CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- goauthentik authentikauthentik: Denial of Service via Document Type Declarations in SAML Messages7.5 High
- x.org libxiOut-of-bounds read in libXi's XI2 class parser7.4 High
- termix-ssh termixTermix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)5.3 Medium
fuse3MageiaUpdated fuse3 package fixes security vulnerabilitiesNo score- linuxgfs2: fix quota init duplicate scanNo score
- linuxgfs2: move quota_init qc iterator increment7.1 High
- linuxdrm/xe: Fix null pointer dereference in devcoredump cleanupNo score
- linuxwifi: cfg80211: reject duplicate wiphy cipher suite entries4.8 Medium
- linuxwifi: nl80211: reject beacons with bad HE operation6.8 Medium
- linuxwifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()5.7 Medium
- linuxi3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM8455.1 Medium
- linuxmedia: chips-media: wave5: Fix Reports from Kernel Lock Validator6.7 Medium
- linuxmedia: chips-media: wave5: Release m2m_ctx after Instance Removed from List7.8 High
- linuxspi: spi-qcom-qspi: Fix incomplete error handling in runtime PMNo score
- linuxwifi: mac80211: avoid out-of-bounds access in monitor6.9 Medium
- linuxthunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()No score
- linuxthunderbolt: Keep XDomain reference during the lifetime of a service8.8 High
- linuxthunderbolt: Set tb->root_switch to NULL when domain is stopped7.5 High
- linuxmedia: dm1105: fix missing error check for dma_alloc_coherentNo score
- linuxcrypto: ixp4xx - fix buffer chain unwind on allocation failureNo score
- linuxPCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()No score
- linuxwatchdog: lenovo_se10_wdt: Fix use-after-free and resource leak riskNo score
- linuxgenirq/proc: Size interrupt directory names for 10-digit interrupt numbersNo score
- linuxmmc: davinci: avoid NULL deref of host->data in IRQ handlerNo score
- linuxpinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO directionNo score
- linuxwifi: rtw89: phy: check length before parsing PHY status IE6.0 Medium
- linuxcoresight: perf: Retrieve path and source from event dataNo score
- linuxdrm/amdgpu/userq: pin mqd and fw object bo to avoid eviction5.7 Medium
- linuxdrm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id7.8 High
- linuxdrm/amdkfd: Fix OOB memory exposure in get_wave_state()7.1 High
- linuxdrm/amdkfd: Check bounds on allocate_doorbell7.8 High
- linuxdrm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw7.8 High
- linuxdrm/amdgpu: Bound GPIO I2C table entry count from VBIOS7.0 High
- linuxwifi: mac80211: don't call ieee80211_handle_reconfig_failure when not neededNo score
- linuxnet/rds: Don't sleep inside rds_ib_conn_path_shutdownNo score
- linuxaffs: handle set_blocksize failuresNo score
- linuxbfs: handle set_blocksize failuresNo score
- linuxqnx4: handle set_blocksize failuresNo score
- linuxjfs: handle set_blocksize failuresNo score
- linuxhpfs: handle set_blocksize failuresNo score
- linuxomfs: handle set_blocksize failuresNo score
- linuxusbip: vhci_hcd: fix NULL deref in status_show_vhciNo score
- linuxusb: core: hcd: fix possible deadlock in rh control transfersNo score
- linuxusb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET logNo score
- linuxserial: 8250: fix possible ISR soft lockupNo score
- linuxtty: serial: 8250: protect against NULL uart->port.dev in registerNo score
- linuxdriver core: Avoid warning when removing a device while its supplier is unbindingNo score
- linuxvirt: acrn: Fix irqfd use-after-free during eventfd shutdown7.8 High
- linuxRDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()No score
- linuxrds: filter RDS_INFO_* getsockopt by caller's netnsNo score
- Show moreLoading…