UpHeron
All posts

Daily summary

Vulnerabilities of 30 October 2026: 497 new, 13 critical, 1 newly exploited

497 vulnerabilities added on 30 October 2026, 13 critical and 89 high: Linux kernel (334), .NET (33), PHP object injection in WordPress plugins and more. 1 vulnerability newly listed as exploited by CISA.

  • 13 critical
  • 89 high
  • 83 medium
  • 6 low
  • 306 unrated
  • 1 newly exploited

Newly listed as exploited

Added to CISA's Known Exploited Vulnerabilities catalog: attackers use it.

  1. 10.0GitLabInteger Overflow or Wraparound in GitLabExploitedFixed in 19.3.5, 19.4.2CVE-2026-97229

Linux kernel

334 vulnerabilities · Servers and applications · most fixed in 5.15.224, 6.1.191, 6.6.160

  1. 9.8net: openvswitch: conntrack: fix helper UAF due to extensions reallocFixed in 6.18.55, 7.2.9CVE-2026-98490
  2. 9.8ipv4: free inet_opt and ireq_opt after an RCU grace periodFixed in 6.18.56, 7.2.10CVE-2026-98432
  3. 9.1tcp: prevent collapsing skbs across boundary in rtx queueFixed in 6.18.55, 7.2.9CVE-2026-98549
  4. 8.8ksmbd: fix heap out-of-bounds write in krb5_authenticate()Fixed in 6.18.58, 7.2.12CVE-2026-99083
  5. 8.8KVM: x86: Use active memslots for the per-vCPU MMIO cacheFixed in 6.18.58, 7.2.12CVE-2026-99082
Show 329 more
  1. 8.8namespace: unhash a dentry before detaching the mounts on itFixed in 6.18.57, 7.2.11CVE-2026-98981
  2. 8.8smb: client: use finish_no_open() for non-regular inodesFixed in 6.18.56, 7.2.9CVE-2026-98451
  3. 8.8smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUsFixed in 6.18.54, 7.2.8CVE-2026-98171
  4. 8.1amt: send the relay's General Query directly from the receive pathFixed in 6.18.57, 7.2.11CVE-2026-98968
  5. 8.1smb: client: fix create context out-of-bounds readsFixed in 6.18.55, 7.2.9CVE-2026-98454
  6. 7.8strparser: make sure __strp_recv isn't running before tearing down the parserFixed in 6.18.57, 7.2.11CVE-2026-99056
  7. 7.8tipc: destroy topsrv workqueues before closing connectionsFixed in 6.18.57, 7.2.11CVE-2026-99054
  8. 7.8tipc: hold a reference to nodes found by link nameFixed in 6.18.57, 7.2.11CVE-2026-99053
  9. 7.8net/smc: protect clcsock lifetime in smc_getnameFixed in 6.18.57, 7.2.11CVE-2026-99032
  10. 7.8Bluetooth: ISO: Serialize concurrent connect callsFixed in 6.18.57, 7.2.11CVE-2026-99012
  11. 7.8drm/i915/gem: Prevent overstepping exec array boundaryFixed in 6.18.57, 7.2.11CVE-2026-99006
  12. 7.8drm/vmwgfx: validate pitch coming from userspaceFixed in 6.18.57, 7.2.11CVE-2026-99002
  13. 7.8namespace: don't inherit MNT_UMOUNT in clone_mnt()Fixed in 6.18.57, 7.2.11CVE-2026-98993
  14. 7.8HID: steam: Refactor registrationFixed in 6.18.57, 7.2.11CVE-2026-98944
  15. 7.8mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publishFixed in 6.18.55, 7.2.9CVE-2026-98507
  16. 7.8xfs: fix cursor and pointer handling when recovering iunlink bucketsFixed in 6.18.55, 7.2.9CVE-2026-98443
  17. 7.8exec: Cleanup POSIX timers right after de_thread()Fixed in 6.18.54, 7.2.8CVE-2026-98260
  18. 7.7wireguard: noise: reject response consumption after intermediate initiationFixed in 6.18.57, 7.2.11CVE-2026-99059
  19. 7.5bnxt_en: fix DMA mapping length for padded small packetsFixed in 6.18.57, 7.2.11CVE-2026-99081
  20. 7.5nvmet: use the local P2P device on metadata allocation failureFixed in 6.18.57, 7.2.11CVE-2026-98964
  21. 7.5smb: client: fix use-after-free of iface in cifs_try_adding_channels()Fixed in 6.18.54, 7.2.8CVE-2026-98173
  22. 7.4ipv4: udp: Create exceptions before socket matchingFixed in 6.18.59, 7.2.11CVE-2026-99077
  23. 7.1smb: client: fix potential OOB read in smb3_enum_snapshots()Fixed in 6.18.54, 7.2.8CVE-2026-98169
  24. 7.0Bluetooth: mgmt: fix race in read_unconf_index_list()Fixed in 6.18.55, 7.2.9CVE-2026-98456
  25. –Drivers: hv: Don't reset VMBus connection state on error/exit pathsFixed in 6.18.59, 7.2.13CVE-2026-99216
  26. –power: supply: core: prevent unregistering a power supply while a callback runsFixed in 6.18.59, 7.2.13CVE-2026-99215
  27. –drm/vc4: hdmi: Move packet RAM enable to PM runtimeFixed in 6.18.59, 7.2.13CVE-2026-99214
  28. –vsock: treat TCP_CLOSING as once-establishedFixed in 6.18.59, 7.2.13CVE-2026-99213
  29. –net/rds: don't let the rdma_cm destroy an id RDS still owns on route failureFixed in 6.18.59, 7.2.13CVE-2026-99212
  30. –accel/rocket: clear rdev on device init failureFixed in 6.18.59, 7.2.13CVE-2026-99210
  31. –netlink: reset skb headers before unicast and multicast filteringFixed in 6.18.59, 7.2.13CVE-2026-99211
  32. –drm/xe: skip eviction of a BO with no resourceFixed in 6.18.59, 7.2.13CVE-2026-99209
  33. –drm/xe/oa: Zero OA buffer at allocationFixed in 6.18.59, 7.2.13CVE-2026-99208
  34. –scsi: target: Disable interrupts while holding delayed_cmd_lockFixed in 7.2.13CVE-2026-99207
  35. –sched/core: Call wakeup_preempt() for queued tasks during class changeFixed in 7.2.13CVE-2026-99205
  36. –scsi: target: iscsi: Fix race in discovery auth updatesFixed in 6.18.59, 7.2.13CVE-2026-99206
  37. –ocfs2/dlm: Protect the recovery list during debugfs readsFixed in 6.18.59, 7.2.13CVE-2026-99204
  38. –pipe: preserve existing fasync readers on writer setup failureFixed in 6.18.59, 7.2.13CVE-2026-99203
  39. –netlink: avoid hashing the network namespace pointerFixed in 6.18.59, 7.2.13CVE-2026-99201
  40. –scsi: libsas: Fix SMP IO deadlock during HA resumeFixed in 7.2, 7.2.13CVE-2026-99202
  41. –net: hisilicon: hisi_femac: Move setting of netops to fix crashFixed in 7.2.13CVE-2026-99200
  42. –net: hisilicon: hip04_eth: Move setting of netops to fix crashFixed in 7.2.13CVE-2026-99199
  43. –net: ethernet: actions: Move setting of netops to fix crashFixed in 7.2.13CVE-2026-99198
  44. –net: au1000: move setting of netops to fix crashFixed in 7.2.13CVE-2026-99196
  45. –net: mv643xx: move setting of netops to fix crashFixed in 7.2.13CVE-2026-99197
  46. –net: ethoc: move setting of netops to fix crashFixed in 7.2.13CVE-2026-99195
  47. –net: ethernet: aeroflex: move setting of netops to fix crashFixed in 7.2.13CVE-2026-99194
  48. –net: ti: icssm-prueth: Move setting of netops to fix crashFixed in 7.2.13CVE-2026-99193
  49. –net: bcmgenet: unshare the skb before writing the control blockFixed in 6.18.59, 7.2.13CVE-2026-99192
  50. –gpiolib: fix memory leak in gpiod_set_array_value_complex() on error pathsFixed in 6.18.59, 7.2.13CVE-2026-99190
  51. –calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()Fixed in 6.18.59, 7.2.13CVE-2026-99191
  52. –gpio: mxc: fix race between chained IRQ handler install and probe completionFixed in 6.18.59, 7.2.13CVE-2026-99189
  53. –net: stmmac: dwmac1000: clear the RGMII status interruptFixed in 7.2.13CVE-2026-99188
  54. –x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()Fixed in 7.2.13CVE-2026-99186
  55. –perf: Fix perf_pmu_migrate_context() leaving events behindFixed in 6.18.59, 7.2.13CVE-2026-99187
  56. –firewire: core: fix race condition in split transaction handlingFixed in 7.2.13CVE-2026-99185
  57. –accel/rocket: search every core slot when a core is removedFixed in 6.18.59, 7.2.13CVE-2026-99184
  58. –accel/rocket: search every core slot when looking up a schedulerFixed in 7.2.13CVE-2026-99183
  59. –ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH captureFixed in 6.18.59, 7.2.13CVE-2026-99182
  60. –autofs: ignore notification errors from a replaced pipeFixed in 6.18.59, 7.2.13CVE-2026-99181
  61. –unicode: free the map after a grace periodFixed in 6.18.59, 7.2.13CVE-2026-99180
  62. –watch_queue: Fix note pool publication race in watch_queue_set_size()Fixed in 6.18.59, 7.2.13CVE-2026-99179
  63. –KVM: SEV: Fix page dirtying in sev_gmem_post_populate()Fixed in 7.2.13CVE-2026-99177
  64. –x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI contextFixed in 6.18.59, 7.2.13CVE-2026-99178
  65. –KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-EntryFixed in 6.18.59, 7.2.13CVE-2026-99176
  66. –fsnotify: prevent mark additions during connector teardownFixed in 6.18.59, 7.2.13CVE-2026-99175
  67. –eventfs: Free the eventfs_inode after an rcu grace period tooFixed in 6.18.59, 7.2.13CVE-2026-99173
  68. –ext4: free the sbi after a grace periodFixed in 6.18.59, 7.2.13CVE-2026-99174
  69. –ipc: drop the mqueue mount with kern_unmount() on setup failureFixed in 7.2.13CVE-2026-99172
  70. –ntfs3: free the sbi after a grace periodFixed in 6.18.59, 7.2.13CVE-2026-99171
  71. –namespace: a mount that copy_tree() leaves out can't take over a lockFixed in 7.2.13CVE-2026-99170
  72. –futex: Fix mm reuse handling for FUT_OFF_MMSHAREDFixed in 6.18.59, 7.2.13CVE-2026-99169
  73. –mshv_vtl: Check per-CPU register page before mmapFixed in 7.2.13CVE-2026-99168
  74. –net: rds: fix uninitialized trans dereference in CM event handlerFixed in 6.18.59, 7.2.13CVE-2026-99166
  75. –net/sched: fix use-after-free in __tcf_action_put()Fixed in 6.18.59, 7.2.13CVE-2026-99167
  76. –sctp: revalidate output stream after association connect waitFixed in 6.18.59, 7.2.13CVE-2026-99165
  77. –spi: imx: fix slab corruption from undersized DMA bounce buffersFixed in 7.2.13CVE-2026-99164
  78. –tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fieldsFixed in 6.18.59, 7.2.13CVE-2026-99163
  79. –gpio: shared: fix use-after-free bug when adding shared proxiesFixed in 7.2.13CVE-2026-99162
  80. –ring-buffer: Do not show buffer_meta for CPUs without a bufferFixed in 6.18.59, 7.2.13CVE-2026-99160
  81. –i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()Fixed in 6.18.59, 7.2.13CVE-2026-99161
  82. –ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()Fixed in 6.18.59, 7.2.13CVE-2026-99159
  83. –scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB repliesFixed in 6.18.59, 7.2.13CVE-2026-99157
  84. –ring-buffer: Fix false warning in ring_buffer_map_get_reader()Fixed in 6.18.59, 7.2.13CVE-2026-99158
  85. –scsi: st: Fix use-after-free race between st_remove() and st_open()Fixed in 6.18.59, 7.2.13CVE-2026-99156
  86. –scsi: xen/scsifront: Check for a NULL shadow entry on a backend responseFixed in 6.18.59, 7.2.13CVE-2026-99155
  87. –scsi: libiscsi: Validate the ITT reflected in a Reject PDUFixed in 6.18.59, 7.2.13CVE-2026-99153
  88. –scsi: libiscsi: Reject a negative task index from parse_pdu_ittFixed in 6.18.59, 7.2.13CVE-2026-99154
  89. –scsi: libiscsi: Validate the task named by a management responseFixed in 6.18.59, 7.2.13CVE-2026-99152
  90. –drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functionsFixed in 7.2.13CVE-2026-99151
  91. –drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctlFixed in 7.2.13CVE-2026-99149
  92. –drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gprFixed in 6.18.59, 7.2.13CVE-2026-99150
  93. –drm/amdgpu: keep the eviction fence until the last handle is closedFixed in 6.18.59, 7.2.13CVE-2026-99148
  94. –drm/exec: don't immediately add prelocked obj to array of locked objsFixed in 6.18.59, 7.2.13CVE-2026-99147
  95. –drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state changeFixed in 7.2.13CVE-2026-99145
  96. –drm/i915/dmc: Add sanity check for DMC load addressFixed in 6.18.59, 7.2.13CVE-2026-99146
  97. –sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueueFixed in 7.2.13CVE-2026-99144
  98. –tracing: Keep the predicate limit separate from program capacityFixed in 6.18.59, 7.2.13CVE-2026-99143
  99. –tracing: Check operator stack capacity before pushingFixed in 6.18.59, 7.2.13CVE-2026-99142
  100. –tracing: Fix crash in print_graph_function_event()Fixed in 7.2.13CVE-2026-99141
  101. –tracing: Fix hist trigger timestamps for buffered eventsFixed in 6.18.59, 7.2.13CVE-2026-99140
  102. –tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)Fixed in 6.18.59, 7.2.13CVE-2026-99139
  103. –cifs: don't update i_size in cifs_do_truncate without a cached handleFixed in 6.18.59, 7.2.13CVE-2026-99137
  104. –tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)Fixed in 6.18.59, 7.2.13CVE-2026-99138
  105. –dm-crypt: fix a tiny race condition in crypt_dec_pendingFixed in 6.18.59, 7.2.13CVE-2026-99136
  106. –mac802154: fix data race and NULL deref on local->assoc_devFixed in 6.18.59, 7.2.13CVE-2026-99134
  107. –dm-integrity: fix infinite loop on discard with large tag sizeFixed in 6.18.59, 7.2.13CVE-2026-99135
  108. –net/iucv: fix the recvmsg window updateFixed in 6.18.59, 7.2.13CVE-2026-99133
  109. –xfs: fix capability check in xfsFixed in 6.18.59, 7.2.13CVE-2026-99131
  110. –xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_bufFixed in 6.18.59, 7.2.13CVE-2026-99132
  111. –io_uring/cancel: don't spin on local work the task can't runFixed in 6.18.59, 7.2.13CVE-2026-99130
  112. –sctp: validate chunk length in the inqueue parserFixed in 6.18.59, 7.2.13CVE-2026-99128
  113. –selinux: fix BPF token permission checksFixed in 7.2.13CVE-2026-99129
  114. –page_pool: keep frag_offset aligned for odd-sized requestsFixed in 6.18.59, 7.2.13CVE-2026-99127
  115. –s390/pai: Handle multiple PMU stop callback invocationsFixed in 7.2.13CVE-2026-99125
  116. –s390/ctcm: Prevent XID null dereferenceFixed in 6.18.59, 7.2.13CVE-2026-99126
  117. –s390/pci: Fix leak of uninitialized kernel data in SCLP reportFixed in 6.18.59, 7.2.13CVE-2026-99124
  118. –vsock/virtio: validate packet source for connected socketsFixed in 6.18.59, 7.2.13CVE-2026-99123
  119. –ipv4: avoid divide by zero in fib_rebalanceFixed in 6.18.59, 7.2.13CVE-2026-99121
  120. –vsock/vmci: validate packet source for connected socketsFixed in 6.18.59, 7.2.13CVE-2026-99122
  121. –KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codesFixed in 6.18.59, 7.2.13CVE-2026-99120
  122. –drm/amdgpu/userq: actually validate userq BOsFixed in 7.2.13CVE-2026-99119
  123. –drm/i915/dmc: Harden DMC firmware payload parsingFixed in 6.18.59, 7.2.13CVE-2026-99118
  124. –net: psp: do not inherit the Rx association on cloneFixed in 6.18.59, 7.2.13CVE-2026-99116
  125. –net: bridge: mcast: don't truncate the port group walk on teardownFixed in 6.18.59, 7.2.13CVE-2026-99117
  126. –ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATIONFixed in 6.18.59, 7.2.13CVE-2026-99115
  127. –ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATIONFixed in 6.18.59, 7.2.13CVE-2026-99114
  128. –ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it inFixed in 6.18.59, 7.2.13CVE-2026-99113
  129. –smb: client: fix data corruption with concurrent writes and O_TRUNCFixed in 6.18.59, 7.2.13CVE-2026-99111
  130. –net/sched: cls_flower: validate mask pointer after nla_next()Fixed in 6.18.59, 7.2.13CVE-2026-99112
  131. –smb: client: fix heap overflow in cifs_do_set_acl()Fixed in 6.18.59, 7.2.13CVE-2026-99110
  132. –smb: client: reject SetEA requests that do not fit the request bufferFixed in 7.2.13CVE-2026-99109
  133. –ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resizeFixed in 7.2.13CVE-2026-99107
  134. –ntfs: fix FITRIM range alignmentFixed in 7.2.13CVE-2026-99108
  135. –drm/amdgpu: free the userptr ranges when a CS fails after parser_bosFixed in 6.18.59, 7.2.13CVE-2026-99106
  136. –sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQFixed in 6.18.59, 7.2.13CVE-2026-99105
  137. –sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestorFixed in 7.2.13CVE-2026-99104
  138. –workqueue: Fix unbound pool lifetime for pending pwqsFixed in 6.18.59, 7.2.13CVE-2026-99103
  139. –ntfs: take invalidate_lock in ntfs_setattr_size()Fixed in 7.2.13CVE-2026-99102
  140. –ntfs: move attribute payload before shrinking its recordFixed in 7.2.13CVE-2026-99101
  141. –wifi: p54: validate firmware record lengthsFixed in 6.18.59, 7.2.13CVE-2026-99100
  142. –drm/vc4: drain the hangcheck timer and works on V3D unbindFixed in 6.18.57, 7.2.11CVE-2026-99095
  143. –Bluetooth: MGMT: Fix status of pending commands flushed on power offFixed in 6.18.57, 7.2.11CVE-2026-99091
  144. –ASoC: samsung: i2s: enable op_clk in probe to balance runtime PMFixed in 6.18.57, 7.2.11CVE-2026-99089
  145. –net: openvswitch: validate transport header presence in set_ipv6_addrFixed in 6.18.57, 7.2.11CVE-2026-99088
  146. –fs: Free any excess xarray nodes in clear_inode()Fixed in 6.18.57, 7.2.11CVE-2026-99080
  147. –ipv4: stop PMTU walk when nexthop group shrinksFixed in 6.18.57, 7.2.11CVE-2026-99074
  148. –ipv4: stop route notification sizing when nexthop group shrinksFixed in 6.18.57, 7.2.11CVE-2026-99072
  149. –ipv4: do not warn on route notification size raceFixed in 6.18.57, 7.2.11CVE-2026-99071
  150. –ipv6: do not warn on route notification size raceFixed in 6.18.57, 7.2.11CVE-2026-99070
  151. –btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()Fixed in 6.18.57, 7.2.11CVE-2026-99067
  152. –dm ioctl: don't let data_start run past the bufferFixed in 6.18.57, 7.2.11CVE-2026-99063
  153. –wifi: brcmfmac: fix P2P device removal race in brcmf_detach()Fixed in 6.18.57, 7.2.11CVE-2026-99061
  154. –workqueue: Fix NULL current_pwq deref in chained work checkFixed in 6.18.57, 7.2.11CVE-2026-99058
  155. –xen/netfront: don't leak the skb when xennet_fill_frags() failsFixed in 6.18.57, 7.2.11CVE-2026-99057
  156. –selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_optsFixed in 6.18.57, 7.2.11CVE-2026-99052
  157. –gpio: xilinx: fix runtime PM leak on request error pathFixed in 6.18.57, 7.2.11CVE-2026-99049
  158. –ibmveth: h_free logical LAN on open-fail after registerFixed in 6.18.57, 7.2.11CVE-2026-99045
  159. –ice: fix metadata_dst refcount handling on representor teardownFixed in 6.18.57, 7.2.11CVE-2026-99043
  160. –ip6_gre: remove obsolete ERSPAN PMTU updateFixed in 6.18.58, 7.2.11CVE-2026-99041
  161. –KEYS: Fix add_key() race with keyring restrictionFixed in 6.18.57, 7.2.11CVE-2026-99040
  162. –memstick: core: wait for request completion before freeing cardFixed in 6.18.57, 7.2.11CVE-2026-99039
  163. –memstick: rtsx_usb_ms: complete requests after eject instead of dropping themFixed in 6.18.57, 7.2.11CVE-2026-99038
  164. –dm-crypt: reject the lmk IV mode with AEAD ciphersFixed in 6.18.57, 7.2.11CVE-2026-99037
  165. –dm: fix reading free memory in do_resumeFixed in 6.18.57, 7.2.11CVE-2026-99036
  166. –mmc: mtk-sd: Cancel request timeout work on removeFixed in 6.18.57, 7.2.11CVE-2026-99035
  167. –mmc: sdhci-sprd: disable runtime PM on removeFixed in 6.18.57, 7.2.11CVE-2026-99034
  168. –net/packet: guard the ll header push in packet_rcv_spkt()Fixed in 6.18.57, 7.2.11CVE-2026-99033
  169. –net: bridge: avoid recursive multicast port cleanupFixed in 6.18.57, 7.2.11CVE-2026-99031
  170. –net: team: stop reusing skb after queue overrideFixed in 6.18.57, 7.2.11CVE-2026-99027
  171. –openvswitch: fix soft lockup in the netlink flow dumpFixed in 6.18.57, 7.2.11CVE-2026-99025
  172. –optee: register TEE devices only once fully initializedFixed in 6.18.57, 7.2.11CVE-2026-99024
  173. –regulator: ltc3676: don't read the write-only HRST and CLIRQ registersFixed in 6.18.57, 7.2.11CVE-2026-99022
  174. –scsi: ch: Do not keep references to data transfer element devicesFixed in 6.18.58, 7.2.11CVE-2026-99019
  175. –Bluetooth: hci_sock: Serialize dead-device detachmentFixed in 6.18.57, 7.2.11CVE-2026-99015
  176. –Bluetooth: RFCOMM: free the skb when the DLC has no ownerFixed in 6.18.57, 7.2.11CVE-2026-99010
  177. –Bluetooth: RFCOMM: connect the session socket without rfcomm_mutexFixed in 6.18.58, 7.2.11CVE-2026-99009
  178. –Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdownFixed in 6.18.57, 7.2.11CVE-2026-99008
  179. –drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAINFixed in 6.18.57, 7.2.11CVE-2026-99007
  180. –drm/i915/gt: Unmask interrupts only when ACTIVE is trueFixed in 6.18.57, 7.2.11CVE-2026-99005
  181. –namespace: don't copy an unmounted mount treeFixed in 6.18.57, 7.2.11CVE-2026-98992
  182. –namespace: check a submount for references right before unmounting itFixed in 6.18.57, 7.2.11CVE-2026-98990
  183. –namespace: check the mounts before reading their parents in pivot_root()Fixed in 6.18.57, 7.2.11CVE-2026-98985
  184. –dcache: don't put a mountpoint on a dentry that's being removedFixed in 6.18.57, 7.2.11CVE-2026-98984
  185. –namespace: refuse an automount below a mount that is in no namespaceFixed in 6.18.57, 7.2.11CVE-2026-98979
  186. –namespace: handle mount locking for automounts correctlyFixed in 6.18.57, 7.2.11CVE-2026-98977
  187. –gpio: exar: initialize the ID before registering its cleanupFixed in 6.18.57, 7.2.11CVE-2026-98971
  188. –drm/vc4: Free the BO cache size list on teardownFixed in 6.18.57, 7.2.11CVE-2026-98970
  189. –net/sched: em_text: reject unterminated algo before autoloadFixed in 6.18.57, 7.2.11CVE-2026-98969
  190. –cxgb4/ch_ktls: disable softirqs around tid_list erasesFixed in 6.18.57, 7.2.11CVE-2026-98967
  191. –ASoC: adau1372: allow sleepy powerdown GPIOsFixed in 6.18.57, 7.2.11CVE-2026-98956
  192. –flow_dissector: avoid u16 truncation of skb->len when computing thoffFixed in 6.18.57, 7.2.11CVE-2026-98955
  193. –flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()Fixed in 6.18.57, 7.2.11CVE-2026-98950
  194. –ASoC: qcom: lpass-cpu: use DAI table index for playback constraintsFixed in 6.18.56, 7.2.10CVE-2026-98940
  195. –wifi: ath11k: reset ar->num_stations on hardware startFixed in 6.18.56, 7.2.10CVE-2026-98936
  196. –rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leakFixed in 6.18.56, 7.2.10CVE-2026-98935
  197. –ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()Fixed in 6.18.56, 7.2.10CVE-2026-98934
  198. –usb: hub: use shorter 120ms post resume hold for SS root hubsFixed in 6.18.56, 7.2.10CVE-2026-98933
  199. –mtd: spinand: fix NULL pointer dereference with no ECC engineFixed in 6.18.56, 7.2.10CVE-2026-98931
  200. –audit: fix exe mark UAF in kill_rules()Fixed in 6.18.56, 7.2.10CVE-2026-98862
  201. –ipvs: bound LBLCR and LBLC cache growthFixed in 6.18.56, 7.2.10CVE-2026-98857
  202. –kprobes: Skip disarmed probes when checking optkprobe overlapFixed in 6.18.56, 7.2.10CVE-2026-98856
  203. –of/overlay: put property on deadprops only after changeset add succeedsFixed in 6.18.56, 7.2.10CVE-2026-98855
  204. –of/overlay: only treat a positive changeset id as registeredFixed in 6.18.56, 7.2.10CVE-2026-98854
  205. –net: gso: limit recursive IP-in-IP segmentationFixed in 6.18.60, 7.2.10CVE-2026-98853
  206. –net/packet: prevent TX_RING byte count overflowFixed in 6.18.56, 7.2.10CVE-2026-98850
  207. –netfilter: nft_flow_offload: drop flowtable reference on init error pathFixed in 6.18.56, 7.2.10CVE-2026-98851
  208. –rtc: spear: initialize IRQ state before requesting alarm IRQFixed in 6.18.56, 7.2.10CVE-2026-98847
  209. –sctp: check RCV_SHUTDOWN after the sendmsg connect waitFixed in 6.18.56, 7.2.10CVE-2026-98846
  210. –vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAFFixed in 7.2, 7.2.10CVE-2026-98840
  211. –vt: skip screen update for DEC alignment test on backgroup consolesFixed in 6.18.56, 7.2.10CVE-2026-98838
  212. –ALSA: caiaq: unregister the input device when probe failsFixed in 7.1, 7.2.10CVE-2026-98837
  213. –ALSA: line6: reject oversized playback packetsFixed in 6.18.56, 7.2.10CVE-2026-98836
  214. –mtd: core: call _get_device() with the master MTDFixed in 6.18.56, 7.2.10CVE-2026-98833
  215. –of/overlay: don't leak fragment references when changeset init failsFixed in 6.18.56, 7.2.10CVE-2026-98831
  216. –wifi: wfx: validate MIB read length before copying to callerFixed in 6.18.56, 7.2.10CVE-2026-98830
  217. –rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()Fixed in 6.18.56, 7.2.10CVE-2026-98825
  218. –wifi: cfg80211: preserve hidden-group beacon IE ownershipFixed in 6.18.56, 7.2.10CVE-2026-98823
  219. –Bluetooth: btintel: validate DDC record lengthsFixed in 6.18.56, 7.2.10CVE-2026-98819
  220. –net/mctp: publish the mctp_dev only after it is initialisedFixed in 6.18.56, 7.2.10CVE-2026-98812
  221. –net/sched: cls_api: reclaim an empty proto on the error pathFixed in 6.18.56, 7.2.10CVE-2026-98811
  222. –Bluetooth: hci_sync: don't drain cmd_sync backlog on unregisterFixed in 6.18.56, 7.2.10CVE-2026-98809
  223. –tipc: prevent GCM nonce reuse on peer key changesFixed in 6.18.56, 7.2.10CVE-2026-98805
  224. –net: bcmgenet: fix NULL dereference in set_coalesce before first openFixed in 6.18.56, 7.2.10CVE-2026-98798
  225. –ipvs: filter some flags received in the backup serverFixed in 6.18.56, 7.2.10CVE-2026-98794
  226. –netfilter: bpf: reject invalid NAT manipulation typesFixed in 6.18.56, 7.2.10CVE-2026-98793
  227. –perf: Fix race between perf_event_exit_task() and perf_pending_task()Fixed in 6.18.56, 7.2.10CVE-2026-98790
  228. –drm/amd/display: check dc_state_create_copy() for NULL in dm_suspendFixed in 6.18.56, 7.2.10CVE-2026-98785
  229. –drm/amdgpu/gfx6: fix firmware leak on teardownFixed in 6.18.56, 7.2.10CVE-2026-98784
  230. –drm/amdgpu: fix IP instance memory leak on kobject add failureFixed in 6.18.56, 7.2.10CVE-2026-98780
  231. –drm/amdgpu: fix ACP MFD device leak on init failureFixed in 6.18.56, 7.2.10CVE-2026-98779
  232. –binder: fix is_failure flag for superseded transaction cleanupFixed in 6.18.56, 7.2.10CVE-2026-98778
  233. –binder: fix leaked fd fixups on TF_UPDATE_TXN supersedeFixed in 6.18.56, 7.2.10CVE-2026-98777
  234. –nitro_enclaves: fix use-after-free on SLOT_ALLOC failureFixed in 6.18.56, 7.2.10CVE-2026-98775
  235. –USB: cdc-acm: skip URB restart in port_shutdown if disconnectedFixed in 7.1, 7.2.10CVE-2026-98773
  236. –USB: serial: fix port tear down use-after-freeFixed in 6.18.56, 7.2.10CVE-2026-98772
  237. –usb: storage: sierra_ms: reject short SWoC info transfersFixed in 6.18.56, 7.2.10CVE-2026-98771
  238. –usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmdFixed in 6.18.56, 7.2.10CVE-2026-98769
  239. –usb: typec: anx7411 - stop the IRQ before destroying the workqueueFixed in 6.18.56, 7.2.10CVE-2026-98768
  240. –usb: dwc3: gadget: fix IRQ storm on invalid event buffer countFixed in 6.18.56, 7.2.10CVE-2026-98767
  241. –usb: gadget: aspeed-vhub: cancel wake work on device removalFixed in 6.18.56, 7.2.10CVE-2026-98766
  242. –USB: gadget: dummy-hcd: Fix wait for outstanding request completionsFixed in 6.18.56, 7.2.10CVE-2026-98765
  243. –usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESCFixed in 6.18.56, 7.2.10CVE-2026-98764
  244. –usb: core: clear both ep_in and ep_out for non-ep0 control endpointsFixed in 6.18.56, 7.2.10CVE-2026-98763
  245. –USB: dwc2: shut down wakeup timer before freeing HCD stateFixed in 6.18.56, 7.2.10CVE-2026-98762
  246. –usb: typec: tcpm: recover after failure to start the frs amsFixed in 6.18.56, 7.2.10CVE-2026-98761
  247. –usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()Fixed in 6.18.56, 7.2.10CVE-2026-98760
  248. –usb: cdns3: fix use-after-free in cdns3_gadget_exit()Fixed in 6.18.56, 7.2.10CVE-2026-98757
  249. –usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probeFixed in 6.18.56, 7.2.10CVE-2026-98756
  250. –tty: vcc: zero-initialize control packet in vcc_send_ctl()Fixed in 6.18.56, 7.2.10CVE-2026-98755
  251. –tty: vcc: hold port lock when clearing tty pointer in vcc_cleanupFixed in 6.18.56, 7.2.10CVE-2026-98754
  252. –tty: tty_port: restore TTY_IO_ERROR on activation failureFixed in 6.18.56, 7.2.10CVE-2026-98753
  253. –tty: abort break signalling on hangupFixed in 6.18.56, 7.2.10CVE-2026-98751
  254. –tty: port: fix tty_port_tty_vhangup() raceFixed in 6.18.56, 7.2.10CVE-2026-98752
  255. –tty: fix saved termios reset raceFixed in 6.18.56, 7.2.10CVE-2026-98750
  256. –tty: serial: max3100: shut down timer before freeing portFixed in 6.18.56, 7.2.10CVE-2026-98749
  257. –serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()Fixed in 6.18.56, 7.2.10CVE-2026-98748
  258. –arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systemsFixed in 6.18.56, 7.2.10CVE-2026-98745
  259. –ALSA: seq: Serialize compat port-info ioctlsFixed in 6.18.56, 7.2.10CVE-2026-98742
  260. –ALSA: ua101: reject mismatched capture/playback packet sizesFixed in 6.18.56, 7.2.10CVE-2026-98741
  261. –Bluetooth: RFCOMM: Fix initial port reference raceFixed in 6.18.56, 7.2.10CVE-2026-98739
  262. –Bluetooth: hci_conn: Lock parent access during enhanced SCO setupFixed in 6.18.56, 7.2.10CVE-2026-98736
  263. –Bluetooth: hci_core: Serialize ACL scheduling with channel deletionFixed in 6.18.56, 7.2.10CVE-2026-98735
  264. –Bluetooth: hci_core: Serialize fragmented ISO packet queueingFixed in 6.18.56, 7.2.10CVE-2026-98733
  265. –Bluetooth: btintel: fix buffer over-read in btintel_hw_error()Fixed in 6.18.56, 7.2.10CVE-2026-98732
  266. –nvme-multipath: fix underflow in ANA log bounds checksFixed in 6.18.56, 7.2.10CVE-2026-98726
  267. –nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()Fixed in 6.18.56, 7.2.10CVE-2026-98725
  268. –mtd: block2mtd: Fix divide error when erase_size is zeroFixed in 6.18.56, 7.2.10CVE-2026-98722
  269. –mtd: rawnand: cadence: Initialize IRQ state before requesting IRQFixed in 6.18.56, 7.2.10CVE-2026-98721
  270. –KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is interceptedFixed in 6.18.56, 7.2.10CVE-2026-98716
  271. –wifi: cw1200: fix TX padding OOB read leaking heap data to deviceFixed in 6.18.56, 7.2.10CVE-2026-98711
  272. –wifi: iwlegacy: 3945: free EEPROM data on removeFixed in 6.18.56, 7.2.10CVE-2026-98710
  273. –wifi: mac80211: count only matching reservations in reserved switchFixed in 6.18.56, 7.2.10CVE-2026-98709
  274. –wifi: mac80211: keep paired old chanctx aliveFixed in 6.18.56, 7.2.10CVE-2026-98708
  275. –wifi: mac80211: shut down RX BA session timer on teardownFixed in 6.18.56, 7.2.10CVE-2026-98707
  276. –wifi: mac80211: drain PS delivery work during station teardownFixed in 6.18.56, 7.2.10CVE-2026-98706
  277. –wifi: mac80211: account proxy paths against the mesh path limitFixed in 6.18.56, 7.2.10CVE-2026-98705
  278. –wifi: mac80211: keep fallback association elements aliveFixed in 6.18.56, 7.2.10CVE-2026-98704
  279. –wifi: mac80211: minstrel_ht: validate fixed rate indexFixed in 6.18.56, 7.2.10CVE-2026-98703
  280. –wifi: mac80211: release mesh path quota on failed additionsFixed in 6.18.56, 7.2.10CVE-2026-98701
  281. –wifi: mac80211: set info->band for 802.3 encap offload framesFixed in 6.18.56, 7.2.10CVE-2026-98700
  282. –wifi: mac80211: handle empty FILS association request payloadFixed in 6.18.56, 7.2.10CVE-2026-98698
  283. –USB: serial: fix dynamic id driver deregistration raceFixed in 6.18.56, 7.2.10CVE-2026-98697
  284. –USB: serial: fix driver deregistration orderFixed in 6.18.56, 7.2.10CVE-2026-98696
  285. –USB: serial: fix ioctl hangup raceFixed in 6.18.56, 7.2.10CVE-2026-98695
  286. –thunderbolt: Fix KASAN reported use-after-free when request is canceledFixed in 6.18.56, 7.2.10CVE-2026-98694
  287. –thunderbolt: Reject oversized XDomain properties responsesFixed in 6.18.56, 7.2.10CVE-2026-98687
  288. –smb: client: discard post-EOF pagecache when extending a file via zero rangeFixed in 6.18.56, 7.2.10CVE-2026-98686
  289. –smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW racesFixed in 6.18.56, 7.2.10CVE-2026-98681
  290. –iio: accel: kxcjk-1013: reject duplicate event disableFixed in 6.18.56, 7.2.10CVE-2026-98679
  291. –iio: adc: ad_sigma_delta: fix use-after-free on unbindFixed in 6.18.56, 7.2.10CVE-2026-98677
  292. –iio: adc: stm32-adc: fix possible division by zero in processed channelFixed in 6.18.56, 7.2.10CVE-2026-98672
  293. –iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failureFixed in 6.18.56, 7.2.10CVE-2026-98671
  294. –iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbindFixed in 6.18.56, 7.2.10CVE-2026-98670
  295. –iio: buffer: serialize buffer teardown with mode claimsFixed in 6.18.56, 7.2.10CVE-2026-98669
  296. –iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.Fixed in 6.18.56, 7.2.10CVE-2026-98668
  297. –iio: gyro: adis16136: fix unprotected debugfs readsFixed in 6.18.56, 7.2.10CVE-2026-98666
  298. –iio: imu: adis16400: fix unprotected debugfs readsFixed in 6.18.56, 7.2.10CVE-2026-98664
  299. –iio: imu: adis16480: fix unprotected debugfs readsFixed in 6.18.56, 7.2.10CVE-2026-98663
  300. –iio: light: gp2ap020a00f: drain irq_work after free_irqFixed in 6.18.56, 7.2.10CVE-2026-98662
  301. –iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookupFixed in 6.18.56, 7.2.10CVE-2026-98660
  302. –iio: proximity: pulsedlight: fix iio_device left registered on PM setup failureFixed in 6.18.56, 7.2.10CVE-2026-98657
  303. –iio: trigger: cancel reenable_work before freeing triggerFixed in 6.18.56, 7.2.10CVE-2026-98656
  304. –perf: Require kernel access for text poke eventsFixed in 6.18.56, 7.2.10CVE-2026-98655
  305. –vxlan: use one headroom snapshot for neighbour repliesFixed in 6.18.55, 7.2.9CVE-2026-98568
  306. –bna: prevent IOC timer rearm during teardownFixed in 6.18.55, 7.2.9CVE-2026-98544
  307. –drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()Fixed in 6.18.55, 7.2.9CVE-2026-98519
  308. –drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()Fixed in 6.18.55, 7.2.9CVE-2026-98511
  309. –HID: alps: unregister DualPoint Stick input device on removeFixed in 6.18.55, 7.2.9CVE-2026-98502
  310. –net: ipconfig: bound DHCP option constructionFixed in 6.18.55, 7.2.9CVE-2026-98493
  311. –net: ena: fix MMIO read buffer leak on probe failureFixed in 6.18.55, 7.2.9CVE-2026-98486
  312. –netfilter: nf_tables: skip expired catchall elements on insert and deleteFixed in 6.18.55, 7.2.9CVE-2026-98484
  313. –smb: client: close handle after create-context parsing failureFixed in 6.18.56, 7.2.9CVE-2026-98453
  314. –smb: client: close completed creates on compound wait errorsFixed in 6.18.56, 7.2.9CVE-2026-98450
  315. –watchdog: rtd119x: Avoid division by zeroFixed in 6.18.54, 7.2.8CVE-2026-98409
  316. –scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slotFixed in 6.18.53, 7.2.7CVE-2026-98386
  317. –vlan: require the MAC header to be present in __vlan_insert_inner_tag()Fixed in 6.18.55, 7.2.9CVE-2026-98377
  318. –xen/netfront: drop RX packets with a short Ethernet headerFixed in 6.18.56, 7.2.10CVE-2026-98375
  319. –mm/hugetlb: preserve mremap address delta when skipping page tablesFixed in 6.18.55, 7.2.9CVE-2026-98373
  320. –RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tablesFixed in 6.18.58, 7.2.8CVE-2026-98353
  321. –Bluetooth: hci_core: Fix queuing tx_work after workqueue is drainedFixed in 7.1, 7.2.8CVE-2026-98297
  322. –ALSA: usb-audio: Clamp implicit feedback packet count to URB capacityFixed in 6.20, 7.2.8CVE-2026-98265
  323. –ALSA: virtio: reset device before deleting virtqueuesFixed in 6.18.54, 7.2.8CVE-2026-98264
  324. –btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()Fixed in 6.18.54, 7.2.8CVE-2026-98245
  325. –hwmon: (pwm-fan) Stop RPM timer before freeing tach dataFixed in 6.18.54, 7.2.8CVE-2026-98198
  326. –wifi: libipw: reject TKIP frames without a full MICFixed in 6.18.54, 7.2.8CVE-2026-98193
  327. –wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardownFixed in 6.18.54, 7.2.8CVE-2026-98192
  328. –smb: client: fix smbd_connection leak on cifs_get_tcp_session() errorFixed in 6.18.54, 7.2.8CVE-2026-98172
  329. –smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()Fixed in 6.18.54, 7.2.8CVE-2026-98170

.NET

33 vulnerabilities · Servers and applications · most fixed in 8.0.32, 9.0.21, 10.0.13

  1. 9.8Microsoft QUIC Remote Code ExecutionFixed in 10.0.14, 11.0.0-rc.2.26504.105CVE-2026-105016
  2. 9.1ASP.NET Core Security Feature BypassFixed in 10.0.13, 11.0.0-rc.2CVE-2026-70188
  3. 8.8ASP.NET Core Remote Code ExecutionFixed in 10.0.403, 11.0.100-rc.3CVE-2026-102870
  4. 8.8.NET Remote Code ExecutionFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96235
  5. 8.8.NET Framework Remote Code ExecutionFixed in 10.0.13, 11.0.0-rc.2CVE-2026-70007
Show 28 more
  1. 8.8.NET Framework Remote Code ExecutionFixed in 10.0.13, 11.0.0-rc.2CVE-2026-70035
  2. 8.8.NET Remote Code ExecutionFixed in 10.0.13, 11.0.0-rc.2CVE-2026-83520
  3. 8.8.NET Framework Elevation of Privilege VulnerabilityFixed in 10.0.13, 11.0.0-rc.2CVE-2026-85363
  4. 8.8.NET Remote Code ExecutionFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96224
  5. 8.8.NET Remote Code ExecutionFixed in 10.0.13, 11.0.0-rc.2CVE-2026-70174
  6. 8.8.NET Remote Code ExecutionFixed in 10.0.13, 11.0.0-rc.2CVE-2026-87697
  7. 8.1ASP.NET Core Elevation of Privilege VulnerabilityFixed in 9.0.21, 10.0.13CVE-2026-70175
  8. 8.1.NET and Visual Studio Remote Code ExecutionFixed in 11.0.100-rc.3, 11.0.100-rc.3.26522.148CVE-2026-70197
  9. 7.8.NET Elevation of Privilege VulnerabilityFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96225
  10. 7.8.NET Elevation of Privilege VulnerabilityFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96231
  11. 7.5.NET Denial of Service VulnerabilityFixed in 10.0.13, 11.0.0-rc.2CVE-2026-58280
  12. 7.5.NET Information DisclosureFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96232
  13. 7.5ASP.NET Core Denial of Service VulnerabilityFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96233
  14. 7.5.NET Remote Code ExecutionFixed in 9.0.319, 10.0.113CVE-2026-96237
  15. 7.5ASP.NET Core Denial of Service VulnerabilityFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96236
  16. 7.5ASP.NET Core Denial of Service VulnerabilityFixed in 9.0.21, 10.0.13CVE-2026-70181
  17. 7.5ASP.NET Core Elevation of Privilege VulnerabilityFixed in 10.0.13, 11.0.0-rc.2CVE-2026-70183
  18. 7.5ASP.NET Core Denial of Service VulnerabilityFixed in 9.0.21, 10.0.13CVE-2026-70186
  19. 7.5.NET Denial of Service VulnerabilityFixed in 10.0.13, 11.0.0-rc.2CVE-2026-69651
  20. 7.3.NET Elevation of Privilege VulnerabilityFixed in 10.0.402, 11.0.100-rc.2CVE-2026-70161
  21. 7.3.NET Elevation of Privilege VulnerabilityFixed in 10.0.113, 11.0.100-rc.2CVE-2026-70190
  22. 6.7.NET Elevation of Privilege VulnerabilityFixed in 10.0.402, 11.0.100-rc.2CVE-2026-70165
  23. 6.5.NET Information DisclosureFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96229
  24. 6.5.NET Security Feature BypassFixed in 10.0.113, 11.0.100-rc.2CVE-2026-96238
  25. 6.5.NET Framework Security Feature BypassFixed in 11.0.0-rc.2CVE-2026-70194
  26. 5.9ASP.NET Core Denial of Service VulnerabilityFixed in 9.0.21, 10.0.13CVE-2026-70196
  27. 5.9.NET Information DisclosureFixed in 10.0.13, 11.0.0-rc.2CVE-2026-66822
  28. 5.3.NET Information DisclosureFixed in 10.0.13, 11.0.0-rc.2CVE-2026-96234

PHP object injection in WordPress plugins

6 vulnerabilities

  1. 9.8LeadSnapUp to 1.25CVE-2026-90888
  2. 9.8FunnelKit AutomationsUp to 3.8.6.1CVE-2026-39738
  3. 8.8MasterStudy LMSUp to 3.7.55CVE-2026-118090
  4. 8.8GS Testimonial SliderUp to 3.3.10CVE-2026-78527
  5. 8.8Enable Media ReplaceUp to 4.2.2CVE-2026-73186
  6. 7.2Product Feed ManagerUp to 7.14.1CVE-2026-118089

Privilege escalation in WordPress plugins

5 vulnerabilities

  1. 9.8SMS Alert Order NotificationsUp to 4.0.2CVE-2026-116386
  2. 8.8WP BASE BookingUp to 6.5.2CVE-2026-118086
  3. 8.8Export and Import Users and CustomersAuthenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info FieldUp to 2.7.5CVE-2026-104368
  4. 7.4Essential Addons for ElementorUnauthenticated Privilege Escalation to 'page_id' Parameter via Elementor RevisionUp to 6.8.7CVE-2026-118205
  5. 6.3Profile BuilderUp to 4.0.5CVE-2026-54854

PHP object injection in WordPress themes

1 vulnerability

  1. 9.8Royal EventUp to 2.0CVE-2026-119526

SQL injection in WordPress plugins

5 vulnerabilities

  1. 9.3TransliteratorUp to 2.5.13CVE-2026-39732
  2. 9.3BookneticFixed in 5.10.3CVE-2026-39746
  3. 9.3WooCommerce AppointmentsUp to 5.3.2CVE-2026-32557
  4. 6.5Majestic SupportAuthenticated (Subscriber+) SQL Injection via 'columns' ParameterUp to 1.2.2CVE-2026-115820
  5. 6.5JoomSportAuthenticated (Contributor+) SQL Injection via 'pgroup' Shortcode AttributeUp to 5.7.14CVE-2026-118698

Remote code execution in WordPress plugins

3 vulnerabilities

  1. 9.1Widget OptionsUp to 4.2.5CVE-2026-116852
  2. 6.5Ad InserterUnauthenticated Arbitrary Shortcode Execution via 's' Search ParameterUp to 2.8.19CVE-2026-102905
  3. 6.5GeoDirectoryUnauthenticated Shortcode Injection via 'pagination_info' ParameterUp to 2.8.198CVE-2026-118635

MySQL

15 vulnerabilities · Servers and applications

  1. 8.8Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are…Up to 26.7.1CVE-2026-101781
  2. 8.1Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server:…Up to 26.7.1CVE-2026-101770
  3. 8.1Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server:…Up to 26.7.1CVE-2026-101771
  4. 7.4Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL…Up to 26.7.1CVE-2026-101775
  5. 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are…Up to 26.7.1CVE-2026-101778
Show 10 more
  1. 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server:…Up to 26.7.1CVE-2026-101780
  2. 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL…Up to 26.7.1CVE-2026-101774
  3. 5.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are…Up to 26.7.1CVE-2026-101761
  4. 5.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are…Up to 26.7.1CVE-2026-101777
  5. 5.3Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are…Up to 26.7.1CVE-2026-101762
  6. 5.3Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server:…Up to 26.7.1CVE-2026-101755
  7. 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected…Up to 26.7.1CVE-2026-101776
  8. 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…Up to 26.7.1CVE-2026-101760
  9. 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are MySQL Server:…Up to 26.7.1CVE-2026-101756
  10. 2.7Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are MySQL…Up to 26.7.1CVE-2026-101779

Cross-site request forgery in WordPress plugins

2 vulnerabilities

  1. 8.8AI EngineUp to 3.8.8CVE-2026-65566
  2. 5.4APIExperts Square for WooCommerceUp to 4.7.5CVE-2026-119466

Broken access control in WordPress plugins

25 vulnerabilities

  1. 7.5WP REST CacheUp to 2026.3.1CVE-2026-116862
  2. 7.5HUSKYUp to 1.4.6CVE-2026-116401
  3. 7.5Email TemplatesMissing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' ParameterUp to 1.5.14CVE-2026-107630
  4. 7.5Forminator FormsInsecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' ParameterUp to 1.57.3.1CVE-2026-97638
  5. 7.5Photo Reviews for WooCommerceUp to 1.2.30CVE-2026-100517
Show 20 more
  1. 7.2KirkiBroken Object-Level Access Control via Page APIFixed in 6.4.1CVE-2026-112347
  2. 6.9KirkireCAPTCHA Bypass via Missing TokenFixed in 6.2.5CVE-2026-112348
  3. 6.5GiveWPUp to 4.19.0.1CVE-2026-116853
  4. 6.5Booking and Rental ManagerUp to 2.8.2CVE-2026-54850
  5. 6.5Meow GalleryMissing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST EndpointUp to 5.5.4CVE-2026-13747
  6. 5.4Fluent CRMUp to 3.2.6CVE-2026-62141
  7. 5.4Webba BookingUp to 6.5.4CVE-2026-116407
  8. 5.3YITH WooCommerce Product Add-OnsUp to 4.34.0CVE-2026-107868
  9. 5.3Fluent CRMUp to 3.2.6CVE-2026-62056
  10. 5.3BookticsUp to 1.0.31CVE-2026-62122
  11. 5.3JetFormBuilderUp to 3.6.7.1CVE-2026-119482
  12. 5.3TimeticsUp to 1.0.65CVE-2026-116860
  13. 4.3Unlimited Elements For ElementorUp to 2.0.26CVE-2026-62023
  14. 4.3BookItUp to 2.6.0.6CVE-2026-62019
  15. 4.3BookticsUp to 1.0.31CVE-2026-104674
  16. 4.3Event TicketsUp to 5.30.2CVE-2026-62047
  17. 4.3Desktop ModeMissing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on…Up to 1.1.16CVE-2026-109592
  18. 4.3Event TicketsUp to 5.30.2CVE-2026-62055
  19. 4.3Content EggMissing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX ActionUp to 12.0.0CVE-2026-119059
  20. 4.3Content EggMissing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' ParameterUp to 12.0.0CVE-2026-119087

Sensitive data exposure in WordPress plugins

3 vulnerabilities

  1. 7.5Flexible ChatUp to 1.1.0CVE-2026-116861
  2. 7.5Advanced Custom Fields: ExtendedUnauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag InjectionUp to 0.9.2.7CVE-2026-110305
  3. 6.5HUSKYUp to 1.4.6CVE-2026-115947

Authentication bypass in WordPress plugins

2 vulnerabilities

  1. 7.5AI Engine – The Chatbot, AI Framework & MCP for WordPressMissing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client RegistrationUp to 3.8.6CVE-2026-110732
  2. 6.5Page and Post RestrictionUnauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-AuthenticationUp to 1.6.1CVE-2026-118194

File inclusion in WordPress plugins

2 vulnerabilities

  1. 7.5Photo Gallery, Sliders, Proofing and ThemesAuthenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image UploadUp to 4.4.1CVE-2026-76012
  2. 6.5Unlimited Elements For ElementorUp to 2.0.26CVE-2026-62121

Path traversal in WordPress plugins

2 vulnerabilities

  1. 7.5WP EasyPayUp to 4.5.4CVE-2026-39734
  2. 4.9JS Help DeskAuthenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' ParameterUp to 5.0.1CVE-2026-104739

Cross-site scripting in WordPress plugins

31 vulnerabilities

  1. 7.2easy.jobsUnauthenticated Stored Cross-Site Scripting via 'cover_letter' ParameterUp to 2.8.4CVE-2026-112365
  2. 7.2ErpUnauthenticated Stored Cross-Site Scripting via Inbound Email BodyUp to 1.17.10CVE-2026-96894
  3. 7.2Food StoreUnauthenticated Stored Cross-Site Scripting via 'service_time' CookieUp to 1.5.5CVE-2026-116622
  4. 7.1eCommerce Product CatalogUp to 3.6.5CVE-2026-116851
  5. 7.1Mang Board WPUp to 2.4.6CVE-2026-116847
Show 26 more
  1. 7.1VikRentCarUp to 1.4.9CVE-2026-116405
  2. 7.1Ad InserterUp to 2.8.19CVE-2026-105077
  3. 7.1All In One LoginUp to 2.4.1CVE-2026-94175
  4. 7.1Profile BuilderUp to 4.0.5CVE-2026-54855
  5. 7.1Fast Velocity MinifyUp to 3.5.7CVE-2026-48201
  6. 7.1BA Book EverythingUp to 1.8.33CVE-2026-39786
  7. 7.1VikRentCarUp to 1.4.10CVE-2026-28160
  8. 7.1JannahFixed in 7.6.8CVE-2026-42693
  9. 6.5WP Customer AreaUp to 8.4.0CVE-2026-116854
  10. 6.5MultiVendorXUp to 5.0.20CVE-2026-114711
  11. 6.5User RegistrationUp to 5.3.0CVE-2026-27061
  12. 6.5Ultimate Addons for Elementor - LiteUp to 2.9.5CVE-2026-39739
  13. 6.5Media Player Addons For ElementorUp to 1.1.10CVE-2026-119365
  14. 6.5Blocksy CompanionUp to 2.1.60CVE-2026-65444
  15. 6.5SureCartUp to 4.9.4CVE-2026-109697
  16. 6.4GeoDirectoryAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' ParameterUp to 2.8.199CVE-2026-119113
  17. 6.4Themify BuilderAuthenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater FieldUp to 7.8.4CVE-2026-115869
  18. 6.4Redux FrameworkAuthenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_idUp to 4.5.15CVE-2026-102918
  19. 6.4FV Flowplayer Video PlayerAuthenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode AttributesUp to 7.5.55.7212CVE-2026-110533
  20. 6.4Meow GalleryAuthenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)Up to 5.5.1CVE-2026-9239
  21. 6.4CP Multi View Events CalendarAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' ParameterUp to 1.4.43CVE-2026-119176
  22. 6.4Cool FormKit LiteAuthenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id ParameterUp to 2.7.9CVE-2026-118500
  23. 6.4Events Made EasyAuthenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode AttributeUp to 3.3.1CVE-2026-118634
  24. 5.4FV Flowplayer Video PlayerUnauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in CommentsUp to 7.5.55.7212CVE-2026-109984
  25. 5.4FV Flowplayer Video PlayerUnauthenticated Stored Cross-Site Scripting via 'align' Shortcode AttributeUp to 7.5.55.7212CVE-2026-110001
  26. 4.7Like Button Rating ♥ LikeBtnUnauthenticated Stored Cross-Site Scripting via 'Client-IP' HeaderUp to 2.6.64CVE-2026-116552

WordPress

11 vulnerabilities · WordPress core · most fixed in 6.9.11, 7.0.8, 7.1.4

  1. HighContributor+ stored cross-site scripting (XSS) and denial of service issues in Interactivity API bindingsFixed in 7.0.8, 7.1.4GHSA-83c2-c4pc-wmp3
  2. MediumAn information disclosure issue exposing unpublished Customizer changes to unauthenticated visitorsFixed in 7.0.8, 7.1.4GHSA-p2r6-rwjp-phv3
  3. MediumA Contributor+ stored cross-site scripting (XSS) issue in Customizer selective refreshFixed in 7.0.8, 7.1.4GHSA-9vrg-x932-q57q
  4. MediumA Contributor+ stored cross-site scripting (XSS) issue in the labels of the Comments Pagination and Post Navigation Link blocksFixed in 7.0.8, 7.1.4GHSA-j255-3x8q-7q7g
  5. MediumAn issue allowing post content to shadow Script Module data with a matching element IDFixed in 7.0.8, 7.1.4GHSA-wjwj-p342-9fq7
Show 6 more
  1. MediumA cross-site scripting (XSS) issue in the Categories block via format string injectionFixed in 7.0.8, 7.1.4GHSA-7q86-3j97-744j
  2. MediumA hardening fix for unsafe preg_replace() replacements in the Image and Playlist blocksFixed in 7.0.8, 7.1.4GHSA-2p22-wv7j-cvfv
  3. LowA race condition during core updates that could lead to remote code executionFixed in 7.0.8, 7.1.4GHSA-4w3m-c66w-69mg
  4. LowA permissions issue letting custom roles that moderate comments read, edit and delete notes on posts they can't editFixed in 7.0.8, 7.1.4GHSA-vchg-92fx-636p
  5. LowAn Editor+ stored cross-site scripting (XSS) issue in the personal data erasure requests screenFixed in 7.0.8, 7.1.4GHSA-mqjw-vvgg-xfvf
  6. LowUnescaped usernames on the multisite Network Users screens, fixed as a hardening measureFixed in 7.0.8, 7.1.4GHSA-j3rg-rwgx-7wx7

Denial of service in servers and applications

2 vulnerabilities

  1. 6.9ElixirUnbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in ElixirFixed in 1.19.7, 1.20.5CVE-2026-115274
  2. 6.3ElixirUnbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in ElixirFixed in 1.19.7, 1.20.5CVE-2026-109821

The Events Calendar

4 vulnerabilities · WordPress plugins

  1. 6.5Cross Site Scripting (XSS)Up to 6.18.2CVE-2026-119369
  2. 6.5Cross Site Scripting (XSS)Up to 6.18.2CVE-2026-119370
  3. 5.4Broken Access ControlUp to 6.18.2CVE-2026-119367
  4. 5.3Broken Access ControlUp to 6.18.2CVE-2026-119368

Arbitrary file access in WordPress plugins

2 vulnerabilities

  1. 6.5Forminator FormsUnauthenticated Limited File Deletion via Draft Upload MetadataUp to 1.55.0.2CVE-2026-5461
  2. 5.0SureDashUp to 1.12.3CVE-2026-115604

Content injection in WordPress plugins

3 vulnerabilities

  1. 5.3GIFTiT &#8211; Free Gifts for WooCommerceUp to 4.5CVE-2026-52710
  2. 5.3Divi Contact Form 7Up to 4.1.0CVE-2026-62057
  3. 5.3JetFormBuilderUp to 3.6.7.1CVE-2026-119479

Other vulnerabilities in WordPress plugins

4 vulnerabilities

  1. 8.8Formidable FormsAuthenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' ParameterUp to 6.35CVE-2026-89435
  2. 8.7Database CleanerAuthenticated (Administrator+) Arbitrary Table DeletionUp to 1.4.7CVE-2025-8574
  3. 6.5Masteriyo - LMSArbitrary Content DeletionUp to 3.4.3CVE-2026-116410
  4. –Intuitive Custom Post OrderVulnerability in Intuitive Custom Post OrderUp to 3.1.3WPV-7c959d2053be

Other vulnerabilities in servers and applications

2 vulnerabilities

  1. 5.4ElixirInsecure temporary file in mix deps.partition lets a local user execute code in another user's dependency buildFixed in 1.20.5CVE-2026-97209
  2. 3.1JavaVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported…Up to 21.0.12.1CVE-2026-91400

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.