Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,705 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-98907 | Not scored | btrfs: protect sb_write_pointer() with invalidate lock | Oct 23, 2026 |
| CVE-2026-98906 | Not scored | net: lan966x: restore RX state on reload failure | Oct 23, 2026 |
| CVE-2026-98905 | Not scored | drm/amdkfd: Properly acquire queue buffers in CRIU restore | Oct 23, 2026 |
| CVE-2026-98904 | Not scored | mailbox: imx: Use devm_pm_runtime_enable() | Oct 23, 2026 |
| CVE-2026-98903 | Not scored | mailbox: imx: Add a channel shutdown field | Oct 23, 2026 |
| CVE-2026-98902 | Not scored | md/raid5: let stripe batch bm_seq comparison wrap-safe | Oct 23, 2026 |
| CVE-2026-98901 | Not scored | ksmbd: fix lease break and ack state handling | Oct 23, 2026 |
| CVE-2026-98900 | Not scored | xen/gntalloc: validate grant count before allocation | Oct 23, 2026 |
| CVE-2026-98899 | 7.8 High | netfilter: ipset: mark the rcu locked areas properly | Oct 23, 2026 |
| CVE-2026-98898 | Not scored | drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized | Oct 23, 2026 |
| CVE-2026-98897 | Not scored | ksmbd: don't hold ci->m_lock while waiting for a lease break ack | Oct 23, 2026 |
| CVE-2026-112904 | 8.7 High | Vvveb: Path Traversal in nextRestore() and nextBackup() | Oct 23, 2026 |
| CVE-2026-98896 | Not scored | thunderbolt: Keep the domain reference while processing hotplug | Oct 23, 2026 |
| CVE-2026-98895 | 7.0 High | net/mlx5: HWS, Handle destroying table that has a miss table | Oct 23, 2026 |
| CVE-2026-98894 | Not scored | drm/amd/ras: reset CPER ring on corrupt entry size | Oct 23, 2026 |
| CVE-2026-98893 | Not scored | firmware: arm_scmi: Validate SENSOR_UPDATE payload size | Oct 23, 2026 |
| CVE-2026-98892 | Not scored | firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size | Oct 23, 2026 |
| CVE-2026-98891 | Not scored | wifi: mac80211: validate deauth frame length before reason access | Oct 23, 2026 |
| CVE-2026-98890 | Not scored | wifi: libertas: reject short monitor TX frames | Oct 23, 2026 |
| CVE-2026-98889 | 7.8 High | wifi: iwlwifi: mvm: fix sched scan IE sizing | Oct 23, 2026 |
| CVE-2026-98888 | Not scored | arm64: kprobes: Allow reentering kprobes while single-stepping | Oct 23, 2026 |
| CVE-2026-98887 | Not scored | wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO | Oct 23, 2026 |
| CVE-2026-98886 | Not scored | drm/gma500: return errors from Oaktrail HDMI I2C reads | Oct 23, 2026 |
| CVE-2026-98885 | Not scored | ima: return error early if file xattr cannot be changed | Oct 23, 2026 |
| CVE-2026-98884 | Not scored | mmc: core: Add validation for host-provided max_segs | Oct 23, 2026 |
| CVE-2026-98883 | Not scored | serial: 8250_port: recognize UPIO_AU | Oct 23, 2026 |
| CVE-2026-98882 | Not scored | media: chips-media: wave5: Add range checks for dec_output_info | Oct 23, 2026 |
| CVE-2026-98881 | Not scored | net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() | Oct 23, 2026 |
| CVE-2026-98880 | Not scored | ntfs3: handle set_blocksize failures | Oct 23, 2026 |
| CVE-2026-98879 | Not scored | isofs: handle set_blocksize failures | Oct 23, 2026 |
| CVE-2026-98878 | Not scored | irqchip/gic-v5: Immediately exec priority drop following activate | Oct 23, 2026 |
| CVE-2026-98877 | Not scored | irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed | Oct 23, 2026 |
| CVE-2026-98876 | Not scored | host1x: bus: Fix missing ops null check in error teardown | Oct 23, 2026 |
| CVE-2026-98875 | Not scored | drm/nouveau/gsp: add SEC2 to GA100 chip table | Oct 23, 2026 |
| CVE-2026-98874 | Not scored | wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect | Oct 23, 2026 |
| CVE-2026-98873 | Not scored | netfilter: nf_conntrack_expect: zero at allocation time | Oct 23, 2026 |
| CVE-2026-98872 | Not scored | freevxfs: don't BUG() on unknown typed-extent type | Oct 23, 2026 |
| CVE-2026-98871 | Not scored | crypto: ccp - Fix possible deadlock in SEV init failure path | Oct 23, 2026 |
| CVE-2026-98870 | 8.8 High | ksmbd: remove stale channels from all sessions on teardown | Oct 23, 2026 |
| CVE-2026-115727 | 9.2 Critical | AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server | Oct 23, 2026 |
| CVE-2026-115726 | 8.5 High | Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings | Oct 23, 2026 |
| CVE-2026-115725 | 2.3 Low | Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id | Oct 23, 2026 |
| CVE-2026-115724 | 2.1 Low | VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider | Oct 23, 2026 |
| CVE-2026-115723 | 8.3 High | Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion | Oct 23, 2026 |
| CVE-2026-115722 | 6.9 Medium | RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header | Oct 23, 2026 |
| CVE-2026-107685 | 9.1 Critical | WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers | Oct 23, 2026 |
| CVE-2026-95620 | 2.1 Low | Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt | Oct 23, 2026 |
| CVE-2026-94263 | 4.8 Medium | Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message | Oct 23, 2026 |
| CVE-2026-111965 | 4.3 Medium | Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass | Oct 23, 2026 |
| CVE-2026-105963 | 5.1 Medium | Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments | Oct 23, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.