CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linux, linux kernel +1 moreBluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect7.8 High
- linux, linux kernel +1 moredrm/pagemap: Prevent double migration of device pages5.5 Medium
- linuxnet: ethernet: oa_tc6: Improve the error recoveryNo score
- linuxnet/sched: cls_u32: fix duplicate handle when node ID pool is exhausted7.3 High
- linuxigmp: convert struct ip_sf_list to RCU6.8 Medium
- linuxipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()2.0 Low
- linuxipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()2.0 Low
- teldat regesta smart hd-plc - tldph16d2CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT4.8 Medium
- rapid7 platformRapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup2.7 Low
- linux, linux kernel +1 moreipv6: mcast: use rcu_assign_pointer() for __rcu list updates4.7 Medium
- linux, linux kernel +1 moretipc: fix NULL deref in tipc_named_node_up() on empty publication list5.5 Medium
- linux, linux kernel +1 moretipc: Dont send random pad bytes in RESET/ACTIVATE messages5.3 Medium
- linux, linux kernel +1 moreipv6: sr: restore network header before routing and forwarding7.4 High
- linux, linux kernel +1 moreaf_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().5.5 Medium
- linux, linux kernel +1 morestaging: fbtft: make dirty_lock IRQ-safe5.5 Medium
- linux, linux kernel +1 moreASoC: fsl_micfil: balance mclk enable/disable7.8 High
- linux, linux kernel +1 moreASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()5.5 Medium
- linux, linux kernel +1 morebtrfs: detach failed sprout device from transaction update list5.5 Medium
- linux, linux kernel +1 morebtrfs: restore active device pointers after failed sprout5.5 Medium
- linux, linux kernel +1 morebonding: alb: fix uninitialized transport header access in alb_determine_nd()5.5 Medium
- linuxscsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()No score
- linuxsched/rt,dl: Skip migrate-disabled tasks when picking a push candidate5.6 Medium
- linuxALSA: ump: do not touch legacy_rmidi before it existsNo score
- linuxbpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge8.5 High
- linuxbpf: backtracking shouldn't clear outer frame R1-R5 for callbacks8.4 High
- linux, linux kernel +1 morebtrfs: fix transaction use-after-free in raid stripe insertion7.0 High
- linux, linux kernel +1 morebtrfs: fix the possible bioc_list memory leak during error5.5 Medium
- linuxbtrfs: zoned: finish active block group cleanup if call_zone_finish() failsNo score
- linux, linux kernel +1 morebtrfs: do not force reloc root creation during qgroup_account_snapshot()5.5 Medium
- linuxbtrfs: zstd: fix lost wakeup when waiting for a workspace5.7 Medium
- linux, linux kernel +1 moreipvs: fix reversed sequence option serialization4.4 Medium
- linuxnetfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()No score
- linuxtracing/probes: Fix use-after-free on field name/type of events with multiple probesNo score
- linuxbpf: reject BPF_PSEUDO_FUNC reference to the main programNo score
- linuxbonding: do not clear curr_active_slave prematurely when releasing all slavesNo score
- linuxnet: Remove conflicting altnames for dying netns in __dev_change_net_namespace().7.8 High
- linuxnet/rds: use wq_has_sleeper() in release_in_xmit()No score
- linuxnet/rds: clear cp_flags bits individually in rds_conn_path_reset()No score
- linuxnet/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()8.1 High
- linuxnet/rds: acquire the fastpath locks in rds_conn_shutdown()8.1 High
- linuxnet/rds: don't let rds_conn_shutdown() consume a concurrent dropNo score
- linuxerofs: disable LZ4 rolling decompression for now2.0 Low
- linuxALSA: caiaq: Fix potential double-free at error pathNo score
- linuxbpf: Reject key-less BTF for hash mapsNo score
- linuxbpf: Fix NULL-ptr-deref when showing a void BTF typeNo score
- linuxbpf: Fix NULL-ptr-deref in btf_var_show()No score
- linux, linux kernel +1 morebpf: Mark signal tracepoint siginfo arguments as scalar5.5 Medium
- linuxbpf: Reject tail calls directly from callback framesNo score
- linuxbpf: Reject resilient lock operations in rbtree callbacksNo score
- linux, linux kernel +1 morebpf: Mark sched_process_wait argument as nullable5.5 Medium
- Show moreLoading…