Patch TuesdayMicrosoft's monthly security release, by update and product, as the Security Update Guide states it. Nothing is generated.
Your Windows releases from the fleet
- Windows 11, version 26H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711)
- Windows 11, version 25H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711), KB5124008 (20 CVEs · build 10.0.26200.9445), KB5101650 (2 CVEs · build 10.0.26200.8875)
- Windows 11, version 24H2 — KB5127648 (3025 CVEs, 3 exploited · build 10.0.26100.9711), KB5124008 (20 CVEs · build 10.0.26200.9445), KB5101650 (2 CVEs · build 10.0.26200.8875)
- Windows 11, version 23H2 — KB5126653 (965 CVEs, 1 exploited · build 10.0.22631.7652), KB5122880 (9 CVEs · build 10.0.22631.7582), KB5099414 (1 CVEs · build 10.0.22631.7376)
By update 152 in October 2026
| Update | Products | CVEs | Critical | Exploited |
|---|---|---|---|---|
| KB5127648 · 10.0.26100.9711 | Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 Version 26H2 | 3025 | 75 | 3 |
| KB5126657 · 10.0.19044.7807 | Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2, Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 | 1798 | 44 | 2 |
| KB5126646 · 10.0.26100.33650 | Windows Server 2025, Windows Server 2025 (Server Core installation) | 1041 | 35 | 1 |
| KB5127646 · 10.0.28000.3231 | Windows 11 Version 26H1, Windows 11 version 26H1 | 997 | 25 | 1 |
| KB5126655 · 10.0.20348.5761 | Windows Server 2022, Windows Server 2022 (Server Core installation) | 977 | 33 | 1 |
| KB5126653 · 10.0.22631.7652 | Windows 11 Version 23H2 | 965 | 25 | 1 |
| KB5126651 · 10.0.17763.9376 | Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation) | 918 | 30 | 1 |
| KB5126868 · 10.0.14393.9612 | Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 | 770 | 27 | 1 |
| KB5126836 · 6.3.9600.23470 | Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | 649 | 23 | 1 |
| Release Notes · 20260925.100 | Outlook.com, azl3 brotli 1.1.0-2 on Azure Linux 3.0, azl3 nodejs 24.21.0-1 on Azure Linux 3.0, Raw Image Extension on Windows 10 Version 1607, Raw Image Extension on Windows 10 Version 1607 for 32-bit Systems, Raw Image Extension on Windows 10 and 28 more | 23 | 8 | 1 |
| Release Notes · 154.0.4258.62 | Microsoft Edge (Chromium-based) | 19 | 2 | 1 |
| KB5126835 · 6.2.9200.26434 | Windows Server 2012, Windows Server 2012 (Server Core installation) | 612 | 21 | |
| Release Notes · 16.0.14334.20974 | Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2024 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions | 310 | 68 | |
| Release Notes · https://aka.ms/OfficeSecurityReleases | Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft 365 Apps for Enterprise for 32-bit Systems | 162 | 37 | |
| Release Notes · 16.114.26101123 | Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft Office 365 for Mac | 118 | 30 | |
| Release Notes · 18.11.2 | Microsoft Visual Studio 2026 version 18.11, Microsoft Visual Studio 2026 version 18.12, Microsoft Visual Studio 2026 version 18.10 | 52 | 4 | |
| Release Notes · 17.14.43 | Microsoft Visual Studio 2022 version 17.14 | 47 | 3 | |
| KB5002928 · 16.0.10417.20228 | Office Online Server | 44 | 13 | |
| KB5002927 · 16.0.20326.20190 | Microsoft SharePoint Server Subscription Edition | 36 | 2 | |
| Release Notes · 11.0.100-rc.3.26522.148 | .NET 11.0 installed on Windows, .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS, .NET 11.0 runtime installed on Windows, ASP.NET Core 11.0, .NET 11.0 runtime installed on Linux and 1 more | 34 | 2 | |
| KB5130035 · 9.0.21 | .NET 9.0 runtime installed on Windows, ASP.NET Core 9.0, .NET 9.0 runtime installed on Mac OS, .NET 9.0 runtime installed on Linux | 32 | 1 | |
| KB5130036 · 10.0.13 | ASP.NET Core 10.0, .NET 10.0 runtime installed on Windows, .NET 10.0 runtime installed on Mac OS, .NET 10.0 runtime installed on Linux | 32 | ||
| KB5130034 · 8.0.32 | .NET 8.0 runtime installed on Windows, ASP.NET Core 8.0, .NET 8.0 runtime installed on Mac OS, .NET 8.0 runtime installed on Linux | 29 | 1 | |
| KB5126934 · 16.0.4305.5 | Microsoft SQL Server 2022 for x64-based Systems (CU27) | 21 | ||
| KB5126967 · 17.0.5015.4 | Microsoft SQL Server 2025 for x64-based Systems (CU9) | 21 | ||
| KB5128492 · 17.0.1145.4 | Microsoft SQL Server 2025 for x64-based Systems (GDR) | 21 | ||
| KB5128493 · 16.0.1210.3 | Microsoft SQL Server 2022 for x64-based Systems (GDR) | 21 | ||
| KB5124008 · 10.0.26200.9445 | Windows 11 Version 25H2, Windows 11 Version 24H2 | 20 | 2 | |
| KB5128494 · 15.0.4500.2 | Microsoft SQL Server 2019 for x64-based Systems (CU32) | 19 | ||
| KB5128495 · 15.0.2200.2 | Microsoft SQL Server 2019 for x64-based Systems (GDR) | 19 | ||
| KB5127666 · 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809 | 18 | 1 | |
| KB5127689 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2 | 18 | 1 | |
| KB5127690 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025 | 18 | 1 | |
| KB5127691 · 4.8.9363.0 | Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1 | 18 | 1 | |
| KB5127692 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2 | 18 | 1 | |
| KB5127693 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022 | 18 | 1 | |
| KB5127667 · 4.7.4150.0 | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 | 17 | 1 | |
| KB5127668 · 4.7.4150.0 | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 | 17 | 1 | |
| KB5127685 · 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809, Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 | 17 | 1 | |
| KB5127687 · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 | Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022 | 17 | 1 |
112 more updates, mostly single products; the CVE table below names each.
CVEs 1208 of 3424
All components
Mariner 1208Microsoft Edge (Chromium-based) 754Microsoft Office Excel 70Role: DNS Server 52Windows Kernel 46Microsoft Office Word 45Windows Installer 38Microsoft Office SharePoint 37Windows Win32 Kernel Subsystem 36Microsoft Windows Search Component 29.NET 27Windows NTFS 26SQL Server 22Windows Error Reporting 22
| CVE | Severity | CVSS | Component | Title | Update |
|---|---|---|---|---|---|
| CVE-2026-110264 | Critical | 10.0 | Mariner (GitLab) | Integer Overflow or Wraparound in GitLab | Release Notes |
| CVE-2026-94603 | Critical | 10.0 | Mariner (GitHub_M) | Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation | |
| CVE-2026-97229 | Critical | 10.0 | Mariner (GitLab) | Integer Overflow or Wraparound in GitLab | Release Notes, Release Notes |
| CVE-2026-115384 | Critical | 9.9 | Mariner (VulnCheck) | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow | |
| CVE-2026-115889 | Critical | 9.9 | Mariner (GitHub_M) | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation | |
| CVE-2026-115893 | Critical | 9.9 | Mariner (GitHub_M) | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction | |
| CVE-2026-77524 | Critical | 9.9 | Mariner (GitHub_M) | KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication | Release Notes |
| CVE-2026-111444 | Critical | 9.8 | Mariner (mitre) | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings… | |
| CVE-2026-56154 | Critical | 9.8 | Mariner (apache) | Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} | Release Notes |
| CVE-2026-56857 | Critical | 9.8 | Mariner (Go) | Root.Mkdir(All) can follow junctions out of the root on Windows in os | |
| CVE-2026-57941 | Critical | 9.8 | Mariner (apache) | Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy | Release Notes |
| CVE-2026-59797 | Critical | 9.8 | Mariner (apache) | Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function | Release Notes |
| CVE-2026-98167 | Critical | 9.8 | Mariner (Linux) | smb: client: fix server->total_read for compound encrypted PDUs | Release Notes |
| CVE-2026-98168 | Critical | 9.8 | Mariner (Linux) | smb: client: fix reparse buffer bounds in cifs_query_reparse_point() | Release Notes |
| CVE-2026-98170 | Critical | 9.8 | Mariner (Linux) | smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() | |
| CVE-2026-98171 | Critical | 9.8 | Mariner (Linux) | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs | Release Notes |
| CVE-2026-98172 | Critical | 9.8 | Mariner (Linux) | smb: client: fix smbd_connection leak on cifs_get_tcp_session() error | Release Notes |
| CVE-2026-98174 | Critical | 9.8 | Mariner (Linux) | smb: client: fix rlist race and missing initialization | Release Notes |
| CVE-2026-98176 | Critical | 9.8 | Mariner (Linux) | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc | |
| CVE-2026-98177 | Critical | 9.8 | Mariner (Linux) | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. | |
| CVE-2026-98179 | Critical | 9.8 | Mariner (Linux) | drm/amdgpu: fix rmmio iounmap skipped on device removal | |
| CVE-2026-98180 | Critical | 9.8 | Mariner (Linux) | drm/msm: RCU-free the scheduler-containing ring and VM objects | |
| CVE-2026-98181 | Critical | 9.8 | Mariner (Linux) | drm/gud: fix out-of-bounds write in gud_plane_atomic_check() | Release Notes |
| CVE-2026-98186 | Critical | 9.8 | Mariner (Linux) | wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length | Release Notes |
| CVE-2026-98187 | Critical | 9.8 | Mariner (Linux) | wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST | Release Notes |
| CVE-2026-98188 | Critical | 9.8 | Mariner (Linux) | wifi: p54: validate curve data length in the calibration curve converters | Release Notes |
| CVE-2026-98191 | Critical | 9.8 | Mariner (Linux) | wifi: wlcore: release runtime PM ref on regdomain config failure | Release Notes |
| CVE-2026-98192 | Critical | 9.8 | Mariner (Linux) | wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown | |
| CVE-2026-98193 | Critical | 9.8 | Mariner (Linux) | wifi: libipw: reject TKIP frames without a full MIC | |
| CVE-2026-98199 | Critical | 9.8 | Mariner (Linux) | hwmon: (pmbus/core) increase number of phases and add new mask | Release Notes |
| CVE-2026-98203 | Critical | 9.8 | Mariner (Linux) | Input: soc_button_array - check btns_desc->package.count | Release Notes |
| CVE-2026-98206 | Critical | 9.8 | Mariner (Linux) | Input: cyttsp5 - clamp the HID report size before memcpy | Release Notes |
| CVE-2026-98207 | Critical | 9.8 | Mariner (Linux) | mmc: spi: reset bytes_xfered before retrying CRC failures | Release Notes |
| CVE-2026-98209 | Critical | 9.8 | Mariner (Linux) | mmc: sdhci-of-aspeed: Remove children before releasing SDC resources | Release Notes |
| CVE-2026-98211 | Critical | 9.8 | Mariner (Linux) | mmc: mmci: Fix use-after-free in busy-timeout work | |
| CVE-2026-98212 | Critical | 9.8 | Mariner (Linux) | mmc: hsq: Fix use-after-free in retry work | Release Notes |
| CVE-2026-98214 | Critical | 9.8 | Mariner (Linux) | selinux: recheck intermediate backing files on mprotect() | Release Notes |
| CVE-2026-98215 | Critical | 9.8 | Mariner (Linux) | selinux: preserve user SID across nested backing files | Release Notes |
| CVE-2026-98217 | Critical | 9.8 | Mariner (Linux) | IB/mlx4: Fix use-after-free on pkey sysfs registration failure | Release Notes |
| CVE-2026-98221 | Critical | 9.8 | Mariner (Linux) | KEYS: trusted: Fix tpm2_load_cmd() boundary check | Release Notes |
| CVE-2026-98222 | Critical | 9.8 | Mariner (Linux) | KEYS: encrypted: fix integer overflow of datablob_len | |
| CVE-2026-98232 | Critical | 9.8 | Mariner (Linux) | scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() | Release Notes |
| CVE-2026-98233 | Critical | 9.8 | Mariner (Linux) | net/packet: clear RX owner on VNET header error | Release Notes |
| CVE-2026-98238 | Critical | 9.8 | Mariner (Linux) | net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() | Release Notes |
| CVE-2026-98249 | Critical | 9.8 | Mariner (Linux) | arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc | Release Notes |
| CVE-2026-98251 | Critical | 9.8 | Mariner (Linux) | openvswitch: avoid reallocating confirmed conntrack labels | Release Notes |
| CVE-2026-98252 | Critical | 9.8 | Mariner (Linux) | RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() | Release Notes |
| CVE-2026-98253 | Critical | 9.8 | Mariner (Linux) | RDMA/ucma: Serialize join and leave on copy_to_user failure | Release Notes |
| CVE-2026-98254 | Critical | 9.8 | Mariner (Linux) | swiotlb: use the adjusted address for the highmem page lookup | |
| CVE-2026-98255 | Critical | 9.8 | Mariner (Linux) | tcp: exclude old ACKs from tcp fast path | Release Notes |
| CVE-2026-98263 | Critical | 9.8 | Mariner (Linux) | ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type | Release Notes |
| CVE-2026-98269 | Critical | 9.8 | Mariner (Linux) | btrfs: abort transaction on failure to update inode for hole punching and reflinking | Release Notes |
| CVE-2026-98270 | Critical | 9.8 | Mariner (Linux) | drm/amdgpu: check ras and obj before dereference | Release Notes |
| CVE-2026-98272 | Critical | 9.8 | Mariner (Linux) | net: mvpp2: prevent buffer overflow in page_pool allocation | Release Notes |
| CVE-2026-98275 | Critical | 9.8 | Mariner (Linux) | net: ethernet: cortina: Ack RX overrun interrupt correctly | Release Notes |
| CVE-2026-98279 | Critical | 9.8 | Mariner (Linux) | btrfs: handle lack of space when cleaning up verity items | |
| CVE-2026-98282 | Critical | 9.8 | Mariner (Linux) | powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba | Release Notes |
| CVE-2026-98283 | Critical | 9.8 | Mariner (Linux) | KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() | Release Notes |
| CVE-2026-98287 | Critical | 9.8 | Mariner (Linux) | pppoatm: ensure a writable skb header and linear data | Release Notes |
| CVE-2026-98288 | Critical | 9.8 | Mariner (Linux) | net: stmmac: fix TSO header length truncation | |
| CVE-2026-98289 | Critical | 9.8 | Mariner (Linux) | af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). | Release Notes |
| CVE-2026-98292 | Critical | 9.8 | Mariner (Linux) | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access | |
| CVE-2026-98295 | Critical | 9.8 | Mariner (Linux) | Bluetooth: coredump: Quiesce dump work on unregister | |
| CVE-2026-98298 | Critical | 9.8 | Mariner (Linux) | dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() | Release Notes |
| CVE-2026-98301 | Critical | 9.8 | Mariner (Linux) | net: bridge: mst: move switchdev call outside rcu | Release Notes |
| CVE-2026-98303 | Critical | 9.8 | Mariner (Linux) | ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup | Release Notes |
| CVE-2026-98304 | Critical | 9.8 | Mariner (Linux) | net: bcmgenet: restore the hardware filters on open | |
| CVE-2026-98308 | Critical | 9.8 | Mariner (Linux) | ALSA: hda: trace PCM open only after assigning a stream | Release Notes |
| CVE-2026-98311 | Critical | 9.8 | Mariner (Linux) | wifi: virt_wifi: don't transfer operstate before register | Release Notes |
| CVE-2026-98316 | Critical | 9.8 | Mariner (Linux) | ALSA: bcd2000: Fix race between rawmidi and disconnect | Release Notes |
| CVE-2026-98317 | Critical | 9.8 | Mariner (Linux) | neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. | |
| CVE-2026-98319 | Critical | 9.8 | Mariner (Linux) | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | Release Notes |
| CVE-2026-98320 | Critical | 9.8 | Mariner (Linux) | netfilter: flowtable: hold reference on ct until flow is released | Release Notes |
| CVE-2026-98321 | Critical | 9.8 | Mariner (Linux) | netfilter: nf_nat: unregister and release hooks on error | |
| CVE-2026-98322 | Critical | 9.8 | Mariner (Linux) | netfilter: nft_nat: fully initialise new_addr in netmap setup | Release Notes |
| CVE-2026-98323 | Critical | 9.8 | Mariner (Linux) | RDMA/siw: Bound fragmented header copies by the remaining length | Release Notes |
| CVE-2026-98326 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: mesh: release the channel if start fails | Release Notes |
| CVE-2026-98327 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: mesh: reset the CSA state when leaving | |
| CVE-2026-98328 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: add HE 6 GHz capability in the scan elems len | Release Notes |
| CVE-2026-98329 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: don't allow injecting frames wider than the chanctx | |
| CVE-2026-98330 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: get the wiphy out of a dying network namespace | |
| CVE-2026-98331 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: unlist vifs when their netdev is unregistered | Release Notes |
| CVE-2026-98332 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: only operate on TDLS peers in the TDLS code | |
| CVE-2026-98333 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: reset the LED state when ifup fails | |
| CVE-2026-98335 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: abort chanswitch when leaving a mesh | |
| CVE-2026-98336 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: don't offload TC setup on AP_VLAN interfaces | Release Notes |
| CVE-2026-98337 | Critical | 9.8 | Mariner (Linux) | wifi: mac80211: don't start a ROC while scanning | |
| CVE-2026-98338 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: ibss: ref BSS entry for joined event | |
| CVE-2026-98339 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: don't filter by BSS type when removing stale entries | Release Notes |
| CVE-2026-98340 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: only group hidden BSSes with beacon entries | Release Notes |
| CVE-2026-98341 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: don't free driver-owned scan requests | |
| CVE-2026-98345 | Critical | 9.8 | Mariner (Linux) | wifi: cfg80211: check IP header size in cfg80211_classify8021d() | Release Notes |
| CVE-2026-98348 | Critical | 9.8 | Mariner (Linux) | wifi: libipw: reject too-short association responses | Release Notes |
| CVE-2026-98351 | Critical | 9.8 | Mariner (Linux) | wifi: virt_wifi: free skb when disconnected | Release Notes |
| CVE-2026-98352 | Critical | 9.8 | Mariner (Linux) | RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted | Release Notes |
| CVE-2026-98353 | Critical | 9.8 | Mariner (Linux) | RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables | Release Notes |
| CVE-2026-98362 | Critical | 9.8 | Mariner (Linux) | clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate | Release Notes |
| CVE-2026-98363 | Critical | 9.8 | Mariner (Linux) | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | Release Notes |
| CVE-2026-98365 | Critical | 9.8 | Mariner (Linux) | RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access | Release Notes |
| CVE-2026-98368 | Critical | 9.8 | Mariner (Linux) | esp: downgrade zerocopy managed frags before mutating skb frags | Release Notes |
| CVE-2026-98370 | Critical | 9.8 | Mariner (Linux) | xfrm: fix compat ALLOCSPI request use-after-free | Release Notes |
| CVE-2026-99078 | Critical | 9.8 | Mariner (Linux) | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry | |
| CVE-2026-99079 | Critical | 9.8 | Mariner (Linux) | net/mlx5e: Prevent stale XSK buffer release on refill retry | |
| CVE-2026-99100 | Critical | 9.8 | Mariner (Linux) | wifi: p54: validate firmware record lengths | |
| CVE-2026-98573 | Critical | 9.4 | Mariner (Linux) | net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() | Release Notes |
| CVE-2026-99999 | Critical | 9.3 | Mariner (Linux) | ipv4: validate checksum_start before completing checksum | Release Notes |
| CVE-2026-78663 | Critical | 9.1 | Mariner (Go) | Double flow control refund on HTTP/2 server streams in net/http | Release Notes, Release Notes, Release Notes +13 |
| CVE-2026-91403 | Critical | 9.1 | Mariner (oracle) | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0… | |
| CVE-2026-98621 | Critical | 9.1 | Mariner (Linux) | net: gue: reject invalid REMCSUM offsets | Release Notes |
| CVE-2026-98725 | Critical | 9.1 | Mariner (Linux) | nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() | |
| CVE-2026-98794 | Critical | 9.1 | Mariner (Linux) | ipvs: filter some flags received in the backup server | |
| CVE-2026-93479 | Critical | 8.1 | Mariner (f5) | NGINX Map directive and Regex matching vulnerability | |
| CVE-2026-119568 | Critical | 7.4 | Mariner (VulnCheck) | vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking | |
| CVE-2026-108266 | Critical | — | Mariner (GitHub_M) | Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session | |
| CVE-2026-108267 | Critical | — | Mariner (GitHub_M) | Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session | |
| CVE-2026-115557 | Critical | — | Mariner (PSF) | Distrust compromised intermediate certificates in ssl module | Release Notes |
| CVE-2026-115905 | Critical | — | Mariner (GitHub_M) | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | |
| CVE-2026-83632 | Critical | — | Mariner (apache) | Apache Thrift: C++ THttpTransport grows its line buffer without bound | Release Notes |
| CVE-2026-97631 | Critical | — | Mariner (TianoCore) | Pre-boot RCE in EDK II PXE driver | |
| CVE-2026-56153 | Important | 9.4 | Mariner (apache) | Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char | Release Notes |
| CVE-2026-107350 | Important | 8.8 | Mariner (PostgreSQL) | Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer | Release Notes |
| CVE-2026-86567 | Important | 8.8 | Mariner (redhat) | Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap | Release Notes |
| CVE-2026-89091 | Important | 8.8 | Mariner (redhat) | Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution | |
| CVE-2026-93546 | Important | 8.8 | Mariner (apache) | Apache HTTP Server: mod_dav_fs namespace overflow | Release Notes |
| CVE-2026-97380 | Important | 8.8 | Mariner (GitHub_M) | MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges | |
| CVE-2026-98981 | Important | 8.8 | Mariner (Linux) | namespace: unhash a dentry before detaching the mounts on it | |
| CVE-2026-99082 | Important | 8.8 | Mariner (Linux) | KVM: x86: Use active memslots for the per-vCPU MMIO cache | |
| CVE-2026-99083 | Important | 8.8 | Mariner (Linux) | ksmbd: fix heap out-of-bounds write in krb5_authenticate() | |
| CVE-2026-100236 | Important | 8.6 | Mariner (redhat) | Dpdk: dpdk: heap out-of-bounds read/write in gso header copy | Release Notes |
| CVE-2026-98978 | Important | 8.4 | Mariner (Linux) | namespace: never expire a locked mount | |
| CVE-2026-98526 | Important | 8.3 | Mariner (Linux) | llc: reserve device headroom for allocated frames | Release Notes |
| CVE-2026-112085 | Important | 8.2 | Mariner (openjs) | webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades | |
| CVE-2026-59685 | Important | 8.2 | Mariner (apache) | Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM | Release Notes |
| CVE-2026-63718 | Important | 8.2 | Mariner (apache) | Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling | |
| CVE-2026-77214 | Important | 8.2 | Mariner (VulnCheck) | libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer | Release Notes |
| CVE-2026-87864 | Important | 8.2 | Mariner (curl) | IMAP APPEND plus CRLF conversion command injection | |
| CVE-2026-98190 | Important | 8.2 | Mariner (Linux) | wifi: wilc1000: fix out-of-bounds read in P2P public action frames | Release Notes |
| CVE-2026-98466 | Important | 8.2 | Mariner (Linux) | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 | |
| CVE-2026-46570 | Important | 8.1 | Mariner (mitre) | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata. | Release Notes |
| CVE-2026-73636 | Important | 8.1 | Mariner (apache) | Apache HTTP Server: mod_auth_digest one-time-nonce replay attack | Release Notes |
| CVE-2026-92392 | Important | 8.1 | Mariner (curl) | HTTP/2 upload Use-After-Free | |
| CVE-2026-94300 | Important | 8.1 | Mariner (isc) | Concurrent GSS-TSIG messages corrupt memory | |
| CVE-2026-98175 | Important | 8.1 | Mariner (Linux) | smb: client: cancel reconnect work in clean_demultiplex_info() | Release Notes |
| CVE-2026-98261 | Important | 8.1 | Mariner (Linux) | cifs: Fix server use-after-free in cifs_chan_skip_or_disable() | Release Notes |
| CVE-2026-98432 | Important | 8.1 | Mariner (Linux) | ipv4: free inet_opt and ireq_opt after an RCU grace period | Release Notes |
| CVE-2026-98441 | Important | 8.1 | Mariner (Linux) | net/sched: act_ct: avoid modifying shared unconfirmed ct entry | |
| CVE-2026-98602 | Important | 8.1 | Mariner (Linux) | Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough | Release Notes |
| CVE-2026-98687 | Important | 8.1 | Mariner (Linux) | thunderbolt: Reject oversized XDomain properties responses | |
| CVE-2026-98829 | Important | 8.1 | Mariner (Linux) | wifi: mac80211: drop oversized fragments to avoid extra_len overflow | |
| CVE-2026-53615 | Important | 8.0 | Mariner (GitHub_M) | util-linux libblkid DOS extended-partition overflow produces invalid partition metadata | |
| CVE-2026-115392 | Important | 7.9 | Mariner (VulnCheck) | Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes | |
| CVE-2026-104715 | Important | 7.8 | Mariner (redhat) | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass | Release Notes |
| CVE-2026-108976 | Important | 7.8 | Mariner (mitre) | GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992. | |
| CVE-2026-119373 | Important | 7.8 | Mariner (VulnCheck) | SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists() | |
| CVE-2026-119374 | Important | 7.8 | Mariner (VulnCheck) | SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete() | |
| CVE-2026-119379 | Important | 7.8 | Mariner (VulnCheck) | SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind() | |
| CVE-2026-119586 | Important | 7.8 | Mariner (VulnCheck) | SQLite CLI through 3.54.1 Command Injection via .recover Output | |
| CVE-2026-42616 | Important | 7.8 | Mariner (mitre) | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file. | Release Notes |
| CVE-2026-86562 | Important | 7.8 | Mariner (redhat) | Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) | Release Notes |
| CVE-2026-88812 | Important | 7.8 | Mariner (suse) | X.Org Server XKB SetGeometry TextDoodad Double Free | |
| CVE-2026-90954 | Important | 7.8 | Mariner (redhat) | Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush | |
| CVE-2026-93518 | Important | 7.8 | Mariner (suse) | X.Org Server XKB ResizeKeyType Numeric Truncation | |
| CVE-2026-93519 | Important | 7.8 | Mariner (suse) | X.Org Server XFixes Pointer Barrier Event List Buffer Overflow | |
| CVE-2026-93520 | Important | 7.8 | Mariner (suse) | X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write | |
| CVE-2026-93521 | Important | 7.8 | Mariner (suse) | X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow | |
| CVE-2026-93522 | Important | 7.8 | Mariner (suse) | X.Org Server Glamor CopyArea Heap Buffer Overflow | |
| CVE-2026-93523 | Important | 7.8 | Mariner (suse) | X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write | |
| CVE-2026-94444 | Important | 7.8 | Mariner (Go) | Checksum bypass for golang.org/fips140 in cmd/go | |
| CVE-2026-98194 | Important | 7.8 | Mariner (Linux) | wifi: libertas_tf: fix UAF in lbtf_free_adapter() | Release Notes |
| CVE-2026-98245 | Important | 7.8 | Mariner (Linux) | btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() | |
| CVE-2026-98248 | Important | 7.8 | Mariner (Linux) | arm64: percpu: Fix LSE operations on {8,16}-bit types | |
| CVE-2026-98309 | Important | 7.8 | Mariner (Linux) | drm/vc4: Use managed KMS polling to fix UAF on unbind | Release Notes |
| CVE-2026-98342 | Important | 7.8 | Mariner (Linux) | dmaengine: wait for RCU readers before releasing dma_device | Release Notes |
| CVE-2026-98343 | Important | 7.8 | Mariner (Linux) | dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() | Release Notes |
| CVE-2026-98359 | Important | 7.8 | Mariner (Linux) | RDMA/core: Reject unregistering netdevs in ib_get_eth_speed | Release Notes |
| CVE-2026-98366 | Important | 7.8 | Mariner (Linux) | RDMA/rxe: validate access flags before swapping the MR's PD | Release Notes |
| CVE-2026-98378 | Important | 7.8 | Mariner (Linux) | bpf: Skip unsettled links in link iterator | Release Notes |
| CVE-2026-98381 | Important | 7.8 | Mariner (Linux) | veth: manage XDP program pointers during channel resize | Release Notes |
| CVE-2026-98715 | Important | 7.8 | Mariner (Linux) | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN | |
| CVE-2026-98716 | Important | 7.8 | Mariner (Linux) | KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted | |
| CVE-2026-98808 | Important | 7.8 | Mariner (Linux) | net: systemport: Fix buffer overflow in bcm_sysport_get_stats() | |
| CVE-2026-98863 | Important | 7.8 | Mariner (Linux) | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails | |
| CVE-2026-98900 | Important | 7.8 | Mariner (Linux) | xen/gntalloc: validate grant count before allocation | Release Notes |
| CVE-2026-99053 | Important | 7.8 | Mariner (Linux) | tipc: hold a reference to nodes found by link name | |
| CVE-2026-99054 | Important | 7.8 | Mariner (Linux) | tipc: destroy topsrv workqueues before closing connections | |
| CVE-2026-99056 | Important | 7.8 | Mariner (Linux) | strparser: make sure __strp_recv isn't running before tearing down the parser | |
| CVE-2026-99110 | Important | 7.8 | Mariner (Linux) | smb: client: fix heap overflow in cifs_do_set_acl() | |
| CVE-2026-99138 | Important | 7.8 | Mariner (Linux) | tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) | |
| CVE-2026-99139 | Important | 7.8 | Mariner (Linux) | tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) | |
| CVE-2026-99154 | Important | 7.8 | Mariner (Linux) | scsi: libiscsi: Reject a negative task index from parse_pdu_itt | |
| CVE-2026-99156 | Important | 7.8 | Mariner (Linux) | scsi: st: Fix use-after-free race between st_remove() and st_open() | |
| CVE-2026-99157 | Important | 7.8 | Mariner (Linux) | scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies | |
| CVE-2026-99167 | Important | 7.8 | Mariner (Linux) | net/sched: fix use-after-free in __tcf_action_put() | |
| CVE-2026-99181 | Important | 7.8 | Mariner (Linux) | autofs: ignore notification errors from a replaced pipe | |
| CVE-2026-99192 | Important | 7.8 | Mariner (Linux) | net: bcmgenet: unshare the skb before writing the control block | |
| CVE-2026-46569 | Important | 7.7 | Mariner (mitre) | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file. | Release Notes |
| CVE-2026-61642 | Important | 7.7 | Mariner (GitHub_M) | Squid Request Smuggling in HTTP Transfer-Encoding | Release Notes |
| CVE-2026-92709 | Important | 7.7 | Mariner (GitHub_M) | Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE | |
| CVE-2026-98442 | Important | 7.7 | Mariner (Linux) | net/sched: act_ct: fix helper UAF due to extensions realloc | |
| CVE-2026-98490 | Important | 7.7 | Mariner (Linux) | net: openvswitch: conntrack: fix helper UAF due to extensions realloc | |
| CVE-2026-98559 | Important | 7.7 | Mariner (Linux) | net/smc: fix UAF on lgr list traversal in smcr_port_err() | Release Notes |
| CVE-2026-98720 | Important | 7.7 | Mariner (Linux) | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified | |
| CVE-2026-98968 | Important | 7.7 | Mariner (Linux) | amt: send the relay's General Query directly from the receive path | |
| CVE-2026-99059 | Important | 7.7 | Mariner (Linux) | wireguard: noise: reject response consumption after intermediate initiation | |
| CVE-2026-115484 | Important | 7.6 | Mariner (redhat) | Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg | |
| CVE-2026-107161 | Important | 7.5 | Mariner (redhat) | Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients | |
| CVE-2026-107300 | Important | 7.5 | Mariner (GitHub_M) | msgpack5: Many buffered values can exhaust the streaming decoder stack | |
| CVE-2026-107302 | Important | 7.5 | Mariner (GitHub_M) | msgpack5: Truncated map32 headers throw an unexpected error | |
| CVE-2026-107349 | Important | 7.5 | Mariner (PostgreSQL) | Infinite loop on empty option name in startup options parameter in PgBouncer | Release Notes |
| CVE-2026-109089 | Important | 7.5 | Mariner (suse) | libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow | |
| CVE-2026-109090 | Important | 7.5 | Mariner (suse) | libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow | |
| CVE-2026-110354 | Important | 7.5 | Mariner (mitre) | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without… | Release Notes |
| CVE-2026-111181 | Important | 7.5 | Mariner (openjs) | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body | |
| CVE-2026-114613 | Important | 7.5 | Mariner (GitHub_M) | MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure | Release Notes |
| CVE-2026-115506 | Important | 7.5 | Mariner (VulnCheck) | libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay | |
| CVE-2026-115909 | Important | 7.5 | Mariner (GitHub_M) | zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction | |
| CVE-2026-116587 | Important | 7.5 | Mariner (GitHub_M) | Go JOSE: DoS when parsing JWKs that contain RSA keys | |
| CVE-2026-119025 | Important | 7.5 | Mariner (VulnCheck) | open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows | |
| CVE-2026-119195 | Important | 7.5 | Mariner (GitHub_M) | pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding | |
| CVE-2026-119196 | Important | 7.5 | Mariner (GitHub_M) | pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding | |
| CVE-2026-119197 | Important | 7.5 | Mariner (GitHub_M) | pyasn1: Quadratic-complexity denial of service in binary REAL decoding | |
| CVE-2026-19630 | Important | 7.5 | Mariner (isc) | Amplified resource exhaustion in inbound message processing | |
| CVE-2026-46729 | Important | 7.5 | Mariner (apache) | Apache HTTP Server: mod_heartmonitor denial of service | Release Notes |
| CVE-2026-47360 | Important | 7.5 | Mariner (apache) | Apache HTTP Server: mod_session: Session cookie not removed during internal redirect | Release Notes |
| CVE-2026-56851 | Important | 7.5 | Mariner (Go) | Panic parsing crafted input in x/text/secure/precis in golang.org/x/text | Release Notes |
| CVE-2026-56866 | Important | 7.5 | Mariner (Go) | HTTP/1 client connection desynchronization after CONNECT rejection in net/http | |
| CVE-2026-63045 | Important | 7.5 | Mariner (apache) | Apache HTTP Server: mod_proxy_ftp PASV address handling | Release Notes |
| CVE-2026-63686 | Important | 7.5 | Mariner (apache) | Apache HTTP Server: mod_xml2enc crash on charset conversion failure | Release Notes |
| CVE-2026-67693 | Important | 7.5 | Mariner (mitre) | An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU) | |
| CVE-2026-77206 | Important | 7.5 | Mariner (libreswan) | IKEv2 pre-authentication Null Pointer Dereference in EAP code | |
| CVE-2026-77207 | Important | 7.5 | Mariner (libreswan) | Null Pointer Dereference in PKCS#7 bundle with no certificates | Release Notes |
| CVE-2026-78659 | Important | 7.5 | Mariner (Go) | HTTP/2 server memory exhaustion due to Trailer headers in net/http | Release Notes, Release Notes, Release Notes +21 |
| CVE-2026-78660 | Important | 7.5 | Mariner (Go) | HTTP/2 transport accepts malformed framing-related headers in net/http | Release Notes, Release Notes, Release Notes +21 |
| CVE-2026-78667 | Important | 7.5 | Mariner (Go) | Lack of limit on size of parsed Range headers in net/http | |
| CVE-2026-78669 | Important | 7.5 | Mariner (Go) | Excessive CPU consumption from repeated initial window changes in net/http | Release Notes, Release Notes, Release Notes +21 |
| CVE-2026-94439 | Important | 7.5 | Mariner (Go) | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http | |
| CVE-2026-94440 | Important | 7.5 | Mariner (Go) | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart | |
| CVE-2026-94453 | Important | 7.5 | Mariner (libreswan) | IKEv2 Use-After-Free bug when using IKE-over-TCP | Release Notes |
| CVE-2026-95124 | Important | 7.5 | Mariner (mitre) | Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache() | |
| CVE-2026-95184 | Important | 7.5 | Mariner (mitre) | Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS). | |
| CVE-2026-95209 | Important | 7.5 | Mariner (mitre) | An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS). | |
| CVE-2026-96888 | Important | 7.5 | Mariner (isc) | Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization | |
| CVE-2026-97031 | Important | 7.5 | Mariner (Go) | Reject malformed ECH outer extension references in crypto/tls | |
| CVE-2026-97032 | Important | 7.5 | Mariner (Go) | HTTP/2 server crash due to HPACK encoder race in net/http | Release Notes, Release Notes, Release Notes +21 |
| CVE-2026-97206 | Important | 7.5 | Mariner (NLnet Labs) | DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. | Release Notes |
| CVE-2026-97313 | Important | 7.5 | Mariner (isc) | Specific RPZ configurations and query patterns may result in an unexpected exit | |
| CVE-2026-98561 | Important | 7.5 | Mariner (Linux) | nfp: hold IPsec RX state under the XArray lock | Release Notes |
| CVE-2026-98707 | Important | 7.5 | Mariner (Linux) | wifi: mac80211: shut down RX BA session timer on teardown | |
| CVE-2026-98734 | Important | 7.5 | Mariner (Linux) | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown | |
| CVE-2026-98735 | Important | 7.5 | Mariner (Linux) | Bluetooth: hci_core: Serialize ACL scheduling with channel deletion | |
| CVE-2026-98846 | Important | 7.5 | Mariner (Linux) | sctp: check RCV_SHUTDOWN after the sendmsg connect wait | |
| CVE-2026-98857 | Important | 7.5 | Mariner (Linux) | ipvs: bound LBLCR and LBLC cache growth | |
| CVE-2026-99081 | Important | 7.5 | Mariner (Linux) | bnxt_en: fix DMA mapping length for padded small packets | |
| CVE-2026-99128 | Important | 7.5 | Mariner (Linux) | sctp: validate chunk length in the inqueue parser | |
| CVE-2026-104252 | Important | 7.4 | Mariner (GitHub_M) | Vitess vttablet /twopcz reflected XSS | Release Notes |
| CVE-2026-105482 | Important | 7.4 | Mariner (hackerone) | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C… | Release Notes |
| CVE-2026-105483 | Important | 7.4 | Mariner (hackerone) | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as… | Release Notes |
| CVE-2026-106069 | Important | 7.4 | Mariner (hackerone) | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host fo… | Release Notes |
| CVE-2026-46572 | Important | 7.4 | Mariner (mitre) | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory. | Release Notes |
| CVE-2026-87866 | Important | 7.4 | Mariner (curl) | wolfSSL public-key pinning bypass | |
| CVE-2026-88647 | Important | 7.4 | Mariner (mitre) | A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate. | |
| CVE-2026-98549 | Important | 7.4 | Mariner (Linux) | tcp: prevent collapsing skbs across boundary in rtx queue | |
| CVE-2026-98570 | Important | 7.4 | Mariner (Linux) | net: ipv6: keep room for the mac header in dst_dev_overhead() | Release Notes |
| CVE-2026-99076 | Important | 7.4 | Mariner (Linux) | ipv6: udp: Create exceptions before socket matching | |
| CVE-2026-99077 | Important | 7.4 | Mariner (Linux) | ipv4: udp: Create exceptions before socket matching | |
| CVE-2026-88829 | Important | 7.2 | Mariner (redhat) | Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy | |
| CVE-2026-108985 | Important | 7.1 | Mariner (mitre) | ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored. | Release Notes |
| CVE-2026-42617 | Important | 7.1 | Mariner (mitre) | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file. | |
| CVE-2026-42618 | Important | 7.1 | Mariner (mitre) | In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file. | Release Notes |
| CVE-2026-98383 | Important | 7.1 | Mariner (Linux) | bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL | Release Notes |
| CVE-2026-98436 | Important | 7.1 | Mariner (Linux) | accel/amdxdna: Disable device buffer exporting | |
| CVE-2026-98457 | Important | 7.1 | Mariner (Linux) | Bluetooth: L2CAP: validate frame length before control and FCS access | Release Notes |
| CVE-2026-98460 | Important | 7.1 | Mariner (Linux) | Bluetooth: hci_sock: reject out-of-range OCF values | Release Notes |
| CVE-2026-98479 | Important | 7.1 | Mariner (Linux) | scsi: libiscsi_tcp: Check the data direction of a Data-In PDU | Release Notes |
| CVE-2026-98483 | Important | 7.1 | Mariner (Linux) | nfc: fix use-after-free in nfc_get_local_general_bytes | Release Notes |
| CVE-2026-98517 | Important | 7.1 | Mariner (Linux) | drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM | |
| CVE-2026-98581 | Important | 7.1 | Mariner (Linux) | nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() | Release Notes |
| CVE-2026-98626 | Important | 7.1 | Mariner (Linux) | bpf: Restrict CO-RE poisoning to relocatable instructions | Release Notes |
| CVE-2026-98686 | Important | 7.1 | Mariner (Linux) | smb: client: discard post-EOF pagecache when extending a file via zero range | |
| CVE-2026-98706 | Important | 7.1 | Mariner (Linux) | wifi: mac80211: drain PS delivery work during station teardown | |
| CVE-2026-98709 | Important | 7.1 | Mariner (Linux) | wifi: mac80211: count only matching reservations in reserved switch | |
| CVE-2026-98736 | Important | 7.1 | Mariner (Linux) | Bluetooth: hci_conn: Lock parent access during enhanced SCO setup | |
| CVE-2026-98737 | Important | 7.1 | Mariner (Linux) | Bluetooth: hci_sync: Fix inquiry cache use-after-free | |
| CVE-2026-98801 | Important | 7.1 | Mariner (Linux) | net: restrict SO_RESERVE_MEM to TCP sockets and cap max value | |
| CVE-2026-98827 | Important | 7.1 | Mariner (Linux) | wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE | |
| CVE-2026-98882 | Important | 7.1 | Mariner (Linux) | media: chips-media: wave5: Add range checks for dec_output_info | Release Notes |
| CVE-2026-98951 | Important | 7.1 | Mariner (Linux) | riscv: ptrace: Zero-initialize regset buffers before copyin | |
| CVE-2026-98959 | Important | 7.1 | Mariner (Linux) | btrfs: fix xattr replace when multiple xattrs are packed in the same item | |
| CVE-2026-99002 | Important | 7.1 | Mariner (Linux) | drm/vmwgfx: validate pitch coming from userspace | |
| CVE-2026-99006 | Important | 7.1 | Mariner (Linux) | drm/i915/gem: Prevent overstepping exec array boundary | |
| CVE-2026-99012 | Important | 7.1 | Mariner (Linux) | Bluetooth: ISO: Serialize concurrent connect calls | |
| CVE-2026-99032 | Important | 7.1 | Mariner (Linux) | net/smc: protect clcsock lifetime in smc_getname | |
| CVE-2026-105773 | Important | 7.0 | Mariner (cisa-cg) | Canimaan Software ClamXAV local privilege escalation | |
| CVE-2026-53613 | Important | 7.0 | Mariner (GitHub_M) | util-linux mount target TOCTOU allows local privilege escalation | |
| CVE-2026-98456 | Important | 7.0 | Mariner (Linux) | Bluetooth: mgmt: fix race in read_unconf_index_list() | Release Notes |
| CVE-2026-98491 | Important | 7.0 | Mariner (Linux) | net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry | Release Notes |
| CVE-2026-98524 | Important | 7.0 | Mariner (Linux) | rds: ib: Clear the sg list when mapping an MR fails | Release Notes |
| CVE-2026-98548 | Important | 7.0 | Mariner (Linux) | sctp: discard the rest of the packet on a stale-cookie error | Release Notes |
| CVE-2026-98733 | Important | 7.0 | Mariner (Linux) | Bluetooth: hci_core: Serialize fragmented ISO packet queueing | |
| CVE-2026-109351 | Important | 6.5 | Mariner (VulnCheck) | Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count | |
| CVE-2026-97629 | Important | 6.5 | Mariner (f5) | NGINX ngx_http_ssl_module vulnerability | |
| CVE-2026-107324 | Important | 5.9 | Mariner (mongodb) | Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver | Release Notes, Release Notes, Release Notes +4 |
| CVE-2026-107325 | Important | 5.9 | Mariner (mongodb) | Application denial of service via missing BSON array length validation in MongoDB Go Driver | Release Notes, Release Notes, Release Notes +4 |
| CVE-2026-118370 | Important | 5.9 | Mariner (VulnCheck) | libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes | |
| CVE-2026-102554 | Important | — | Mariner (Google) | Denial of Service via Eager Array Allocation During Deserialization in Guava | Release Notes |
| CVE-2026-104150 | Important | — | Mariner (GitHub_M) | AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity | |
| CVE-2026-106547 | Important | — | Mariner (HDFG) | HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata | Release Notes |
| CVE-2026-116591 | Important | — | Mariner (GitHub_M) | compress zstd: Panic on two-block frames | |
| CVE-2026-118669 | Important | — | Mariner (GitHub_M) | OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client | |
| CVE-2026-61373 | Important | — | Mariner (apache) | Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation | Release Notes |
| CVE-2026-61374 | Important | — | Mariner (apache) | Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit | Release Notes |
| CVE-2026-63772 | Important | — | Mariner (apache) | Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-66055 | Important | — | Mariner (apache) | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language) | Release Notes, Release Notes |
| CVE-2026-66837 | Important | — | Mariner (apache) | Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length | Release Notes |
| CVE-2026-66858 | Important | — | Mariner (apache) | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml) | Release Notes |
| CVE-2026-66859 | Important | — | Mariner (apache) | Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route | Release Notes |
| CVE-2026-83663 | Important | — | Mariner (apache) | Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go) | Release Notes |
| CVE-2026-83745 | Important | — | Mariner (apache) | Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D) | Release Notes |
| CVE-2026-85493 | Important | — | Mariner (apache) | Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) | Release Notes |
| CVE-2026-86535 | Important | — | Mariner (apache) | Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely | Release Notes |
| CVE-2026-86537 | Important | — | Mariner (apache) | Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service | Release Notes |
| CVE-2026-87117 | Important | — | Mariner (apache) | Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec | Release Notes |
| CVE-2026-90440 | Important | — | Mariner (apache) | Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service | Release Notes |
| CVE-2026-91135 | Important | — | Mariner (apache) | Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) | Release Notes |
| CVE-2026-91137 | Important | — | Mariner (apache) | Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements | Release Notes |
| CVE-2026-92543 | Important | — | Mariner (Docker) | Docker Engine insecure-registry fallback via malicious DNS responses | Release Notes, Release Notes, Release Notes +1 |
| CVE-2026-93318 | Important | — | Mariner (Docker) | Cache poisoning via unvalidated image layer DiffIDs | |
| CVE-2026-93517 | Important | — | Mariner (suse) | X.Org Server GLX RenderLarge Heap Buffer Overflow | |
| CVE-2026-94200 | Important | — | Mariner (EEF) | TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl | Release Notes |
| CVE-2026-94633 | Important | — | Mariner (apache) | Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length | Release Notes |
| CVE-2026-94635 | Important | — | Mariner (apache) | Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name | Release Notes |
| CVE-2026-94639 | Important | — | Mariner (apache) | Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget) | Release Notes |
| CVE-2026-94642 | Important | — | Mariner (apache) | Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception | Release Notes |
| CVE-2026-94644 | Important | — | Mariner (apache) | Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound | Release Notes |
| CVE-2026-94645 | Important | — | Mariner (apache) | Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound | Release Notes |
| CVE-2026-94646 | Important | — | Mariner (apache) | Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers) | Release Notes |
| CVE-2026-94648 | Important | — | Mariner (apache) | Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound | Release Notes |
| CVE-2026-94650 | Important | — | Mariner (apache) | Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion) | Release Notes |
| CVE-2026-94651 | Important | — | Mariner (apache) | Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error | Release Notes |
| CVE-2026-94653 | Important | — | Mariner (apache) | Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) | Release Notes |
| CVE-2026-94654 | Important | — | Mariner (apache) | Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame | Release Notes |
| CVE-2026-94655 | Important | — | Mariner (apache) | Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic | Release Notes |
| CVE-2026-94656 | Important | — | Mariner (apache) | Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound | Release Notes |
| CVE-2026-94657 | Important | — | Mariner (apache) | Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound | Release Notes |
| CVE-2026-94658 | Important | — | Mariner (apache) | Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic) | Release Notes |
| CVE-2026-96277 | Important | — | Mariner (apache) | Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception | Release Notes |
| CVE-2026-96286 | Important | — | Mariner (apache) | Apache Thrift: Perl servers end `serve()` when serving one connection fails | Release Notes |
| CVE-2026-96287 | Important | — | Mariner (apache) | Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) | Release Notes |
| CVE-2026-96288 | Important | — | Mariner (apache) | Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) | Release Notes |
| CVE-2026-96289 | Important | — | Mariner (apache) | Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard | Release Notes |
| CVE-2026-96292 | Important | — | Mariner (apache) | Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic) | Release Notes |
| CVE-2026-96294 | Important | — | Mariner (apache) | Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection | Release Notes |
| CVE-2026-96990 | Important | — | Mariner (apache) | Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound | Release Notes |
| CVE-2026-15176 | Moderate | 8.1 | Mariner (f5) | NGINX ngx_http_core_module vulnerability | |
| CVE-2026-97205 | Moderate | 8.1 | Mariner (f5) | NGINX ngx_http_core_module vulnerability | |
| CVE-2026-115776 | Moderate | 7.5 | Mariner (GitHub_M) | Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer | |
| CVE-2026-115778 | Moderate | 7.5 | Mariner (GitHub_M) | Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer | |
| CVE-2026-48005 | Moderate | 7.5 | Mariner (apache) | Apache HTTP Server: mod_auth_digest reauthentication attack | Release Notes |
| CVE-2026-56449 | Moderate | 7.5 | Mariner (apache) | Apache HTTP Server: mod_proxy_html: crash in dump_content | Release Notes |
| CVE-2026-63292 | Moderate | 7.5 | Mariner (apache) | Apache HTTP Server: mod_vhost_alias stack overflow | Release Notes |
| CVE-2026-86414 | Moderate | 7.5 | Mariner (curl) | leaking host credentials to HTTP proxy | |
| CVE-2026-111943 | Moderate | 7.4 | Mariner (Go) | Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509 | |
| CVE-2026-116620 | Moderate | 7.3 | Mariner (VulDB) | Tencent RapidJSON Regex stream.h Take out-of-bounds | |
| CVE-2026-73637 | Moderate | 7.3 | Mariner (apache) | Apache HTTP Server: mod_auth_digest DoS attack | Release Notes |
| CVE-2026-115486 | Moderate | 7.1 | Mariner (redhat) | Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning | |
| CVE-2026-98169 | Moderate | 7.1 | Mariner (Linux) | smb: client: fix potential OOB read in smb3_enum_snapshots() | Release Notes |
| CVE-2026-98189 | Moderate | 7.1 | Mariner (Linux) | wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() | Release Notes |
| CVE-2026-98197 | Moderate | 7.1 | Mariner (Linux) | hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove | Release Notes |
| CVE-2026-98200 | Moderate | 7.1 | Mariner (Linux) | hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() | Release Notes |
| CVE-2026-98201 | Moderate | 7.1 | Mariner (Linux) | Input: zero ff_effect before compat copy in input_ff_effect_from_user | Release Notes |
| CVE-2026-98204 | Moderate | 7.1 | Mariner (Linux) | Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() | Release Notes |
| CVE-2026-98208 | Moderate | 7.1 | Mariner (Linux) | mmc: sdio_uart: fix xmit_fifo leak when the port table is full | Release Notes |
| CVE-2026-98210 | Moderate | 7.1 | Mariner (Linux) | mmc: mxcmmc: cancel data work and watchdog on remove | Release Notes |
| CVE-2026-98213 | Moderate | 7.1 | Mariner (Linux) | mmc: core: Cancel SDIO IRQ work before freeing host | Release Notes |
| CVE-2026-98218 | Moderate | 7.1 | Mariner (Linux) | i2c: atr: fix dangling adapter pointer on add failure | Release Notes |
| CVE-2026-98231 | Moderate | 7.1 | Mariner (Linux) | xfrm: serialize state GC with device state flush | Release Notes |
| CVE-2026-98234 | Moderate | 7.1 | Mariner (Linux) | net/sched: hhf: cap hh_flows_limit at change time | Release Notes |
| CVE-2026-98236 | Moderate | 7.1 | Mariner (Linux) | net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value | Release Notes |
| CVE-2026-98239 | Moderate | 7.1 | Mariner (Linux) | net: lan743x: fix RX checksum use-after-free | Release Notes |
| CVE-2026-98246 | Moderate | 7.1 | Mariner (Linux) | Bluetooth: hci_sync: Serialize local codec list cleanup | Release Notes |
| CVE-2026-98264 | Moderate | 7.1 | Mariner (Linux) | ALSA: virtio: reset device before deleting virtqueues | Release Notes |
| CVE-2026-98293 | Moderate | 7.1 | Mariner (Linux) | Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() | Release Notes |
| CVE-2026-98294 | Moderate | 7.1 | Mariner (Linux) | Bluetooth: hci_qca: Do not write to the serial port after it is closed | |
| CVE-2026-98357 | Moderate | 7.1 | Mariner (Linux) | IB/isert: wait for deferred control PDU completions before releasing the connection | Release Notes |
| CVE-2026-98360 | Moderate | 7.1 | Mariner (Linux) | RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds | Release Notes |
| CVE-2026-98364 | Moderate | 7.1 | Mariner (Linux) | xfrm: hold net_device reference under RCU in bundle creation | |
| CVE-2026-98369 | Moderate | 7.1 | Mariner (Linux) | xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() | Release Notes |
| CVE-2026-98374 | Moderate | 7.1 | Mariner (Linux) | tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() | Release Notes |
| CVE-2026-98781 | Moderate | 7.1 | Mariner (Linux) | drm/mediatek: Fix pdev reference leak in mtk_drm_bind() | |
| CVE-2026-98782 | Moderate | 7.1 | Mariner (Linux) | drm/mediatek: Fix ovl adaptor platform device leak | |
| CVE-2026-98881 | Moderate | 7.1 | Mariner (Linux) | net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() | Release Notes |
| CVE-2026-98883 | Moderate | 7.1 | Mariner (Linux) | serial: 8250_port: recognize UPIO_AU | Release Notes |
| CVE-2026-98889 | Moderate | 7.1 | Mariner (Linux) | wifi: iwlwifi: mvm: fix sched scan IE sizing | Release Notes |
| CVE-2026-98902 | Moderate | 7.1 | Mariner (Linux) | md/raid5: let stripe batch bm_seq comparison wrap-safe | Release Notes |
| CVE-2026-98904 | Moderate | 7.1 | Mariner (Linux) | mailbox: imx: Use devm_pm_runtime_enable() | |
| CVE-2026-98907 | Moderate | 7.1 | Mariner (Linux) | btrfs: protect sb_write_pointer() with invalidate lock | Release Notes |
| CVE-2026-98913 | Moderate | 7.1 | Mariner (Linux) | net: thunderx: fix PTP device ref leak in nicvf_probe() | Release Notes |
| CVE-2026-98915 | Moderate | 7.1 | Mariner (Linux) | media: video-i2c: use vb2_video_unregister_device on driver removal | Release Notes |
| CVE-2026-98916 | Moderate | 7.1 | Mariner (Linux) | wifi: nl80211: check link is beaconing for color change | |
| CVE-2026-99117 | Moderate | 7.1 | Mariner (Linux) | net: bridge: mcast: don't truncate the port group walk on teardown |
Showing 400 of 1208; narrow by component or search.
Revised by Microsoft 2026-11-01. "Exploited" and "disclosed" are Microsoft's own words from the guide's exploitability index; a CVE's page carries NVD's, CISA's and the public exploit indexes' besides.