key parameter9.8CNA v3.10.5%2026-10-16Fix
CVE-2026-104726Name Directory WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-104715Red Hat cifs-utils mount.cifs argument injection7.8CNA v3.10.1%2026-10-16Exploit codeFix
CVE-2026-104003properfraction Paid Membership Plugin ProfilePress User Profile Comments tab code injection5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-104001Slim SEO WordPress plugin arbitrary shortcode execution via Biographical Info user Meta5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-104000Simply Schedule Appointments WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-103999Ultra Addons for Contact Form 7 WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-103911wpmudev Forminator Forms code injection6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-10389610Web Booster WordPress plugin unauthenticated limited file write / cache poisoning7.5CNA v3.10.5%2026-10-16Fix
CVE-2026-103895miniOrange OTP Login, Verification and SMS Notifications WordPress plugin authentication bypass8.1CNA v3.10.4%2026-10-16Reported exploitedFix
CVE-2026-103768ELEX WordPress HelpDesk and Customer Ticketing System plugin unauthenticated arbitrary file upload9.8CNA v3.10.6%2026-10-16Fix
CVE-2026-103696Mobile Builder for WordPress unauthenticated SQLi via delivery_id parameter6.8CISA ADP v3.10.3%2026-10-16
CVE-2026-103525FluentCart A New Era of eCommerce WordPress plugin insecure direct object reference7.5CNA v3.10.4%2026-10-16Fix
CVE-2026-103518FluentCart A New Era of eCommerce WordPress plugin SQL injection4.9CNA v3.10.4%2026-10-16Fix
CVE-2026-103481Gwolle Guestbook WordPress plugin reflected cross-site scripting via permalink parameter6.1CNA v3.10.2%2026-10-16Fix
CVE-2026-103480Tourfic WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-102941Gomarkdown/markdown IsSafeURL panics on short URLs7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-102923SparkyFitness: SSRF via unvalidated custom_url in AI service settings5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-102917IBM i is affected by an improper privilege management7.8CNA v3.10.1%2026-10-16Fix
CVE-2026-102834JavaCV: Integer overflow in IPCameraFrameGrabber causes Infinite-Loop DoS7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-102693RIOT: Remote stack buffer overflow in ATWINC15x0 driver via unsanitized SSID9.6CNA v3.10.2%2026-10-16Fix
CVE-2026-102692RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access9.1CNA v3.10.4%2026-10-16Fix
CVE-2026-102608ZoneMinder: Authenticated OS command injection9.0CNA v3.10.3%2026-10-16Fix
CVE-2026-102607ZoneMinder: Authenticated OS command injection (RCE) via Export feature8.8CNA v3.10.4%2026-10-16Exploit codeFix
CVE-2026-102552Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver8.2CNA v4.00.2%2026-10-16Fix
CVE-2026-102551FreeRTOS-Plus-TCP improper verification of communication source9.2CNA v4.00.3%2026-10-16Fix
CVE-2026-101335wpmudev Forminator Forms Quiz Notification Merge Tags code injection6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-101300Server-side request forgery in Wegow PDF export7.1CNA v4.00.2%2026-10-16
CVE-2026-101021J4Care dcm4che inefficient algorithmic complexity8.7CNA v4.00.3%2026-10-16Fix
CVE-2026-100186User Profile Builder WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-100159Ays Pro Popup Box ays_popup_get_user_ip function code injection4.8CNA v3.10.3%2026-10-16Fix
CVE-2026-100158SQL Chart Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-100108Social Share Buttons WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-100106FiboSearch WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-97858Guangzhou Juan IoT Technology EseeCloud App mass assignment6.9CNA v4.00.3%2026-10-16
CVE-2026-97851J4Care dcm4che missing authorization8.8CNA v4.00.3%2026-10-16Fix
CVE-2026-97640WPConsent WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-97470Tourfic WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-97380MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges8.8CNA v3.10.6%2026-10-16Fix
CVE-2026-97339Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-97296Gravity Forms WordPress plugin PHP object injection8.1CNA v3.10.3%2026-10-16Fix
CVE-2026-96870SureDash WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-96768GoSMTP Pro WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-96628getarcaneapp arcane incorrect authorization4.3CNA v3.10.2%2026-10-16Fix
CVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover8.8CNA v3.10.3%2026-10-16Fix
CVE-2026-96626Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host8.5CNA v3.10.2%2026-10-16Fix
CVE-2026-96620anthropics claude-agent-sdk-python claude Agent SDK: Argument injection9.2CNA v4.00.6%2026-10-16Fix
CVE-2026-96570Schema and Structured Data for WP and AMP WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-96562Broken Link Checker WordPress plugin code injection6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-96542EA Javelin Anticheat Installer local privilege escalation5.0CNA v3.10.1%2026-10-16
CVE-2026-96425Incorrect permission assignment for critical resource in lomiri-download-manager5.5CNA v3.10.1%2026-10-16Fix
CVE-2026-96424Incorrect permission assignment for critical resource in lomiri-download-manager7.8CNA v3.10.1%2026-10-16Fix
CVE-2026-96339Houzez WordPress theme cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-16Fix
CVE-2026-95859libp2p rust-libp2p libp2p-rust: Gossipsub GRAFT topics unbounded growth8.7CNA v4.00.3%2026-10-16Fix
CVE-2026-95809Opti-Behavior WordPress plugin unauthenticated stored DOM-based cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-95686Opti-Behavior WordPress plugin unauthenticated stored DOM-based cross-site scripting7.2CNA v3.10.3%2026-10-16Fix
CVE-2026-95183An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.8.8CISA ADP v3.10.3%2026-10-16
CVE-2026-95182DeepSeek Harness An untrusted search path10.0CISA ADP v3.10.5%2026-10-16
CVE-2026-94388Green Popups WordPress plugin SQL injection9.3CNA v3.10.2%2026-10-16Fix
CVE-2026-94169The Grid WordPress plugin remote code execution (RCE)10.0CNA v3.13.3%2026-10-16Reported exploitedNucleiExploit codeFix
CVE-2026-93953Backuply WordPress plugin Second-order SQL injection8.0CNA v3.10.3%2026-10-16Fix
CVE-2026-93767Tainacan WordPress plugin path traversal to arbitrary file read6.5CNA v3.10.6%2026-10-16Fix
CVE-2026-93681Tutor LMS WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-93535WP Dark Mode Improve Accessibility with AI Powered Dark WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-92766Vitepos WordPress plugin unauthenticated SQL injection via src_by parameter7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-92553YaySMTP WordPress plugin arbitrary file upload8.8CNA v3.10.6%2026-10-16Fix
CVE-2026-92427Coinsnap Bitcoin Crowdfunding payment gateway webhook information disclosure5.3CISA ADP v3.10.2%2026-10-16
CVE-2026-92263SparkyFitness: Authenticated OS command injection7.2CNA v3.10.4%2026-10-16Fix
CVE-2026-92262MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass9.9CNA v3.10.7%2026-10-16Exploit codeFix
CVE-2026-92115WP Photo Album Plus WordPress plugin command injection8.8CNA v3.11.5%2026-10-16Fix
CVE-2026-91833WX Subscribe WordPress plugin unauthenticated SQLi via attach parameter6.8CISA ADP v3.10.2%2026-10-16
CVE-2026-91830Subscribe to Comments WordPress plugin unauthenticated Subscription management key disclosure6.5CISA ADP v3.10.2%2026-10-16Fix
CVE-2026-90821Improper neutralization of input during web page generation in Crafty Controller5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-89280The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. T4.3CNA v3.10.2%2026-10-16Fix
CVE-2026-89098Red Hat Enterprise Linux 10 nfs-utils: Nfs-utils: Denial of service via assertion failure in fsidd5.5CNA v3.10.1%2026-10-16Fix
CVE-2026-89096Red Hat Enterprise Linux 10 Nfs-utils: Nfs-utils: Denial of service via memory leak in rpc.statd5.9CNA v3.10.3%2026-10-16Fix
CVE-2026-89088Red Hat Enterprise Linux 10 parted: Parted: Denial of service5.5CNA v3.10.1%2026-10-16Fix
CVE-2026-89085Red Hat Enterprise Linux 10 parted: Parted: Heap-based buffer overflow6.6CNA v3.10.2%2026-10-16Fix
CVE-2026-89079Theme My Login WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.3%2026-10-16Reported exploitedNucleiExploit codeFix
CVE-2026-89051Hide My WP Ghost WordPress plugin unauthenticated stored cross-site scripting via comment content7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-88963Tutor LMS WordPress plugin reflected DOM-based cross-site scripting6.1CNA v3.10.2%2026-10-16Fix
CVE-2026-88755Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.7.8CISA ADP v3.10.2%2026-10-16
CVE-2026-87111User Registration PRO WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-16Fix
CVE-2026-86047MariaDB: Insufficient quoting in mariadb-dump and SHOW commands7.7CNA v3.10.3%2026-10-16Fix
CVE-2026-86009Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control8.2CNA v4.00.3%2026-10-16
CVE-2026-86008Mailu domain managers can take over higher-privileged accounts7.2CNA v3.10.3%2026-10-16
CVE-2026-85985MariaDB: Unauthorized file access via CONNECT engine UDFs5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-85977Red Hat Hardened Images libtirpc: Libtirpc: Denial of service5.3CNA v3.10.3%2026-10-16Fix
CVE-2026-85748MariaDB server SYS_REFCURSOR handling use-after-free9.9CNA v3.10.5%2026-10-16Fix
CVE-2026-85746MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections9.9CNA v3.10.6%2026-10-16Fix
CVE-2026-85745MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon4.3CNA v3.10.3%2026-10-16Fix
CVE-2026-85659PilotPress WordPress plugin privilege escalation8.8CNA v3.10.4%2026-10-16Fix
CVE-2026-85231Red Hat Enterprise Linux 10 libtirpc: Libtirpc: Denial of service6.5CNA v3.10.3%2026-10-16
CVE-2026-81452Dell Alienware Command Center (AWCC) least privilege violation7.0CNA v3.10.1%2026-10-16Fix
CVE-2026-80092Microsoft Identity Web elevation of privilege5.3CNA v3.10.6%2026-10-16Fix
CVE-2026-77829Cooked WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-16Fix
CVE-2026-77630pupnp DNS resolution denial of service7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-77474Dicklesworthstone destructive_command_guard split_command_segments denial of service7.1CNA v3.10.1%2026-10-16Fix
CVE-2026-75903Vulnity Security WordPress plugin unauthenticated authentication bypass to Administrator8.1CNA v3.10.5%2026-10-16Fix
CVE-2026-74923Document Gallery information disclosure5.3CISA ADP v3.10.2%2026-10-16
CVE-2026-69080Apache Kylin: Broken access control in QuerySQLBlacklistController7.5CISA ADP v3.10.4%2026-10-16Fix
CVE-2026-69077Apache Kylin: JobController allows unauthorized cross-project manipulation7.5CISA ADP v3.10.4%2026-10-16Fix
CVE-2026-69076Apache Kylin: Unauthorized cross-project job discard7.5CISA ADP v3.10.4%2026-10-16Fix
CVE-2026-68908MZ Automation libiec61850 Reporting_RCBWriteAccessHandler vulnerability5.3CNA v3.10.5%2026-10-16Fix
CVE-2026-68907MZ Automation libiec61850 checkDataSetAccess out-of-bounds read8.2CNA v4.00.4%2026-10-16Fix
CVE-2026-68906MZ Automation libiec61850 ACSE parseUserInformation out-of-bounds read8.7CNA v4.00.4%2026-10-16Fix
CVE-2026-68573Apache Kylin: Unauthenticated Metastore Cleanup9.8CISA ADP v3.10.6%2026-10-16Fix
CVE-2026-68572Apache Kylin: Unauthorized SQL execution to Spark SQL env7.5CISA ADP v3.10.4%2026-10-16Fix
CVE-2026-68571Apache Kylin: JDBC URL Whitelist Verification Bypass8.8CISA ADP v3.10.5%2026-10-16Fix
CVE-2026-68498FasterXML jackson-core ReaderBasedJsonParser denial of service7.5CNA v3.10.9%2026-10-16Fix
CVE-2026-64959Apache Kylin: Missing authentication on certain cache API endpoints9.8CISA ADP v3.10.7%2026-10-16Fix
CVE-2026-64862Frappe HR: Missing authorization on PWA API endpoints enables Cross-Employee Data access in HRMS6.5CNA v3.10.2%2026-10-16Fix
CVE-2026-64610Apache Kylin: Redis unsafe Java deserialization9.8CISA ADP v3.10.6%2026-10-16Fix
CVE-2026-63619Apache Kylin: Missing authorization and path-confinement on system meta dump9.1CISA ADP v3.10.4%2026-10-16Fix
CVE-2026-63618Apache Kylin: Low-Privilege Config Exposure7.5CISA ADP v3.10.4%2026-10-16Fix
CVE-2026-62439GIMP file-pvr plug-in integer overflow7.0CNA v3.10.2%2026-10-16Fix
CVE-2026-62438Red Hat Enterprise Linux 10 gimp: Gimp: Paa integer overflow out-of-bounds read6.1CNA v3.10.1%2026-10-16Fix
CVE-2026-62362PBH-BTN PeerBanHelper analysis endpoint SQL injection4.9CNA v3.10.3%2026-10-16Fix
CVE-2026-61726Tandoor Recipes: Private recipe authorization bypass8.1CNA v3.10.2%2026-10-16Fix
CVE-2026-59970Tandoor Recipes: Blind SSRF via AI provider URL (api_base)7.7CNA v3.10.3%2026-10-16Exploit codeFix
CVE-2026-59967Tandoor Recipes recipe-from-source API insecure direct object reference5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-59966Tandoor Recipes: ReDoS5.7CNA v3.10.3%2026-10-16Fix
CVE-2026-59963Tandoor Recipes recipe utility API endpoints authorization bypass7.1CNA v3.10.2%2026-10-16Fix
CVE-2026-59962Tandoor Recipes: ORM ORDER BY injection via FK Traversal in Tandoor Recipes6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-57488pupnp HTTP parser vulnerability7.1CNA v3.10.3%2026-10-16Fix
CVE-2026-57487pupnp libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered7.5CNA v3.10.3%2026-10-16Fix
CVE-2026-57486pupnp ixmlNode_compare null pointer dereference7.5CNA v3.10.4%2026-10-16Fix
CVE-2026-57447Discourse Doc Categories: Doc category index refresh leaks private topic titles4.3CNA v3.10.2%2026-10-16
CVE-2026-57446libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale file* handle5.3CNA v3.10.4%2026-10-16Fix
CVE-2026-57169Dockhand: Unauthenticated container exec via WebSocket upgrade9.6CNA v3.10.3%2026-10-16Fix
CVE-2026-55862pupnp ixml DOM functions denial of service6.5CNA v3.10.4%2026-10-16Fix
CVE-2026-55836open-zaak open Zaak: Path traversal / arbitrary server-file read6.8CNA v3.10.4%2026-10-16Fix
CVE-2026-55796Frappe HR: SQL injection in HRMS Salary Payments via ECS Report6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-55543TuxGuitar: Arbitrary code execution via maliciously crafted `.tg` file8.5CNA v4.00.1%2026-10-16Fix
CVE-2026-54657open-zaak search endpoints improper authorization6.5CNA v3.10.3%2026-10-16Fix
CVE-2026-49868RIOT-OS DHCPv6 client out-of-bounds read9.8CNA v3.10.4%2026-10-16Fix
CVE-2026-49410OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation8.1CNA v3.10.2%2026-10-16Fix
CVE-2026-48741MZ Automation libiec61850 MMS Read service null pointer dereference7.5CNA v3.10.4%2026-10-16Fix
CVE-2026-48503libIEC61850: Remote information disclosure in MMS file service7.5CNA v3.10.5%2026-10-16Fix
CVE-2026-46472GStreamer gst-plugins-good isomp4 plugin information disclosure7.5CISA ADP v3.10.3%2026-10-16Fix
CVE-2026-46471GStreamer gst-plugins-good isomp4 plugin information disclosure5.5CISA ADP v3.10.1%2026-10-16Fix
CVE-2026-44977countly-server star-rating plugin stored cross-site scripting9.0CNA v3.10.3%2026-10-16Fix
CVE-2026-42270countly-server local fs storage backend denial of service7.5CNA v3.10.5%2026-10-16Fix
CVE-2026-42269countly-server data migration plugin path traversal8.1CNA v3.10.5%2026-10-16Fix
CVE-2026-41582countly-server public image and screenshot routes path traversal7.5CNA v3.10.4%2026-10-16Fix
CVE-2026-30971ZoneMinder: Authenticated RCE via command injection in monitor Device Path8.8CNA v3.11.1%2026-10-16Fix
CVE-2026-26846WEINVEIW CO buffer overflow9.8CISA ADP v3.10.7%2026-10-16
CVE-2026-19867Mattermost user notification properties denial of service4.3CNA v3.10.2%2026-10-16
CVE-2026-19798Wp Map Block WordPress plugin unauthorized access4.3CNA v3.10.2%2026-10-16Fix
CVE-2026-19621Mattermost interactive-message integration information disclosure6.5CNA v3.10.2%2026-10-16
CVE-2026-19603Mattermost private channel ID disclosure via user status endpoints4.3CNA v3.10.2%2026-10-16
CVE-2026-19601Mattermost Disclosure of AD/LDAP bind password via Test Connection4.9CNA v3.10.2%2026-10-16
CVE-2026-19600Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts4.5CNA v3.10.2%2026-10-16
CVE-2026-19541Mattermost outgoing OAuth connection client secret exposure during connection validation6.5CNA v3.10.2%2026-10-16
CVE-2026-19076Mattermost account type switch endpoint incorrect authorization4.4CNA v3.10.2%2026-10-16
CVE-2026-18799Mattermost Server Slack import account binding missing authorization4.3CNA v3.10.2%2026-10-16
CVE-2026-18795Mattermost missing server side validation allowed user to quarantine a DM and GM post6.4CNA v3.10.2%2026-10-16
CVE-2026-18560Mattermost GetFile API vulnerability4.3CNA v3.10.2%2026-10-16
CVE-2026-18551Mattermost guest account privilege escalation via member roles API6.5CNA v3.10.2%2026-10-16
CVE-2026-18516Improper encoding or escaping of output in Crafty Controller9.6CNA v3.10.3%2026-10-16
CVE-2026-18256Mattermost private team metadata disclosure via the team search API4.3CNA v3.10.2%2026-10-16
CVE-2026-18223Mattermost invitation tokens incorrect authorization5.0CNA v3.10.2%2026-10-16
CVE-2026-17591Red Hat Hardened Images libarchive: Libarchive: Use-after-free via aliased mac metadata copy3.6CNA v3.10.1%2026-10-16Fix
CVE-2026-17491IBM i is affected by an improper privilege management vulnerability in OpenSSH5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-17488IBM i is affected by an improper authentication vulnerability in SST / DST4.3CNA v3.10.3%2026-10-16Fix
CVE-2026-17275IBM i is affected by an improper validation3.7CNA v3.10.2%2026-10-16Fix
CVE-2026-17073IBM i Network File System improper access control5.4CNA v3.10.1%2026-10-16Fix
CVE-2026-17068IBM i Network File System improper authorization5.4CNA v3.10.1%2026-10-16Fix
CVE-2026-16453Mattermost SAML RelayState forgery allows unauthorized team membership7.1CNA v3.10.2%2026-10-16
CVE-2026-16251Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering6.5CNA v3.10.3%2026-10-16
CVE-2026-15575Sensitive information disclosure due to Enabled Debug Mode in Production in SFM Software's Costifier5.3CNA v3.10.2%2026-10-16
CVE-2026-15222User Registration and Membership WordPress plugin arbitrary shortcode execution via display_name5.4CNA v3.10.2%2026-10-16Fix
CVE-2026-15219IDOR in SFM Software's Costifier6.5CNA v3.10.2%2026-10-16
CVE-2026-14452Checkmk open redirect and XSS via reset_url parameter8.6CNA v4.00.3%2026-10-16Fix
CVE-2026-14177User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure7.5CNA v3.10.2%2026-10-16
CVE-2026-12272Lightweight Cookie Notice WordPress plugin sensitive information exposure5.3CNA v3.10.2%2026-10-16Fix
CVE-2026-111369ClassroomIO incorrect authorization via Lesson Update and Delete Routes7.1CNA v4.00.2%2026-10-15
CVE-2026-111368ClassroomIO IDOR via Course Submission Update, Grade and Delete Routes6.1CNA v4.00.2%2026-10-15
CVE-2026-111367BillionMail Forgeable JWTs via Default Signing Key6.9CNA v4.00.3%2026-10-15
CVE-2026-111366cool-admin-midway authorization bypass via /admin/sys/user endpoints8.6CNA v4.00.4%2026-10-15
CVE-2026-111365cool-admin-midway missing authorization via System Role endpoints7.0CNA v4.00.3%2026-10-15
CVE-2026-111364MinDoc IDOR via /API/:key/content/:id GET Branch7.1CNA v4.00.2%2026-10-15
CVE-2026-111363BISHENG IDOR via /API/v1/knowledge/file_bbox7.1CNA v4.00.2%2026-10-15
CVE-2026-111359CRMEB IDOR via giftDetail and receiveGift7.1CNA v4.00.2%2026-10-15
CVE-2026-111358SendPortal sendportal-core Cross-Workspace Tag Attachment via Subscriber form5.3CNA v4.00.3%2026-10-15
CVE-2026-111357Ivanti Connect Secure inclusion of untrusted functionality7.0CNA v3.10.2%2026-10-15Reported exploited
CVE-2026-111356MacCMS v10 account takeover via Password Recovery brute-force9.1CNA v4.00.3%2026-10-15
CVE-2026-111355zhontai Admin.Core authorization bypass via User and Organization By-ID endpoints5.3CNA v4.00.3%2026-10-15
CVE-2026-111354crmeb_java authorization bypass via Front Order Express and Refund endpoints2.3CNA v4.00.3%2026-10-15
CVE-2026-111353Peppermint missing authorization via Time-Tracking and Attachment upload endpoints5.3CNA v4.00.2%2026-10-15
CVE-2026-111352ThinkCMF incorrect authorization in Admin REST API8.7CNA v4.00.4%2026-10-15
CVE-2026-111351metasfresh authorization bypass via /rest/API/board REST API2.3CNA v4.00.2%2026-10-15
CVE-2026-111350Papermark missing authorization in Data Room Viewer Group API2.3CNA v4.00.3%2026-10-15
CVE-2026-111349puemos Craftplan CRM Customer resource missing authorization6.9CNA v4.00.3%2026-10-15
CVE-2026-111348Likeshop IDOR via AfterSale API Refund endpoints5.3CNA v4.00.2%2026-10-15
CVE-2026-111347go-ldap-admin Hard-Coded RSA Private Key via /base/decryptpwd8.2CNA v4.00.4%2026-10-15
CVE-2026-111346easysoft zentaopms ZenTao PMS authorization bypass via action::editComment5.3CNA v4.00.2%2026-10-15
CVE-2026-111345Trudesk authorization bypass via GET /API/v1/messages/conversation/:id5.3CNA v4.00.3%2026-10-15
CVE-2026-111344APITable authorization bypass5.3CNA v4.00.3%2026-10-15
CVE-2026-111343pig-mesh pig SysUserController missing authorization5.3CNA v4.00.3%2026-10-15
CVE-2026-111332OxiCloud incorrect authorization via Share Ring Cookie6.3CNA v4.00.3%2026-10-15
CVE-2026-111331Dokploy Cross-Organization authorization bypass via port tRPC Router5.3CNA v4.00.3%2026-10-15
CVE-2026-111330JuggleIM im-server weak password Hashing via Unsalted SHA-18.2CNA v4.00.2%2026-10-15
CVE-2026-111329JuggleIM im-server Default Admin Credentials in Admin console9.3CNA v4.00.5%2026-10-15
CVE-2026-111324rustdesk-api authorization bypass via POST /API/sysinfo6.9CNA v4.00.3%2026-10-15
CVE-2026-111323RedAmon unauthenticated SSRF via /tradecraft/verify endpoint6.9CNA v4.00.3%2026-10-15
CVE-2026-111322Archon missing authentication via /API/* Control API9.3CNA v4.00.7%2026-10-15
CVE-2026-111321TaskingAI SSRF via OpenAPI servers[0].url in Actions5.3CNA v4.00.2%2026-10-15
CVE-2026-111320ValueCell unauthenticated SSRF via /API/v1/models/check6.9CNA v4.00.3%2026-10-15
CVE-2026-111313JobOps SSRF via POST /API/manual-jobs/fetch7.1CNA v4.00.3%2026-10-15
CVE-2026-111312OpenHealth missing authentication via /API/health-data/[id] route9.2CNA v4.00.5%2026-10-15
CVE-2026-111284Aureus ERP stored XSS via Time Off Holiday Action Modal5.1CNA v4.00.2%2026-10-15
CVE-2026-111283BMC Helix Network Management authentication bypass via SAML Configuration9.5CNA v4.00.5%2026-10-15Exploit codeFix
CVE-2026-111282iso14229 out-of-bounds read via Handle_0x38_RequestFileTransfer8.8CNA v4.00.5%2026-10-15Fix
CVE-2026-111281Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode hard-coded credentials9.3CNA v4.00.6%2026-10-15
CVE-2026-111280snap7 out-of-bounds write via TSnap7MicroClient::opReadArea8.3CNA v4.00.4%2026-10-15
CVE-2026-111279Dragonfly Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER8.7CNA v4.00.5%2026-10-15
CVE-2026-111278NivoCart CAPTCHA Bypass via Answer Disclosed in Page HTML6.9CNA v4.00.3%2026-10-15
CVE-2026-111277NivoCart Guest Order Invoice Disclosure via account/order/download8.7CNA v4.00.4%2026-10-15
CVE-2026-111275nifti_clib stack out-of-bounds access via nifti_convert_n2hdr2nim6.9CNA v4.00.1%2026-10-15
CVE-2026-111274unarr heap out-of-bounds read via zip_parse_extra_fields6.8CNA v4.00.1%2026-10-15
CVE-2026-111273unarr off-by-one heap buffer overflow via tar_get_name6.9CNA v4.00.1%2026-10-15
CVE-2026-111272LibRaw heap out-of-bounds read via parseNikonMakernote ShotInfo6.8CNA v4.00.1%2026-10-15
CVE-2026-111271libmodplug heap out-of-bounds read via CSoundFile::ReadAMS26.8CNA v4.00.1%2026-10-15
CVE-2026-111270libmodplug heap out-of-bounds write via CSoundFile::ReadDSM6.9CNA v4.00.1%2026-10-15
CVE-2026-111269libical heap out-of-bounds read via icalvalue_decode_ical_string6.9CNA v4.00.1%2026-10-15
CVE-2026-111252OpenNMS denial of service via XML entity expansion6.5CNA v3.10.2%2026-10-15Fix
CVE-2026-111235OpenNMS REST authorization bypass via non-canonical HTTP method9.1CNA v3.10.4%2026-10-15Fix
CVE-2026-111234SimplePie Local File Read via file:// Redirect8.2CNA v4.00.3%2026-10-15
CVE-2026-111233Netgate pfSense CE reflected XSS via firewall_rules.php2.3CNA v4.01.1%2026-10-15
CVE-2026-111232Netgate pfSense CE stored XSS via Separator Color4.8CNA v4.01.0%2026-10-15
CVE-2026-111231Netgate pfSense CE authorization bypass via config_restore and config_install8.6CNA v4.00.8%2026-10-15
CVE-2026-111230Netgate pfSense CE Local File Read via Dynamic DNS Update URL6.9CNA v4.00.8%2026-10-15
CVE-2026-111229Netgate pfSense CE command injection via Captive Portal HA Sync8.6CNA v4.06.4%2026-10-15
CVE-2026-111228Netgate pfSense CE CRLF injection via services_unbound_advanced.php5.1CNA v4.01.8%2026-10-15
CVE-2026-111227Netgate pfSense CE CRLF injection via services_unbound_acls.php5.1CNA v4.01.8%2026-10-15
CVE-2026-111226Netgate pfSense CE OS command injection via system_advanced_admin.php8.6CNA v4.06.5%2026-10-15
CVE-2026-111225Netgate pfSense CE OS command injection via openvpn.learn-address.sh2.3CNA v4.06.2%2026-10-15
CVE-2026-111224Netgate pfSense CE OS command injection via openvpn.connect_async.sh7.7CNA v4.05.4%2026-10-15
CVE-2026-111223Netgate pfSense CE command injection via IPsec Mobile Login Banner8.6CNA v4.00.7%2026-10-15
CVE-2026-111222Netgate pfSense CE php.ini injection via Timezone setting7.5CNA v4.01.0%2026-10-15
CVE-2026-111221Netgate pfSense CE command injection via RADIUS Secret mpd.conf injection7.5CNA v4.00.9%2026-10-15
CVE-2026-111220Netgate pfSense CE Crontab injection via PPP Periodic Reset ptpid8.6CNA v4.00.7%2026-10-15
CVE-2026-111219Netgate pfSense CE command injection via PPPoE Server Username7.5CNA v4.00.9%2026-10-15
CVE-2026-111218Netgate pfSense CE OS command injection via Traffic Shaper Limiters8.6CNA v4.08.0%2026-10-15
CVE-2026-111217Netgate pfSense CE OS command injection via CARP VHID8.6CNA v4.06.7%2026-10-15
CVE-2026-111216Netgate pfSense CE OS command injection via Gateway Monitor IP8.6CNA v4.04.6%2026-10-15
CVE-2026-111215Netgate pfSense CE OS command injection via Wireless Parent interface8.6CNA v4.06.1%2026-10-15
CVE-2026-111214Netgate pfSense CE OS command injection via interfaces_qinq_edit.php8.6CNA v4.010.0%2026-10-15
CVE-2026-111172@casl/ability prototype pollution via rulesToFields setByPath6.0CNA v4.00.4%2026-10-15Fix
CVE-2026-111171Web3.py and CCIP-read SSRF Bypass6.3CNA v4.00.3%2026-10-15Fix
CVE-2026-111170kedro-datasets path traversal via MatplotlibDataset Plot Name7.1CNA v4.00.4%2026-10-15Fix
CVE-2026-111169La Suite Docs authorization bypass via Comment Thread Creation2.3CNA v4.00.3%2026-10-15
CVE-2026-111168LibreDesk stored XSS via SVG Upload Content-Type parameter5.1CNA v4.00.2%2026-10-15Fix
CVE-2026-111167GNU LibreDWG out-of-bounds read in acds_private AcDs Decoder6.9CNA v4.00.1%2026-10-15
CVE-2026-111166libmikmod heap out-of-bounds read via IMF_Load6.8CNA v4.00.2%2026-10-15
CVE-2026-111165libmikmod out-of-bounds read in MTM_Load via Channel Count6.8CNA v4.00.1%2026-10-15
CVE-2026-111164UADE out-of-bounds read in uade_filemagic via Short module6.8CNA v4.00.1%2026-10-15
CVE-2026-111163WildMIDI heap out-of-bounds read via _WM_ParseNewHmi6.8CNA v4.00.2%2026-10-15
CVE-2026-111162WildMIDI heap out-of-bounds read via _WM_ParseNewHmp6.9CNA v4.00.1%2026-10-15
CVE-2026-111161libADLMIDI stack out-of-bounds write via BW_MidiSequencer noteStates6.9CNA v4.00.2%2026-10-15
CVE-2026-111160LightLLM unauthenticated DoS via pd_kv_trans_params deserialization8.7CNA v4.00.4%2026-10-15
CVE-2026-111159libewf heap out-of-bounds read via L01 Extended Attribute Parsing6.9CNA v4.00.1%2026-10-15
CVE-2026-111158EarthScope libmseed heap out-of-bounds read via ms3_detect6.8CNA v4.00.1%2026-10-15
CVE-2026-111157SoX heap out-of-bounds write via MS ADPCM WAV Decoding6.9CNA v4.00.1%2026-10-15
CVE-2026-111156libTiMidity out-of-bounds access via SoundFont Preset header6.9CNA v4.00.1%2026-10-15
CVE-2026-111155libTiMidity out-of-bounds read via SoundFont Loader sndfont.c6.9CNA v4.00.1%2026-10-15
CVE-2026-111154libTiMidity stack out-of-bounds write via parse_gen in SoundFont Loader6.9CNA v4.00.1%2026-10-15
CVE-2026-111153Game Music Emu (libgme) out-of-bounds read via Classic_Emu::mute_voices_6.8CNA v4.00.1%2026-10-15
CVE-2026-111152Game Music Emu (libgme) heap out-of-bounds read via AY Loader6.8CNA v4.00.1%2026-10-15
CVE-2026-111151OpenJPH heap out-of-bounds write in HTJ2K Cleanup-Pass Decoder6.9CNA v4.00.1%2026-10-15
CVE-2026-111150ValleyBell libvgm through commit a6eed945 heap out-of-bounds read via DecompressDataBlk6.8CNA v4.00.1%2026-10-15
CVE-2026-111149FreeImage heap out-of-bounds read via PICT Unpack32Bits6.9CNA v4.00.1%2026-10-15
CVE-2026-111148libsidplayfp heap out-of-bounds read via SidTuneBase::acceptSidTune6.8CNA v4.00.1%2026-10-15
CVE-2026-111147Libyal libesedb heap out-of-bounds read via libesedb_record_get_multi_value6.9CNA v4.00.1%2026-10-15
CVE-2026-111146ytnef heap out-of-bounds read via MAPIPrint in lib/ytnef.c6.9CNA v4.00.1%2026-10-15
CVE-2026-111145ytnef heap out-of-bounds read via DecompressRTF6.9CNA v4.00.1%2026-10-15
CVE-2026-111144libansilove null pointer dereference via ansilove_xbin6.8CNA v4.00.1%2026-10-15
CVE-2026-111143Ansilove libansilove out-of-bounds read via ansilove_xbin RLE Decoding6.8CNA v4.00.1%2026-10-15
CVE-2026-111142Zziplib out-of-bounds read via zzip_disk_findfirst6.8CNA v4.00.1%2026-10-15
CVE-2026-111141zziplib out-of-bounds read via __zzip_parse_root_directory ZIP64 Parsing5.7CNA v4.00.1%2026-10-15
CVE-2026-111140libregf heap out-of-bounds read via libregf_value_item_read_value_data6.9CNA v4.00.1%2026-10-15
CVE-2026-111139NetSurf libnsbmp out-of-bounds read via bmp_decode_mask6.8CNA v4.00.1%2026-10-15
CVE-2026-111138NetSurf libnsbmp out-of-bounds read in RLE8 and RLE4 Decoders6.8CNA v4.00.1%2026-10-15
CVE-2026-111137libsmi out-of-bounds write via smiValueAsString OCTET STRING DEFVAL6.9CNA v4.00.1%2026-10-15
CVE-2026-111136libInstPatch heap out-of-bounds write via ipatch_sf2_gen_is_valid6.9CNA v4.00.2%2026-10-15Fix
CVE-2026-111135libfwsi heap out-of-bounds read via libfwsi_mtp_volume_values_read_data6.9CNA v4.00.1%2026-10-15
CVE-2026-111134libfwsi heap out-of-bounds read via libfwsi_mtp_file_entry_values_read_data6.9CNA v4.00.1%2026-10-15
CVE-2026-111133libfsapfs heap out-of-bounds read via libfsapfs_key_encrypted_key_read_data6.9CNA v4.00.2%2026-10-15
CVE-2026-111132GNOME libgxps heap out-of-bounds read via path_geometry_start_element6.9CNA v4.00.1%2026-10-15
CVE-2026-111131Libxmp stack out-of-bounds read via P61A Depacker6.9CNA v4.00.2%2026-10-15
CVE-2026-111130OpenSlide heap out-of-bounds read via MIRAX get_tile_position6.9CNA v4.00.1%2026-10-15
CVE-2026-111129Assimp null pointer dereference via Ogre Animation Track6.8CNA v4.00.1%2026-10-15
CVE-2026-111128Assimp null pointer dereference via Ogre Importer Bone Assignment6.8CNA v4.00.2%2026-10-15
CVE-2026-111127catdoc out-of-bounds read via xls2csv copy_unicode_string6.9CNA v4.00.1%2026-10-15
CVE-2026-111126catdoc out-of-bounds read in xls2csv MULRK Record handler6.9CNA v4.00.2%2026-10-15
CVE-2026-111125CFITSIO heap out-of-bounds read via HCOMPRESS input_nnybble6.9CNA v4.00.2%2026-10-15
CVE-2026-111124CFITSIO heap out-of-bounds read via Negative ZDITHER0 Seed6.9CNA v4.00.2%2026-10-15
CVE-2026-111123FluidSynth out-of-bounds write via SoundFont Modulator Destination6.9CNA v4.00.2%2026-10-15