Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,705 vulnerabilities match.

CVESeveritySummary
CVE-2026-989417.0 Highext4: don't enable large folios on encrypted inodes
CVE-2026-98940Not scoredASoC: qcom: lpass-cpu: use DAI table index for playback constraints
CVE-2026-98939Not scoredx86/mm: Drop unnecessary PMD page copy when freeing
CVE-2026-98938Not scoredrust: irq: pass RegistrationInner as cookie to request_irq
CVE-2026-98937Not scoredperf/core: Check kernel access when kernel callchains are requested
CVE-2026-98936Not scoredwifi: ath11k: reset ar->num_stations on hardware start
CVE-2026-98935Not scoredrtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
CVE-2026-98934Not scoredipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
CVE-2026-98933Not scoredusb: hub: use shorter 120ms post resume hold for SS root hubs
CVE-2026-989327.4 HighEDAC/altera: Fix use-after-free in error paths
CVE-2026-98931Not scoredmtd: spinand: fix NULL pointer dereference with no ECC engine
CVE-2026-571178.8 HighPraisonAI: Compute-bridged file tools allow shell command injection
CVE-2026-98930Not scoredKVM: s390: Fix IRQ injection with SIGP Stop and Store Status
CVE-2026-571467.5 HighPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
CVE-2026-98929Not scoredmacsec: initialize SecY before registering the netdevice
CVE-2026-98928Not scoredKVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
CVE-2026-571448.8 HighPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
CVE-2026-571427.8 HighPraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
CVE-2026-571218.1 HighPraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
CVE-2026-571169.8 CriticalPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
CVE-2026-989277.0 HighKVM: arm64: nv: Fix life cycle of the nested_mmus array
CVE-2026-98926Not scoreddrm/amd/display: Remove sink usage from DPMS
CVE-2026-98925Not scoredbpf, sockmap: Fix self-redirect copied_seq double-counting
CVE-2026-571147.2 HighPraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
CVE-2026-571138.1 HighPraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
CVE-2026-98924Not scoredfs: avoid repeated scans in evict_inodes()
CVE-2026-98923Not scoredarm64: io: Reject non-user protection in ioremap_prot()
CVE-2026-98922Not scorednet: emac: move setting of netops to fix crash
CVE-2026-98921Not scoredovl: fix UAF in ovl_do_mkdir() debug print
CVE-2026-98920Not scorednetfs: Fix missing alloc tagging of direct mempool allocations
CVE-2026-98919Not scoreddrm/xe: harden adjust_idledly() against divide-by-zero and overflow
CVE-2026-98918Not scoredmm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()
CVE-2026-98917Not scoredparisc: Increase kernel stack size to 32kb
CVE-2026-568408.8 HighPraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
CVE-2026-568387.8 HighPraisonAI recipe.run_stream skips dangerous-tool policy enforcement
CVE-2026-568378.6 HighPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
CVE-2026-568368.2 HighPraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
CVE-2026-568358.3 HighPraisonAI Slack app_mention bypasses configured user/channel authorization
CVE-2026-568347.5 HighPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
CVE-2026-568337.5 HighPraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
CVE-2026-568328.8 HighPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
CVE-2026-98916Not scoredwifi: nl80211: check link is beaconing for color change
CVE-2026-98915Not scoredmedia: video-i2c: use vb2_video_unregister_device on driver removal
CVE-2026-98914Not scoreddrm/amdgpu: cap ATOM command table nesting depth
CVE-2026-98913Not scorednet: thunderx: fix PTP device ref leak in nicvf_probe()
CVE-2026-98912Not scoredALSA: seq: oss: Reject reads that cannot fit the next event
CVE-2026-989117.5 Highdpaa2-switch: fix the error path in dpaa2_switch_rx()
CVE-2026-98910Not scoreddrm/amdkfd: Unwind debug trap enable on copy_to_user failure
CVE-2026-98909Not scorednet: cpsw_new: unregister devlink on port registration failure
CVE-2026-98908Not scorednet: microchip: sparx5: clean up PSFP resources on flower setup failure

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.