[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-93277 | 24 Sep 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Validate udata before executing commands The destroy callbacks… | |
| CVE-2026-93263 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: clk: eswin: Zero-initialize stack-allocated clk_init_data… | |
| CVE-2026-93264 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL… | |
| CVE-2026-93265 | 24 Sep 2026 | CVSS 7.7 | LinuxIn the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node DSP3… | |
| CVE-2026-93266 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: arm64: RSI: fix field-spanning write warning in attestation token init The… | |
| CVE-2026-93267 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in uverbs_free_dmah() When accessing a… | |
| CVE-2026-93268 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock… | |
| CVE-2026-93269 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4_ext_migrate Move iput(tmp_inode) after… | |
| CVE-2026-93255 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock [FALSE ALERTS]… | |
| CVE-2026-93256 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: mask DAIF before restoring hibernated kernel The arm64… | |
| CVE-2026-93257 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: block: handle nogenerate/noverify properly in fs-integrity Check the BIP_CHECK… | |
| CVE-2026-93258 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full() This reverts… | |
| CVE-2026-93259 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: powerpc/irq: Fix missing r2 clobber in PCREL inline assembly In… | |
| CVE-2026-93260 | 24 Sep 2026 | CVSS 7.4 | LinuxIn the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When… | |
| CVE-2026-93261 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in __lock_set_class()… | |
| CVE-2026-93262 | 24 Sep 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush()… | |
| CVE-2026-93249 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clk_init_data is fully initialized The… | |
| CVE-2026-93250 | 24 Sep 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() vxlan_mdb_flush() iterates… | |
| CVE-2026-93251 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: ACPI: bus: Introduce acpi_bus_get_primary_device() The function used for… | |
| CVE-2026-93252 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_init_acl() A lockdep warning… | |
| CVE-2026-93253 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When… | |
| CVE-2026-93254 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit Currently… | |
| CVE-2026-93242 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()… | |
| CVE-2026-93243 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mm/secretmem: properly account locked pages secretmem accounts folios by treating… | |
| CVE-2026-93244 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/sysfb: simpledrm: Improve stride validation Validate the computed stride… | |
| CVE-2026-93245 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: apparmor: policy_int make sure list heads are initialized before fail path If… | |
| CVE-2026-93246 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity… | |
| CVE-2026-93247 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference 'uuid_count' member… | |
| CVE-2026-93248 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/xe: don't WARN on kernel job timeout when device already wedged… | |
| CVE-2026-93234 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol… | |
| CVE-2026-93235 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... -… | |
| CVE-2026-93236 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common When… | |
| CVE-2026-93237 | 24 Sep 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: LoongArch: Add DIRECT_MAP_PHYSMEM_END definition get_free_mem_region() and… | |
| CVE-2026-93238 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap The… | |
| CVE-2026-93239 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix the lockless page-table walk in show_pte() show_pte() walks page… | |
| CVE-2026-93240 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated… | |
| CVE-2026-93241 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done… | |
| CVE-2026-93227 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn With… | |
| CVE-2026-93228 | 24 Sep 2026 | CVSS 9.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or… | |
| CVE-2026-93229 | 24 Sep 2026 | CVSS 7.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry The… | |
| CVE-2026-93230 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic… | |
| CVE-2026-93231 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: lockd: fix swapped arguments in nlmsvc_match_ip() When releasing locks by server… | |
| CVE-2026-93232 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Patch… | |
| CVE-2026-93233 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix callocated underflow on large folio split… | |
| CVE-2026-93219 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sun4i: Advertise a real minimum delta… | |
| CVE-2026-93220 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: sched_ext: Keep kick_sync waiting on the rq's own CPU kick_sync_wait_bal_cb()… | |
| CVE-2026-93221 | 24 Sep 2026 | CVSS 8.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsd_net boolean flags to unsigned long flags word nfsd_net… | |
| CVE-2026-93222 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites send_signal_locked() rewrites… | |
| CVE-2026-93223 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix of_node_put() on VIP parse errors… | |
| CVE-2026-93224 | 24 Sep 2026 | CVSS 8.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rn_unregister on failed accept When svc_rdma_accept()… | |
| CVE-2026-93225 | 24 Sep 2026 | CVSS 7.4 | LinuxIn the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails… | |
| CVE-2026-93226 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6_nh_dump_exceptions() uses… | |
| CVE-2026-93211 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registering shrinker shrinker_register()… | |
| CVE-2026-93212 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose nfsd_file_net_dispose() is… | |
| CVE-2026-93213 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in of_alias_scan() stem parser The stem parser tests… | |
| CVE-2026-93214 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() usbg_make_tpg() held dep_lock… | |
| CVE-2026-93215 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: cdx: Fix double free when sysfs file creation fails In cdx_create_res_attr(), if… | |
| CVE-2026-93216 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in… | |
| CVE-2026-93217 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks… | |
| CVE-2026-93218 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd… | |
| CVE-2026-93207 | 24 Sep 2026 | CVSS 9.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry… | |
| CVE-2026-93208 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: kasan: fix cache shrink race with CPU hotplug kasan_quarantine_remove_cache()… | |
| CVE-2026-93209 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb BT enable… | |
| CVE-2026-93210 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently… | |
| CVE-2026-88371 | 24 Sep 2026 | CVSS 5.5 | VulnerabilityZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128… | |
| CVE-2026-92680 | 24 Sep 2026 | CVSS 5.5 | Araxis MergeAraxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not… | |
| CVE-2026-93205 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm arm_smmu_device_remove() manually… | |
| CVE-2026-93206 | 24 Sep 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use file_ns_capable() when checking config space read access… | |
| CVE-2026-88358 | 24 Sep 2026 | CVSS 6.5 | Vulnerabilitysimdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document… | |
| CVE-2026-88361 | 24 Sep 2026 | CVSS 7.5 | VulnerabilitySumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries. | |
| CVE-2026-88362 | 24 Sep 2026 | CVSS 7.5 | VulnerabilityMuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an… | |
| CVE-2026-88365 | 24 Sep 2026 | CVSS 9.8 | Vulnerabilityminimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field. | |
| CVE-2026-88366 | 24 Sep 2026 | CVSS 7.5 | VulnerabilityNanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially… | |
| CVE-2026-88368 | 24 Sep 2026 | CVSS 7.5 | VulnerabilityNanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted… | |
| CVE-2026-88369 | 24 Sep 2026 | CVSS 7.3 | Vulnerabilityzserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump(). | |
| CVE-2026-88370 | 24 Sep 2026 | CVSS 5.3 | Vulnerabilitylibconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled… | |
| CVE-2026-88355 | 24 Sep 2026 | CVSS 7.5 | VulnerabilityAn incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including… | |
| CVE-2026-88357 | 24 Sep 2026 | CVSS 7.5 | VulnerabilitynDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause… | |
| CVE-2026-79758 | 24 Sep 2026 | CVSS 5.4 | Termix-SSH TermixTermix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated… | |
| CVE-2026-79759 | 24 Sep 2026 | CVSS 4.3 | Termix-SSH TermixTermix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST… | |
| CVE-2026-79760 | 24 Sep 2026 | CVSS 6.4 | Termix-SSH TermixTermix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows… | |
| CVE-2026-79761 | 24 Sep 2026 | CVSS 6.6 | Termix-SSH TermixTermix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH… | |
| CVE-2026-75907 | 24 Sep 2026 | CVSS 7.5 | Norwegian Cruise Line door access controlThe door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip… | |
| CVE-2026-76907 | 24 Sep 2026 | CVSS 6.5 | suitenumerique docsLaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts… | |
| CVE-2026-77581 | 24 Sep 2026 | CVSS 8.6 | alam00000 bentopdfBentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in… | |
| CVE-2026-67233 | 24 Sep 2026 | CVSS 7.1 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's… | |
| CVE-2026-63203 | 24 Sep 2026 | CVSS 7.6 | logto-io logtoLogto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in… | |
| CVE-2026-63630 | 24 Sep 2026 | CVSS 3.4 | alam00000 bentopdfBentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control… | |
| CVE-2026-56737 | 24 Sep 2026 | CVSS 8.1 | phpMyFAQ's two-factor authentication login bypasses the password factorphpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication… | Fix |
| CVE-2026-56739 | 24 Sep 2026 | CVSS 8.5 | logto-io logtoLogto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound… | |
| CVE-2025-32000 | 24 Sep 2026 | CVSS 4.3 | HCL Software HCL SametimeHCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is… | |
| CVE-2026-97224 | 24 Sep 2026 | CVSS 4.3 | ExcalidrawA vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts… | |
| CVE-2026-97362 | 24 Sep 2026 | CVSS 7.5 | rejetto hfs2HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent… | |
| CVE-2026-97404 | 24 Sep 2026 | CVSS 9.2 | OpenStack ZaqarIn OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an… | |
| CVE-2026-90959 | 24 Sep 2026 | CVSS 8.1 | Red Hat Ansible Automation Platform 2.6 for RHEL 9A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository… | |
| CVE-2026-90481 | 24 Sep 2026 | CVSS 9.2 | PortSwigger Burp Suite DASTIn PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or… | |
| CVE-2026-88351 | 24 Sep 2026 | CVSS 9.8 | VulnerabilityAn integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack… | |
| CVE-2026-81552 | 24 Sep 2026 | CVSS 8.8 | IBM DataStage on Cloud Pak for DataIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization… | Fix |
| CVE-2026-82093 | 24 Sep 2026 | CVSS 8.8 | IBM DataStage on Cloud Pak for DataIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of… | Fix |
| CVE-2026-82094 | 24 Sep 2026 | CVSS 7.1 | IBM DataStage on Cloud Pak for DataIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper… | Fix |
Page 161 of 168