CVE-2026-90779 - SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when process

CVE-2026-90778 - SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processi

CVE-2026-90777 - ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=Fa

CVE-2026-90776 - Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the ad

CVE-2026-90775 - PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-suppli

CVE-2026-90518 - A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an

CVE-2026-90517 - A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unkn

CVE-2026-90516 - A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected ele

CVE-2026-90515 - A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacte

CVE-2026-90774 - rustypaste before 0.18.1 validates the destination path before applying the optional custom filename

CVE-2026-90773 - procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying

CVE-2026-90772 - Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslyS

CVE-2026-90771 - joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages

CVE-2026-90770 - Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that in

CVE-2026-90769 - Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allow

CVE-2026-90768 - CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authe

CVE-2026-90767 - Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() en

CVE-2026-90562 - LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no

CVE-2026-90561 - Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulne

CVE-2026-90514 - A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is

CVE-2026-90513 - A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953

CVE-2026-90511 - A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb958

CVE-2026-90510 - A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the func

CVE-2026-90509 - A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the fun

CVE-2026-90508 - A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by

CVE-2026-90507 - A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae8641105

CVE-2026-90506 - A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae8641105

CVE-2026-90505 - A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.

CVE-2026-90504 - A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae8641105

CVE-2026-90503 - A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is th

CVE-2026-90502 - A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of

CVE-2026-90501 - A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the functio

CVE-2026-90500 - A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function Fa

CVE-2026-90499 - A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoContr

CVE-2026-90498 - A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown fun

CVE-2026-90497 - A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerab

CVE-2026-90496 - A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updat

CVE-2026-89080 - The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated reques

CVE-2026-88995 - The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restri

CVE-2026-88912 - The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check owne

CVE-2026-88764 - The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supp

CVE-2026-86407 - The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor r

CVE-2026-86406 - The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of t

CVE-2026-80072 - The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination

CVE-2026-80071 - The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may

CVE-2026-77773 - The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perf

CVE-2026-90679 - Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that

CVE-2026-90678 - An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitatio

CVE-2026-90495 - A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function

CVE-2026-90494 - A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in

CVE-2026-90493 - A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The

CVE-2026-90668 - The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP reque

CVE-2026-90492 - A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected eleme

CVE-2026-90491 - A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySu

CVE-2026-90490 - A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown proce

CVE-2026-90651 - Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify u

CVE-2026-90648 - wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily in

CVE-2026-90489 - A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown co

CVE-2026-90488 - A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClass

CVE-2026-90647 - ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper ce

CVE-2026-90487 - A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown fun

CVE-2026-90486 - A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d

CVE-2026-79300 - SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured

CVE-2026-90485 - A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_118

CVE-2026-90616 - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to fi

CVE-2026-90560 - zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDict

CVE-2026-90559 - snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(Byte

CVE-2026-90558 - sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting rout

CVE-2026-90557 - Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_u

CVE-2026-90556 - Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing save

CVE-2026-90555 - vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint

CVE-2026-90554 - vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extract

CVE-2026-90553 - vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor l

CVE-2026-90552 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist owner

CVE-2026-90551 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist owner

CVE-2026-90550 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorizatio

CVE-2026-90549 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize acce

CVE-2026-90548 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissio

CVE-2026-90547 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissio

CVE-2026-90546 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access p

CVE-2026-90545 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access p

CVE-2026-90544 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access p

CVE-2026-90543 - WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin ena

CVE-2026-90542 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in

CVE-2026-90541 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication

CVE-2026-90540 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissi

CVE-2026-90539 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authenticatio

CVE-2026-90538 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization

CVE-2026-90537 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization

CVE-2026-90536 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the

CVE-2026-90535 - Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api

CVE-2026-90534 - Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3,

CVE-2026-90533 - Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser

CVE-2026-15451 - The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in ver

CVE-2026-10148 - The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-

CVE-2026-90474 - MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 autho

CVE-2026-90473 - msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue(

CVE-2026-90472 - msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue()

CVE-2026-89172 - Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, an

CVE-2026-85200 - The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and

CVE-2026-85198 - The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vul

CVE-2026-78175 - The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Objec

CVE-2026-78159 - The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions

CVE-2026-78006 - The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions

CVE-2026-77161 - The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Inje

CVE-2026-17585 - The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vuln

CVE-2026-16482 - The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based b

CVE-2026-11355 - The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modificatio

CVE-2026-87919 - The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which

CVE-2026-87918 - The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on severa

CVE-2026-87916 - The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX

CVE-2026-87894 - The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check

CVE-2026-87892 - The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the se

CVE-2026-87891 - The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or author

CVE-2026-87888 - The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST rout

CVE-2026-87842 - The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check be

CVE-2026-87797 - The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership chec

CVE-2026-87759 - The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check

CVE-2026-86790 - The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before o

CVE-2026-85681 - The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one

CVE-2026-84171 - The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of u

CVE-2026-84099 - The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a

CVE-2026-84047 - The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parame

CVE-2026-84025 - The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that r

CVE-2026-84024 - The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field co

CVE-2026-84023 - The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities befo

CVE-2026-83532 - The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several sh

CVE-2026-82851 - The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type

CVE-2026-82847 - The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fiel

CVE-2026-82845 - The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metad

CVE-2026-81742 - The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before

CVE-2026-81429 - The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF c

CVE-2026-81402 - The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verifica

CVE-2026-81090 - The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploa

CVE-2026-80494 - The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before

CVE-2026-80491 - The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input befor

CVE-2026-78152 - The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email ad

CVE-2026-77753 - The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user

CVE-2026-77752 - The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user req

CVE-2026-77705 - The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify tha

CVE-2026-77689 - The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that

CVE-2026-77006 - The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does

CVE-2026-77005 - The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file pa

CVE-2026-75800 - The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML

CVE-2026-87719 - GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 b

CVE-2026-85706 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.

CVE-2026-90467 - aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing att

CVE-2026-89268 - QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attribut

CVE-2026-89267 - starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when

CVE-2026-89266 - stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multip

CVE-2026-90461 - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when I

CVE-2026-90460 - An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentic

CVE-2026-90457 - The administrative password is hashed using a comparatively weak, fast algorithm for the credential

CVE-2026-90456 - An example environment-configuration file for a bundled inventory-management component ships with a

CVE-2026-90455 - A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilit

CVE-2026-90454 - A deployment mode intended to expose only read access to a bundled packet-analysis component's inter

CVE-2026-90453 - A file-upload handler redirects the authenticated client's browser to a URL taken directly from that

CVE-2026-90452 - Requests from the reverse proxy to the identity-provider service for token discovery, introspection,

CVE-2026-90451 - An example environment-configuration file ships with a fixed, publicly-known secret value used to si

CVE-2026-90450 - The application's role-authorization lookup defaults to granting access when a request handler's nam

CVE-2026-90449 - When a particular authentication mode is configured, the reverse proxy forwards requests for a bundl

CVE-2026-90448 - A deployment mode intended to expose only read access to stored data proxies a set of application pr

CVE-2026-90447 - A routing rule selects between two different authentication mechanisms for the same downstream servi

CVE-2026-90446 - An application programming interface endpoint accepts a user-supplied value and interpolates it dire

CVE-2026-90445 - An interface that accepts file uploads from authenticated users extracts the contents of uploaded ar

CVE-2026-90444 - A file-transfer interface that requires valid credentials accepts attacker-controlled filenames with

CVE-2026-90443 - A web interface reflects a portion of the request URL into a script context and a hyperlink attribut

CVE-2026-54258 - ZoneMinder is a free, open source closed-circuit television software application. Versions prior to

CVE-2026-54248 - Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose p

CVE-2026-54241 - libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use sign

CVE-2026-54240 - libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use sign

CVE-2026-50018 - Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions u

CVE-2026-50013 - Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in

CVE-2026-49992 - Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cr

CVE-2026-49846 - libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()

CVE-2026-48496 - OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple p

CVE-2026-45056 - matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encry

CVE-2026-44715 - OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.

CVE-2026-81918 - Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute

CVE-2026-81917 - Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields

CVE-2026-81907 - Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clea

CVE-2026-68535 - Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block ty

CVE-2026-54174 - melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9,

CVE-2026-54166 - Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with

CVE-2026-54165 - Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03

CVE-2026-50025 - Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to

CVE-2026-49865 - Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side re

CVE-2026-49464 - NL Portal Backend Libraries provide backend components for Dutch government portals that interact wi

CVE-2026-49439 - OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted dat

CVE-2026-48490 - ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform.

CVE-2026-47773 - ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.

CVE-2026-45057 - matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation

CVE-2026-89773 - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HD

CVE-2026-89772 - In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios dur

CVE-2026-89771 - In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize

CVE-2026-89770 - In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity pay

CVE-2026-89769 - In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fi

CVE-2026-89768 - In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested bac

CVE-2026-89767 - In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating()

CVE-2026-89766 - In the Linux kernel, the following vulnerability has been resolved: pidfd: hold exec_update_lock ar

CVE-2026-89765 - In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old it

CVE-2026-89764 - In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between

CVE-2026-89763 - In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown

CVE-2026-89762 - In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused b

CVE-2026-89761 - In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds wri

CVE-2026-89760 - In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernat

CVE-2026-89759 - In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup

CVE-2026-89758 - In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present

CVE-2026-89757 - In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redund

CVE-2026-89756 - In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks qu

CVE-2026-89755 - In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale

CVE-2026-89754 - In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->ac

CVE-2026-89753 - In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks qui

CVE-2026-89752 - In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a

CVE-2026-89751 - In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port

CVE-2026-89750 - In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copi

CVE-2026-89749 - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_

CVE-2026-89748 - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion i

CVE-2026-89747 - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in

CVE-2026-89746 - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free wit

CVE-2026-89745 - In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for

CVE-2026-89744 - In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite l

CVE-2026-89743 - In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-rep

CVE-2026-89742 - In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-af

CVE-2026-89741 - In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix er

CVE-2026-89740 - In the Linux kernel, the following vulnerability has been resolved: serial: imx: serialize imx_uart

CVE-2026-89739 - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-afte

CVE-2026-89738 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain po

CVE-2026-89737 - In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disabl

CVE-2026-89736 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-a

CVE-2026-89735 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove defa

CVE-2026-89734 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null poin

CVE-2026-89733 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling

CVE-2026-89732 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Prevent dead

CVE-2026-89731 - In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_in

CVE-2026-89730 - In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-

CVE-2026-89729 - In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bou

CVE-2026-89728 - In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds

CVE-2026-89727 - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN o

CVE-2026-89726 - In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-b

CVE-2026-89725 - In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-

CVE-2026-89724 - In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-boun

CVE-2026-89723 - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds

CVE-2026-89722 - In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds re

CVE-2026-89721 - In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fi

CVE-2026-89720 - In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read i

CVE-2026-89719 - In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access

CVE-2026-89718 - In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access

CVE-2026-89717 - In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compr

CVE-2026-89716 - In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params