Security Box Score — October 18, 2026

552 CVEs published, led by Linux (436).

552 CVEs published October 18, 2026: 5 critical, 21 high, 58 medium, 18 low; 0 in the KEV catalog at press time; 2 with a public exploit reference; 450 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 152 on continuation pages.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	9645	59776	—	—
KEV catalog size	1748

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

3761 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	705	6964	532	2699	910	1	15	6	0.1	7.8	.0018	-801 ▼
microsoft	1460	4363	269	3016	1061	17	291	32	0.7	7.8	.0045	+460 ▲
google	340	3171	390	1236	1407	138	80	9	0.3	7.5	.0026	-176 ▼
red hat	168	1067	57	423	526	61	2	0	0.0	6.5	.0031	+15 ▲
apple	0	564	67	166	317	14	89	9	1.6	6.5	.0019	-246 ▼
freebsd	13	61	3	43	9	3	0	0	0.0	7.8	.0016	+13 ▲
suse	5	58	8	29	19	2	0	0	0.0	7.5	.0033	-12 ▼
canonical	3	53	16	12	20	5	0	0	0.0	7.7	.0021	+3 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	37	219	71	84	63	1	61	18	8.2	8.4	.0044	-60 ▼
ubiquiti	6	71	35	31	3	2	3	3	4.2	8.8	.0050	+6 ▲
palo alto networks	13	65	1	8	38	18	14	3	4.6	4.8	.0028	+4 ▲
fortinet	12	54	13	14	22	5	31	9	16.7	7.0	.0038	+2 ▲
netgear	6	40	0	0	32	8	0	0	0.0	4.3	.0026	+4 ▲
f5	11	37	10	20	6	1	5	2	5.4	8.7	.0048	+3 ▲
ivanti	8	32	8	20	4	0	26	6	18.8	8.8	.0137	-2 ▼
sonicwall	6	25	8	12	5	0	19	4	16.0	7.8	.0049	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	162	869	180	390	266	21	33	2	0.2	7.5	.0056	+69 ▲
mozilla	85	464	127	187	127	0	9	0	0.0	8.8	.0028	-28 ▼
gitlab	26	130	9	29	78	14	5	3	2.3	5.3	.0034	+9 ▲
drupal	0	94	11	9	66	8	4	1	1.1	5.7	.0027	-26 ▼
github	2	25	2	12	11	0	0	0	0.0	7.4	.0058	-1 ▼
docker	8	20	2	10	8	0	0	0	0.0	7.3	.0015	+5 ▲
wordpress	0	6	1	4	1	0	3	3	50.0	8.7	.0363	0
eclipse	0	2	2	0	0	0	0	0	0.0	9.3	.0050	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	2905	581	1660	563	101	28	4	0.1	7.8	.0036	-634 ▼
ibm	205	1228	233	576	398	21	6	1	0.1	7.5	.0035	-92 ▼
adobe	177	1007	108	465	425	9	21	5	0.5	7.5	.0035	+6 ▲
progress	71	137	21	83	32	1	6	1	0.7	7.5	.0034	+68 ▲
zohocorp	1	43	6	29	8	0	0	0	0.0	8.1	.0113	-6 ▼
solarwinds	0	26	18	5	3	0	10	4	15.4	9.1	.0067	-1 ▼
veeam	6	25	7	11	7	0	1	0	0.0	8.5	.0036	+6 ▲
servicenow	0	10	7	3	0	0	2	0	0.0	9.4	.0046	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
siemens	33	87	9	52	23	3	0	7.3	.0028	+18 ▲
d-link	2	76	23	29	12	12	3	8.5	.0164	-19 ▼
synology	0	46	5	10	25	6	0	5.6	.0032	-19 ▼
rockwell automation	2	45	5	34	6	0	0	8.7	.0028	-16 ▼
advantech	0	20	2	17	1	0	0	8.6	.0071	-17 ▼
schneider electric	1	19	2	12	5	0	0	8.6	.0043	-8 ▼
abb	1	12	1	6	5	0	0	7.2	.0017	0
hitachi energy	0	12	2	4	6	0	0	7.0	.0025	-4 ▼

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	52	430	45	194	170	21	2	1	0.2	7.2	.0026	-125 ▼
nvidia	20	321	27	221	73	0	0	0	0.0	7.8	.0019	-12 ▼
sourcecodester	32	269	0	0	162	107	0	0	0.0	5.5	.0041	-16 ▼
openclaw	1	229	5	117	85	22	0	0	0.0	7.1	.0031	-1 ▼
hewlett packard enterprise (hpe)	38	204	39	92	64	9	1	1	0.5	7.3	.0042	-91 ▼
mongodb	22	191	6	106	72	7	1	0	0.0	7.1	.0035	-42 ▼
juniper networks	153	175	23	130	22	0	7	0	0.0	8.6	.0035	+153 ▲
itsourcecode	18	171	0	0	42	129	0	0	0.0	2.1	.0033	-16 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-93616	.7587	99.5	9.8
CVE-2026-87902	.3998	98.6	8.1
CVE-2026-59774	.2831	98.1	9.8
CVE-2026-104935	.2598	98.0	8.6
CVE-2026-111214	.0863	95.1	8.6
CVE-2026-111218	.0844	95.0	8.6
CVE-2026-111215	.0705	94.1	8.6
CVE-2026-111217	.0705	94.1	8.6
CVE-2026-12269	.0699	94.1	8.8
CVE-2026-111216	.0655	93.7	8.6

Highest CVSS
CVE	CVSS	EPSS
CVE-2026-108576	10.0	.0245
CVE-2026-105484	10.0	.0213
CVE-2026-73369	10.0	.0125
CVE-2026-75699	10.0	.0125
CVE-2026-75703	10.0	.0125
CVE-2026-75721	10.0	.0125
CVE-2026-84412	10.0	.0125
CVE-2026-89275	10.0	.0125
CVE-2026-86708	10.0	.0124
CVE-2026-61732	10.0	.0122

Most disclosures (vendor)
Vendor	CVEs
microsoft	1462
linux	1313
google	486
ibm	312
red hat	279
apache	264
adobe	230
mozilla	163
nvidia	155
juniper networks	153

Most KEV additions (YTD)
Vendor	KEV
microsoft	32
cisco	18
apple	9
fortinet	9
google	9
ivanti	6
linux	6
adobe	5
berriai	4
checkpoint	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	95
npm	45
PyPI	36
NuGet	29
Packagist	23
Go	12
crates.io	8
RubyGems	4

Fastest to KEV
CVE	Vendor	Days
CVE-2026-102764	BeyondTrust	0
CVE-2026-86950	Apple	0
CVE-2026-88779	NetScaler	0
CVE-2026-93952	Arista Networks	0
CVE-2026-102489	Zammad GmbH	1
CVE-2026-102490	Zammad GmbH	1
CVE-2026-87902	WordPress	2
CVE-2026-21589	Atlassian	9
CVE-2026-105133	Ahsay	10
CVE-2026-105134	Ahsay	10

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1796
CVE-2021-27102	n/a	2021-11-17	1796
CVE-2021-27101	n/a	2021-11-17	1796
CVE-2021-27103	n/a	2021-11-17	1796
CVE-2021-21017	Adobe	2021-11-17	1796
CVE-2021-28550	Adobe	2021-11-17	1796
CVE-2021-42013	Apache Software Foundation	2021-11-17	1796
CVE-2021-41773	Apache Software Foundation	2021-11-17	1796
CVE-2021-30858	Apple	2021-11-17	1796
CVE-2021-30860	Apple	2021-11-17	1796

Transactions

EXPLOIT PUBLISHED — JeecgBoot: 20 CVEs (CVE-2026-108607, CVE-2026-108612, CVE-2026-108617, CVE-2026-108622, CVE-2026-108627, CVE-2026-108632, CVE-2026-108637, CVE-2026-108642, CVE-2026-108647, CVE-2026-108652, CVE-2026-108657, CVE-2026-108662, CVE-2026-108667, CVE-2026-108672, CVE-2026-108677, CVE-2026-108869, CVE-2026-108874, CVE-2026-108879, CVE-2026-108884, CVE-2026-108891). Public exploit references added.

EXPLOIT PUBLISHED — Unknown Patreon WordPress: 3 CVEs (CVE-2026-92431, CVE-2026-92432, CVE-2026-92433). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2025-53690 (Sitecore Experience Manager (XM)). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-103376 (Unknown PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-104122 (Unknown Ukr-To-Lat). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-104246 (Unknown Contact Form 7 Signature Addon). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-106470 (Unknown WP Data Access). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108165 (immich-app immich). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108689 (WuKongOpenSource Wukong AICRM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108702 (1Panel-dev CordysCRM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108707 (WuKongOpenSource Wukong_HRM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108950 (opensource-socialnetwork). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109181 (jishenghua jshERP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109186 (jishenghua jshERP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-110527 (Unknown WP User Manager). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-33555 (HAProxy). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-81343 (Unknown ACF Frontend Admin by DynamiApps). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-81344 (Unknown ACF Frontend Admin by DynamiApps). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-91074 (Unknown BSK PDF Manager). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-97314 (Unknown ThirstyAffiliates). Public exploit reference added.

DUE DATE PASSED — CVE-2026-0322 (Palo Alto Networks Cloud NGFW). CISA remediation deadline was October 17, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-105133 (AhsayCBS). CISA remediation deadline was October 17, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-105134 (AhsayCBS). CISA remediation deadline was October 17, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-76519 (Cisco Secure Email). CISA remediation deadline was October 17, 2026; still in catalog.

RESCORED — Fortinet FortiOS: 4 CVEs (CVE-2025-31514, CVE-2025-47890, CVE-2025-53843, CVE-2025-58413). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2025-22862 (Fortinet FortiProxy). CVSS 6.3 → 6.7 (NVD).

RESCORED — CVE-2025-25253 (Fortinet FortiProxy). CVSS 6.8 → 7.5 (NVD).

RESCORED — CVE-2025-31366 (Fortinet FortiSASE). CVSS 4.5 → 6.1 (NVD).

RESCORED — CVE-2025-41115 (Grafana Enterprise). CVSS 10 → 9.8 (NVD).

RESCORED — CVE-2025-46373 (Fortinet FortiClientWindows). CVSS 7.1 → 7.8 (NVD).

RESCORED — CVE-2025-57740 (Fortinet FortiPAM). CVSS 6.7 → 8.8 (NVD).

RESCORED — CVE-2025-58034 (Fortinet FortiWeb). CVSS 6.7 → 7.2 (NVD).

RESCORED — CVE-2025-58360 (geoserver). CVSS 8.2 → 9.8 (NVD).

RESCORED — CVE-2025-64446 (Fortinet FortiWeb). CVSS 9.4 → 9.8 (NVD).

RESCORED — CVE-2026-33555 (HAProxy). CVSS 4 → 5.8 (NVD).

RESCORED — CVE-2026-96658 (Red Hat Satellite 6.16 for RHEL 8). CVSS 9.9 → 8.8 (NVD).

PATCH SHIPPED — CVE-2026-15143 (guardrails-detectors). Fixed in Red Hat OpenShift AI 3.4 1791537794.

PATCH SHIPPED — CVE-2026-57727 (Themeum Kirki). Fixed in Kirki 6.2.1.

PATCH SHIPPED — CVE-2026-91202 (Red Hat Enterprise Linux 9). Fixed in Red Hat Enterprise Linux 9 0:36.1-1.el9_8.

PATCH SHIPPED — CVE-2026-91205 (Red Hat Enterprise Linux 9). Fixed in Red Hat Enterprise Linux 9 0:36.1-1.el9_8.

PATCH SHIPPED — CVE-2026-96442 (GNU Emacs). Fixed in Red Hat Enterprise Linux 10 1:29.4-14.el10_2.3.

Yesterday's Results

How to read these box scores · glossary

552 CVEs published. 25 box scores and 375 table rows below; the remaining 152 continue on page 2 — every CVE is listed, nothing truncated.

CVE-2026-111876LOW

alexpasmantier television entry.rs output command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   48.9     —

AFFECTED
  Product     Versions  Fixed
  television  0.15.0 –  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Received

CVE-2026-111869MEDIUM

makeplane API Endpoint reliance on untrusted inputs in a security decision

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0054   44.4     —

AFFECTED
  Product  Versions  Fixed
  plane    1.4.0 –   —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-20, CWE-807 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-111874LOW

n/a OpenCATS — OpenCATS Career Portal CareersUI.php processLogin excessive authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   L   N   N    2.9   .0048   40.3     —

AFFECTED
  Product   Versions  Fixed
  OpenCATS  0.10.0 –  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-307, CWE-799 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Deferred

CVE-2026-111870MEDIUM

itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0043   35.7     —

AFFECTED
  Product                    Versions                                    Fixed
  Online-Examination-System  e6208e630b14657999bbfe4c9912302d2a1e2449 –  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-287, CWE-306 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-111942LOW

hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0027   18.4     —

AFFECTED
  Product                       Versions  Fixed
  Blood_Bank_Management_System  1.0.0 –   —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-111871MEDIUM

itsmeravitejak Online-Examination-System subjectsdb.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   16.9     —

AFFECTED
  Product                    Versions                                    Fixed
  Online-Examination-System  e6208e630b14657999bbfe4c9912302d2a1e2449 –  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-111872MEDIUM

itsmeravitejak Online-Examination-System database.php getreport sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   16.9     —

AFFECTED
  Product                    Versions                                    Fixed
  Online-Examination-System  e6208e630b14657999bbfe4c9912302d2a1e2449 –  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-111873MEDIUM

itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   16.9     —

AFFECTED
  Product                    Versions                                    Fixed
  Online-Examination-System  e6208e630b14657999bbfe4c9912302d2a1e2449 –  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-111877LOW

dext34-morgan Books4Cash search.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0026   17.0     —

AFFECTED
  Product     Versions                                    Fixed
  Books4Cash  a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571 –  —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-111997MEDIUM

beaugunderson ip-address — ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and applica…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   N   N   L    6.3   .0025   15.6     —

AFFECTED
  Product     Versions     Fixed
  ip-address  unspecified  —

TIMELINE
  Oct 18  Reserved by CNA
  Oct 18  Published (CNA: mitre)

CWE-1333 · CNA: mitre · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-111868LOW

datastax pulsar-jms PulsarObjectMessage.java decode deserialization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0025   14.8     —

AFFECTED
  Product     Versions  Fixed
  pulsar-jms  9.0.0 –   —

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-20, CWE-502 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-111875LOW

David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    2.0   .0023   12.5     —

AFFECTED
  Product       Versions  Fixed
  Databasement  1.8.0 –   1.8.2

TIMELINE
  Oct 17  Reserved by CNA
  Oct 18  Published (CNA: VulDB)

CWE-862, CWE-863 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-110981HIGH

Unknown WP Photo Album Plus — WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  L    7.1   .0017    6.2     —

AFFECTED
  Product              Versions     Fixed
  WP Photo Album Plus  unspecified  —

TIMELINE
  Oct 15  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-96534HIGH

Unknown Modern Events Calendar Lite — Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  N  N    7.7   .0016    5.0     —

AFFECTED
  Product                      Versions     Fixed
  Modern Events Calendar Lite  unspecified  —
  Modern Event Calendar Pro    unspecified  —

TIMELINE
  Sep 23  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-89 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-110033MEDIUM

Unknown Salon Booking System — Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   R  U  H  H  H    6.8   .0015    4.0     —

AFFECTED
  Product               Versions     Fixed
  Salon Booking System  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-110069MEDIUM

Unknown Modern Events Calendar Lite — Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  L  N  N    4.3   .0014    3.0     —

AFFECTED
  Product                      Versions     Fixed
  Modern Events Calendar Lite  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-200 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-109937MEDIUM

Unknown Otter Blocks — Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  L  L  N    5.4   .0014    2.7     —

AFFECTED
  Product       Versions     Fixed
  Otter Blocks  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-601 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-87844MEDIUM

Unknown PickPlugins Product Designer for WooCommerce — Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0014    2.7     —

AFFECTED
  Product                                       Versions     Fixed
  PickPlugins Product Designer for WooCommerce  unspecified  —

TIMELINE
  Sep 9   Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-110031HIGH

Unknown Salon Booking System — Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0013    2.5     —

AFFECTED
  Product               Versions  Fixed
  Salon Booking System  10.17 –   —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-269 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-110070MEDIUM

Unknown Modern Events Calendar Lite — Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  N    6.5   .0013    2.5     —

AFFECTED
  Product                      Versions     Fixed
  Modern Events Calendar Lite  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-639 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-110032MEDIUM

Unknown Salon Booking System — Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  L    5.5   .0013    2.5     —

AFFECTED
  Product               Versions     Fixed
  Salon Booking System  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-863 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-110026MEDIUM

Unknown Tasty Recipes Lite — Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  N    4.9   .0013    2.5     —

AFFECTED
  Product             Versions  Fixed
  Tasty Recipes Lite  1.2 –     —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-110976MEDIUM

Unknown AI Engine — AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  N    4.9   .0013    2.5     —

AFFECTED
  Product    Versions     Fixed
  AI Engine  unspecified  —

TIMELINE
  Oct 15  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-111041MEDIUM

Unknown AI Engine — AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  N    4.9   .0013    2.5     —

AFFECTED
  Product    Versions     Fixed
  AI Engine  unspecified  —

TIMELINE
  Oct 15  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-110035MEDIUM

Unknown Salon Booking System — Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  L  N  N    4.3   .0013    2.5     —

AFFECTED
  Product               Versions     Fixed
  Salon Booking System  unspecified  —

TIMELINE
  Oct 13  Reserved by CNA
  Oct 18  Published (CNA: WPScan)

CWE-284 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-110372	9.8	—	Brainstorm Force	OttoKit	CWE-266	WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability
CVE-2026-110886	9.8	—	QuantumCloud	Conversational Forms for ChatBot	CWE-502	WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injec…
CVE-2026-109894	9.3	—	Arraytics	Booktics	CWE-89	WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability
CVE-2026-111998	9.3	—	vanus-labs	vanus	CWE-1392	Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
CVE-2026-112005	9.2	—	clidey	whodb	CWE-22	WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor
CVE-2026-107436	8.8	—	WP Chill	Strong Testimonials	CWE-502	WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnera…
CVE-2026-111999	8.7	—	vanus-labs	vanus	CWE-306	Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP…
CVE-2026-112021	8.7	—	grunfink	snac2	CWE-122	snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_le…
CVE-2026-112001	8.6	—	ProjectSend	ProjectSend	CWE-863	ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Ab…
CVE-2026-110895	8.5	—	DevItems	Support Genix	CWE-89	WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability
CVE-2026-112006	8.3	—	OpenTelemetry	opentelemetry-exporter-otlp-proto-http	CWE-295	OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Impr…
CVE-2026-112051	8.3	—	xorbitsai	inference	CWE-22	Xinference through 4.0.1 Path Traversal via model_name in Custom Model Regist…
CVE-2026-110373	8.1	—	Hamid Alinia	Login with phone number	CWE-266	WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vul…
CVE-2026-112015	7.7	—	omnigent-ai	omnigent	CWE-22	Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd
CVE-2026-112002	7.6	—	ProjectSend	ProjectSend	CWE-620	ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
CVE-2026-110383	7.5	—	WP E-Signature	Electronic Signature Add-on for Fluent Forms	CWE-639	WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Inse…
CVE-2026-112018	7.3	—	jkuhlmann	cgltf	CWE-787	cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
CVE-2026-112000	7.2	—	vanus-labs	vanus	CWE-862	Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
CVE-2026-108485	7.1	—	ThemeGrill	eStore	CWE-79	WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability
CVE-2026-109895	7.1	—	Arraytics	Booktics	CWE-79	WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability
CVE-2026-110382	7.1	—	NSquared	Simply Schedule Appointments	CWE-79	WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scrip…
CVE-2026-110897	7.1	—	IdeaBox Creations	PowerPack Lite for Beaver Builder	CWE-79	WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scri…
CVE-2026-112017	7.1	—	jeecgboot	JeecgBoot	CWE-89	JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass
CVE-2026-112007	6.9	—	schismtracker	Schism Tracker	CWE-787	Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader
CVE-2026-112008	6.9	—	libmng	libmng	CWE-131	libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr
CVE-2026-112016	6.9	—	Netcore	NR256CN	CWE-306	Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging…
CVE-2026-112019	6.9	—	jkuhlmann	cgltf	CWE-125	cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
CVE-2026-112020	6.9	—	lvandeve	lodepng	CWE-125	LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
CVE-2026-112048	6.9	—	SpatiaLite	libspatialite	CWE-789	libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygo…
CVE-2026-112052	6.9	—	SpatiaLite	libspatialite	CWE-190	libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
CVE-2026-112059	6.9	—	libLAS	libLAS	CWE-787	libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
CVE-2026-110024	6.8	—	@fastify/jwt	@fastify/jwt	CWE-613	@fastify/jwt vulnerable to missing token expiration when per-call options dro…
CVE-2026-112009	6.8	—	icculus	smpeg	CWE-125	smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer
CVE-2026-112010	6.8	—	icculus	smpeg	CWE-191	smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp
CVE-2026-112013	6.8	—	True Audio	libtta	CWE-369	libtta through 2.3 Divide by Zero via tta_decoder_init_get_info
CVE-2026-112014	6.8	—	netease-youdao	LobsterAI	CWE-321	LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
CVE-2026-112046	6.8	—	OW2	ASM	CWE-835	OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resol…
CVE-2026-112053	6.8	—	Schroedinger	schroedinger	CWE-125	Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_para…
CVE-2026-112054	6.8	—	Schroedinger	schroedinger	CWE-369	Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Trans…
CVE-2026-112055	6.8	—	wvWare	wv	CWE-125	wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetC…
CVE-2026-112056	6.8	—	wvWare	wv	CWE-125	wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH
CVE-2026-112057	6.8	—	VideoLAN	libdvdnav	CWE-125	libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
CVE-2026-112058	6.8	—	VideoLAN	libdvdnav	CWE-125	libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
CVE-2026-112049	6.7	—	Vita3K	Vita3K	CWE-22	Vita3K before build 4187 Path Traversal via VPK Package Installation
CVE-2026-110365	6.5	—	WPExperts	Advanced File Manager	CWE-862	WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vuln…
CVE-2026-110880	6.5	—	Kit	Kit (formerly ConvertKit)	CWE-862	WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control v…
CVE-2026-110883	6.5	—	VideoWhisper.com	2Way VideoCalls and Random Chat	CWE-305	WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentica…
CVE-2026-110885	6.5	—	HivePress	HivePress	CWE-94	WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability
CVE-2026-112060	6.1	—	RTMPDump	librtmp	CWE-787	librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode
CVE-2026-112003	6.0	—	ProjectSend	ProjectSend	CWE-180	ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/…
CVE-2026-112062	6.0	—	lwIP	lwIP	CWE-121	lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
CVE-2026-112063	6.0	—	strophe	libstrophe	CWE-121	libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi
CVE-2026-112011	5.8	—	True Audio	libtta	CWE-190	libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table
CVE-2026-111990	5.5	—	kishan0725	Hospital Management System	CWE-74	kishan0725 Hospital Management System Appointment Cancellation admin-panel.ph…
CVE-2026-112025	5.5	—	light0011	cms	CWE-266	light0011 cms Captcha Validation UserController.class.php access control
CVE-2026-112027	5.5	—	light0011	cms	CWE-200	light0011 cms Uploadify check-exists.php file_exists file information disclosure
CVE-2026-112028	5.5	—	light0011	cms	CWE-840	light0011 cms Vote VoteController.class.php logic error
CVE-2026-111988	5.3	—	dyad-sh	dyad	CWE-352	dyad-sh dyad OAuth Callback cross-site request forgery
CVE-2026-112030	5.3	—	diem-project	diem	CWE-1393	diem-project diem dmDataLoad.php default password
CVE-2026-112047	5.3	—	OneUptime	oneuptime	CWE-863	OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
CVE-2026-112061	5.3	—	RTMPDump	librtmp	CWE-125	librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode
CVE-2026-112031	5.1	—	Chamilo	LMS	CWE-79	Chamilo LMS Ticket TicketManager.php addProject cross site scripting
CVE-2026-112032	5.1	—	aircheng-org	iWebShop-5	CWE-89	aircheng-org iWebShop-5 util.php search sql injection
CVE-2026-112111	5.1	—	Bootstrap Shortcodes project	Bootstrap Shortcodes	CWE-79	The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to s…
CVE-2026-112012	4.8	—	True Audio	libtta	CWE-787	libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count
CVE-2026-112026	2.9	—	light0011	cms	CWE-326	light0011 cms UserModel.class.php sha1 weak password hash
CVE-2026-112004	2.3	—	teableio	teable	CWE-639	Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Renam…
CVE-2026-112050	2.3	—	gitify-app	gitify	CWE-352	Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
CVE-2026-112112	2.3	—	nic	BIRD	CWE-1284	An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon…
CVE-2026-111984	2.1	—	AUTOMATIC1111	stable-diffusion-webui	CWE-79	AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create…
CVE-2026-111985	2.1	—	AUTOMATIC1111	stable-diffusion-webui	CWE-400	AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_me…
CVE-2026-111986	2.1	—	AUTOMATIC1111	stable-diffusion-webui	CWE-74	AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj…
CVE-2026-111987	2.1	—	AUTOMATIC1111	stable-diffusion-webui	CWE-79	AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py…
CVE-2026-111991	2.1	—	WongKinYiu	yolov9	CWE-74	WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code in…
CVE-2026-111992	2.1	—	itsmeravitejak	Online-Examination-System	CWE-74	itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection
CVE-2026-111993	1.9	—	Soarkey	StudentManagement	CWE-310	Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
CVE-2026-112029	1.1	—	diem-project	diem	CWE-326	diem-project diem SHA1 PluginDmUser.class.php weak password hash
CVE-2024-4457	await	—	WSO2	WSO2 Enterprise Integrator	CWE-78	Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Prod…
CVE-2026-78497	await	—	—	JQ-Lite	CWE-95	JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query'…
CVE-2026-97204	await	—	Gitea	Gitea	CWE-863	Gitea label deletion across repository and organization IDs
CVE-2026-97859	await	—	Gitea	Gitea	CWE-862	Gitea API disclosure of private user social graph, keys and stars
CVE-2026-98433	await	—	Linux	Linux	—	KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
CVE-2026-98434	await	—	Linux	Linux	—	sysctl: Check range in proc_dointvec_ms_jiffies_minmax
CVE-2026-98435	await	—	Linux	Linux	—	EDAC/altera: Use parent device for devres in altr_portb_setup()
CVE-2026-98436	await	—	Linux	Linux	—	accel/amdxdna: Disable device buffer exporting
CVE-2026-98437	await	—	Linux	Linux	—	media: qcom: iris: fix runtime PM reference leaks
CVE-2026-98438	await	—	Linux	Linux	—	mptcp: options: fix uninit-value in mptcp_write_data_fin
CVE-2026-98439	await	—	Linux	Linux	—	smb/server: cancel async requests when closing connection
CVE-2026-98440	await	—	Linux	Linux	—	KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
CVE-2026-98441	await	—	Linux	Linux	—	net/sched: act_ct: avoid modifying shared unconfirmed ct entry
CVE-2026-98442	await	—	Linux	Linux	—	net/sched: act_ct: fix helper UAF due to extensions realloc
CVE-2026-98443	await	—	Linux	Linux	—	xfs: fix cursor and pointer handling when recovering iunlink buckets
CVE-2026-98444	await	—	Linux	Linux	—	xfs: drop dquot flush lock when we can't find a buffer to flush
CVE-2026-98445	await	—	Linux	Linux	—	xfs: don't let memory failures leak blocks and kill repairs
CVE-2026-98446	await	—	Linux	Linux	—	xfs: don't let hidden_space go negative in xfs_metafile_resv_init
CVE-2026-98447	await	—	Linux	Linux	—	xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
CVE-2026-98448	await	—	Linux	Linux	—	xfs: release orphanage dir inode if chown fails
CVE-2026-98449	await	—	Linux	Linux	—	smb: client: delete compound mids on send failure before unlock
CVE-2026-98450	await	—	Linux	Linux	—	smb: client: close completed creates on compound wait errors
CVE-2026-98451	await	—	Linux	Linux	—	smb: client: use finish_no_open() for non-regular inodes
CVE-2026-98452	await	—	Linux	Linux	—	smb: client: clean up failed cached directory opens
CVE-2026-98453	await	—	Linux	Linux	—	smb: client: close handle after create-context parsing failure
CVE-2026-98454	await	—	Linux	Linux	—	smb: client: fix create context out-of-bounds reads
CVE-2026-98455	await	—	Linux	Linux	—	Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
CVE-2026-98456	await	—	Linux	Linux	—	Bluetooth: mgmt: fix race in read_unconf_index_list()
CVE-2026-98457	await	—	Linux	Linux	—	Bluetooth: L2CAP: validate frame length before control and FCS access
CVE-2026-98458	await	—	Linux	Linux	—	Bluetooth: ISO: release unused CIS holds after channel attach
CVE-2026-98459	await	—	Linux	Linux	—	Bluetooth: ISO: balance the parent hold in hci_bind_bis()
CVE-2026-98460	await	—	Linux	Linux	—	Bluetooth: hci_sock: reject out-of-range OCF values
CVE-2026-98461	await	—	Linux	Linux	—	Bluetooth: hci_sock: validate event length before filtering
CVE-2026-98462	await	—	Linux	Linux	—	Bluetooth: hci_conn: fix CIS hold ownership on reuse
CVE-2026-98463	await	—	Linux	Linux	—	sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
CVE-2026-98464	await	—	Linux	Linux	—	RISC-V: KVM: Synchronize hrtimer callback during teardown
CVE-2026-98465	await	—	Linux	Linux	—	RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
CVE-2026-98466	await	—	Linux	Linux	—	KVM: arm64: Transfer the hyp stack pages out of the host stage-2
CVE-2026-98467	await	—	Linux	Linux	—	KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
CVE-2026-98468	await	—	Linux	Linux	—	KVM: arm64: Fix spurious warning for benign stage 2 teardown race
CVE-2026-98469	await	—	Linux	Linux	—	KVM: arm64: Fix AArch32 DBGBXVR<n> handling
CVE-2026-98470	await	—	Linux	Linux	—	KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
CVE-2026-98471	await	—	Linux	Linux	—	KVM: SEV: Do cache maintenance on the source VM during intra-host migration
CVE-2026-98472	await	—	Linux	Linux	—	KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
CVE-2026-98473	await	—	Linux	Linux	—	s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config
CVE-2026-98474	await	—	Linux	Linux	—	s390/pci: Fix missing device lock in zpci_report_status()
CVE-2026-98475	await	—	Linux	Linux	—	s390/cmf: Fix virtual vs physical address confusion
CVE-2026-98476	await	—	Linux	Linux	—	s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
CVE-2026-98477	await	—	Linux	Linux	—	perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
CVE-2026-98478	await	—	Linux	Linux	—	scsi: ufs: core: Keep internal commands dispatchable during error handling
CVE-2026-98479	await	—	Linux	Linux	—	scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
CVE-2026-98480	await	—	Linux	Linux	—	nfc: trf7970a: power down on startup RX gain failure
CVE-2026-98481	await	—	Linux	Linux	—	nfc: port100: reject frames whose declared length exceeds the received data
CVE-2026-98482	await	—	Linux	Linux	—	nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
CVE-2026-98483	await	—	Linux	Linux	—	nfc: fix use-after-free in nfc_get_local_general_bytes
CVE-2026-98484	await	—	Linux	Linux	—	netfilter: nf_tables: skip expired catchall elements on insert and delete
CVE-2026-98485	await	—	Linux	Linux	—	netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
CVE-2026-98486	await	—	Linux	Linux	—	net: ena: fix MMIO read buffer leak on probe failure
CVE-2026-98487	await	—	Linux	Linux	—	net: bridge: mdb: restart port group walk after deletion
CVE-2026-98488	await	—	Linux	Linux	—	net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
CVE-2026-98489	await	—	Linux	Linux	—	net: atl1c: fix soft lockup on out-of-range tpd_cons read
CVE-2026-98490	await	—	Linux	Linux	—	net: openvswitch: conntrack: fix helper UAF due to extensions realloc
CVE-2026-98491	await	—	Linux	Linux	—	net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
CVE-2026-98492	await	—	Linux	Linux	—	net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
CVE-2026-98493	await	—	Linux	Linux	—	net: ipconfig: bound DHCP option construction
CVE-2026-98494	await	—	Linux	Linux	—	net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
CVE-2026-98495	await	—	Linux	Linux	—	net: arp: terminate device name before lookup
CVE-2026-98496	await	—	Linux	Linux	—	net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
CVE-2026-98497	await	—	Linux	Linux	—	net/mlx5e: fix swapped IPv6 IPsec policy masks
CVE-2026-98498	await	—	Linux	Linux	—	net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
CVE-2026-98499	await	—	Linux	Linux	—	HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
CVE-2026-98500	await	—	Linux	Linux	—	HID: hid-oxp: use cancel_delayed_work_sync() in remove
CVE-2026-98501	await	—	Linux	Linux	—	HID: alps: fix use-after-free on input2 registration failure
CVE-2026-98502	await	—	Linux	Linux	—	HID: alps: unregister DualPoint Stick input device on remove
CVE-2026-98503	await	—	Linux	Linux	—	packet: use ubuf_info completion for TX_RING packets
CVE-2026-98504	await	—	Linux	Linux	—	PCI: of_property: Omit bus properties without a subordinate bus
CVE-2026-98505	await	—	Linux	Linux	—	mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
CVE-2026-98506	await	—	Linux	Linux	—	mm/hugetlb: do not dissolve gigantic pages without runtime support
CVE-2026-98507	await	—	Linux	Linux	—	mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
CVE-2026-98508	await	—	Linux	Linux	—	drm/virtio: fix NULL pointer dereference on fence allocation failure
CVE-2026-98509	await	—	Linux	Linux	—	drm/virtio: fix memory leak of fence event on execbuffer failure
CVE-2026-98510	await	—	Linux	Linux	—	drm/xe/vm: nuke PTs only after unlinking contested VMAs
CVE-2026-98511	await	—	Linux	Linux	—	drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
CVE-2026-98512	await	—	Linux	Linux	—	drm/nouveau: RCU-free the scheduler-containing nouveau_sched
CVE-2026-98513	await	—	Linux	Linux	—	drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
CVE-2026-98514	await	—	Linux	Linux	—	drm/nouveau: Fix gem reference leak in validate_init()
CVE-2026-98515	await	—	Linux	Linux	—	drm/nouveau: fix double-free in nvif_vmm_dtor
CVE-2026-98516	await	—	Linux	Linux	—	drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
CVE-2026-98517	await	—	Linux	Linux	—	drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
CVE-2026-98518	await	—	Linux	Linux	—	drm/nouveau/dmem: pin VRAM for the whole registered range
CVE-2026-98519	await	—	Linux	Linux	—	drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
CVE-2026-98520	await	—	Linux	Linux	—	drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
CVE-2026-98521	await	—	Linux	Linux	—	drm/i915: fix incorrect RCU teardown order
CVE-2026-98522	await	—	Linux	Linux	—	drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
CVE-2026-98523	await	—	Linux	Linux	—	drm/client: fix restore of partially initialized client
CVE-2026-98524	await	—	Linux	Linux	—	rds: ib: Clear the sg list when mapping an MR fails
CVE-2026-98525	await	—	Linux	Linux	—	mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
CVE-2026-98526	await	—	Linux	Linux	—	llc: reserve device headroom for allocated frames
CVE-2026-98527	await	—	Linux	Linux	—	gpio: zynq: fix runtime PM leak on request error path
CVE-2026-98528	await	—	Linux	Linux	—	gpio: cdev: fix kernel stack leak to user-space in error path
CVE-2026-98529	await	—	Linux	Linux	—	gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
CVE-2026-98530	await	—	Linux	Linux	—	kprobes: Fix permanent hang when flushing the kprobe optimizer
CVE-2026-98531	await	—	Linux	Linux	—	ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
CVE-2026-98532	await	—	Linux	Linux	—	ipv6: do not let ipv6_find_hdr() return an offset past the packet end
CVE-2026-98533	await	—	Linux	Linux	—	ipe: protect the dm-verity root hash with RCU
CVE-2026-98534	await	—	Linux	Linux	—	ipe: fix use-after-free when auditing a newly loaded policy
CVE-2026-98535	await	—	Linux	Linux	—	fsl/fman: Fix clk reference leak in read_dts_node()
CVE-2026-98536	await	—	Linux	Linux	—	writeback: report a Tasks-RCU quiescent state per cgwb drain pass
CVE-2026-98537	await	—	Linux	Linux	—	workqueue: Fix NULL current_pwq deref in flush dependency check
CVE-2026-98538	await	—	Linux	Linux	—	writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
CVE-2026-98539	await	—	Linux	Linux	—	fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's …
CVE-2026-98540	await	—	Linux	Linux	—	fprobe: Terminate the fgraph_data list when the reservation is not filled
CVE-2026-98541	await	—	Linux	Linux	—	fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
CVE-2026-98542	await	—	Linux	Linux	—	cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitio…
CVE-2026-98543	await	—	Linux	Linux	—	bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
CVE-2026-98544	await	—	Linux	Linux	—	bna: prevent IOC timer rearm during teardown
CVE-2026-98545	await	—	Linux	Linux	—	ata: libata-scsi: bound the ATA passthru sense descriptor writes
CVE-2026-98546	await	—	Linux	Linux	—	arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
CVE-2026-98547	await	—	Linux	Linux	—	af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
CVE-2026-98548	await	—	Linux	Linux	—	sctp: discard the rest of the packet on a stale-cookie error
CVE-2026-98549	await	—	Linux	Linux	—	tcp: prevent collapsing skbs across boundary in rtx queue
CVE-2026-98550	await	—	Linux	Linux	—	tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
CVE-2026-98551	await	—	Linux	Linux	—	perf/core: Fill branch entries with a single assignment
CVE-2026-98552	await	—	Linux	Linux	—	perf/core: Fix a refcount leak in attach_perf_ctx_data()
CVE-2026-98553	await	—	Linux	Linux	—	autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
CVE-2026-98554	await	—	Linux	Linux	—	vlan: ensure sufficient headroom in vlan_dev_hard_header()
CVE-2026-98555	await	—	Linux	Linux	—	llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
CVE-2026-98556	await	—	Linux	Linux	—	gve: DQO: reject TSO packets with an out of range MSS
CVE-2026-98557	await	—	Linux	Linux	—	gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
CVE-2026-98558	await	—	Linux	Linux	—	net: flush skb_defer_nodes in dev_cpu_dead()
CVE-2026-98559	await	—	Linux	Linux	—	net/smc: fix UAF on lgr list traversal in smcr_port_err()
CVE-2026-98560	await	—	Linux	Linux	—	net/rds: size a connection's path set by the transport it ends up with
CVE-2026-98561	await	—	Linux	Linux	—	nfp: hold IPsec RX state under the XArray lock
CVE-2026-98562	await	—	Linux	Linux	—	net: libwx: fix races in Tx timestamp handling
CVE-2026-98563	await	—	Linux	Linux	—	net: phylink: record the PHY only once bringup cannot fail
CVE-2026-98564	await	—	Linux	Linux	—	net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
CVE-2026-98565	await	—	Linux	Linux	—	net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
CVE-2026-98566	await	—	Linux	Linux	—	drm/imagination: clamp freelist reconstruction requests
CVE-2026-98567	await	—	Linux	Linux	—	net: xps: reject an out of range traffic class
CVE-2026-98568	await	—	Linux	Linux	—	vxlan: use one headroom snapshot for neighbour replies
CVE-2026-98569	await	—	Linux	Linux	—	ip_gre: Reject enabling collect metadata through changelink
CVE-2026-98570	await	—	Linux	Linux	—	net: ipv6: keep room for the mac header in dst_dev_overhead()
CVE-2026-98571	await	—	Linux	Linux	—	net: stmmac: clear stale buf->page after recycling on skb build failure
CVE-2026-98572	await	—	Linux	Linux	—	bpf: Fix immediate JMP JEQ/JNE on MIPS32
CVE-2026-98573	await	—	Linux	Linux	—	net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
CVE-2026-98574	await	—	Linux	Linux	—	net: bcmgenet: stop Tx NAPI before disabling the queues
CVE-2026-98575	await	—	Linux	Linux	—	nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
CVE-2026-98576	await	—	Linux	Linux	—	nfc: llcp: fix slab-out-of-bounds reads when logging service names
CVE-2026-98577	await	—	Linux	Linux	—	nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
CVE-2026-98578	await	—	Linux	Linux	—	nfc: st21nfca: validate ISO15693 inventory length
CVE-2026-98579	await	—	Linux	Linux	—	nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
CVE-2026-98580	await	—	Linux	Linux	—	nfc: llcp: Fix race condition in accept_queue lifecycle
CVE-2026-98581	await	—	Linux	Linux	—	nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
CVE-2026-98582	await	—	Linux	Linux	—	nfc: st21nfca: validate received frame size
CVE-2026-98583	await	—	Linux	Linux	—	nfc: nfcmrvl: validate helper command length before pull
CVE-2026-98584	await	—	Linux	Linux	—	net/sched: fix potential stack infoleak in em_text_dump()
CVE-2026-98585	await	—	Linux	Linux	—	eth: fbnic: Avoid rounding zero ring sizes
CVE-2026-98586	await	—	Linux	Linux	—	sctp: hold asoc or transport before mod_timer() in timer handlers
CVE-2026-98587	await	—	Linux	Linux	—	firewire: cdev: fix back-transition for iso_resource_auto client resource
CVE-2026-98588	await	—	Linux	Linux	—	bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
CVE-2026-98589	await	—	Linux	Linux	—	bpf: Reject pkt arguments in mutating subprogs
CVE-2026-98590	await	—	Linux	Linux	—	bpf: Fix bpf_sock context code generation
CVE-2026-98591	await	—	Linux	Linux	—	bpf: Fix bounds check for skb-backed dynptrs
CVE-2026-98592	await	—	Linux	Linux	—	net: spacemit: clear TX descriptor on fragment mapping failure
CVE-2026-98593	await	—	Linux	Linux	—	s390/debug: Fix NULL pointer dereference in debug_info_copy()
CVE-2026-98594	await	—	Linux	Linux	—	tg3: clean up PHYLIB resources on probe failure
CVE-2026-98595	await	—	Linux	Linux	—	udp: remove a disconnected socket from the 4-tuple hash table
CVE-2026-98596	await	—	Linux	Linux	—	ipv6: Fix dst leak for uncached routes.
CVE-2026-98597	await	—	Linux	Linux	—	net: usb: sr9700: include receive overhead in the length check
CVE-2026-98598	await	—	Linux	Linux	—	ipv6: Prevent rt6_insert_exception() for dying fib6_info.
CVE-2026-98599	await	—	Linux	Linux	—	bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
CVE-2026-98600	await	—	Linux	Linux	—	Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
CVE-2026-98601	await	—	Linux	Linux	—	Bluetooth: btintel_pcie: validate device-supplied DMA indices
CVE-2026-98602	await	—	Linux	Linux	—	Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fa…
CVE-2026-98603	await	—	Linux	Linux	—	ovpn: replace bind when clearing stale local source
CVE-2026-98604	await	—	Linux	Linux	—	ovpn: replace bind when learning local endpoint
CVE-2026-98605	await	—	Linux	Linux	—	drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
CVE-2026-98606	await	—	Linux	Linux	—	drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
CVE-2026-98607	await	—	Linux	Linux	—	drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
CVE-2026-98608	await	—	Linux	Linux	—	drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
CVE-2026-98609	await	—	Linux	Linux	—	drm/virtio: fix object leak when drm_gem_handle_create() fails
CVE-2026-98610	await	—	Linux	Linux	—	net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
CVE-2026-98611	await	—	Linux	Linux	—	bpf: Check params size before reading reserved fields
CVE-2026-98612	await	—	Linux	Linux	—	net: usb: catc: bound the RX packet length in catc_rx_done()
CVE-2026-98613	await	—	Linux	Linux	—	bpf: Bound ownership depth through local kptrs and graph roots
CVE-2026-98614	await	—	Linux	Linux	—	sctp: avoid livelock while updating retransmit path
CVE-2026-98615	await	—	Linux	Linux	—	eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
CVE-2026-98616	await	—	Linux	Linux	—	eth: fbnic: reset num_napi when the napi vectors are freed
CVE-2026-98617	await	—	Linux	Linux	—	eth: fbnic: use the Rx queue napi pointer to find the napi vector
CVE-2026-98618	await	—	Linux	Linux	—	eth: fbnic: Handle maximum standalone channels
CVE-2026-98619	await	—	Linux	Linux	—	net: ethtool: keep rtnl_lock for the ioctl self test
CVE-2026-98620	await	—	Linux	Linux	—	net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
CVE-2026-98621	await	—	Linux	Linux	—	net: gue: reject invalid REMCSUM offsets
CVE-2026-98622	await	—	Linux	Linux	—	net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
CVE-2026-98623	await	—	Linux	Linux	—	drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
CVE-2026-98624	await	—	Linux	Linux	—	netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
CVE-2026-98625	await	—	Linux	Linux	—	netfilter: flowtable: publish HW_DEAD after worker is done
CVE-2026-98626	await	—	Linux	Linux	—	bpf: Restrict CO-RE poisoning to relocatable instructions
CVE-2026-98627	await	—	Linux	Linux	—	bpf: Preserve packet pointer class displacement in regsafe()
CVE-2026-98628	await	—	Linux	Linux	—	bpf: Make post-verification instruction rewrites killable
CVE-2026-98629	await	—	Linux	Linux	—	net/sched: cls_u32: fix manual hash table handle IDR aliasing
CVE-2026-98630	await	—	Linux	Linux	—	eth: fbnic: Fix payload page pool error cleanup
CVE-2026-98631	await	—	Linux	Linux	—	xsk: Use a 32-bit compare in xsk_map_gen_lookup
CVE-2026-98632	await	—	Linux	Linux	—	Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
CVE-2026-98633	await	—	Linux	Linux	—	Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
CVE-2026-98634	await	—	Linux	Linux	—	scsi: sd_zbc: Reject disks with too many zones
CVE-2026-98635	await	—	Linux	Linux	—	scsi: block: Fix zones_cond out-of-bounds write on zone report
CVE-2026-98636	await	—	Linux	Linux	—	squashfs: Add dictionary size range check to prevent shift-out-of-bounds
CVE-2026-98637	await	—	Linux	Linux	—	KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
CVE-2026-98638	await	—	Linux	Linux	—	KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
CVE-2026-98639	await	—	Linux	Linux	—	KVM: riscv: Fix NACL hfence entry update order
CVE-2026-98640	await	—	Linux	Linux	—	HID: amd_sfh: Validate PCI BAR size before mapping
CVE-2026-98641	await	—	Linux	Linux	—	bpf, arm64: set up the frame pointer for the exception callback
CVE-2026-98642	await	—	Linux	Linux	—	bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
CVE-2026-98643	await	—	Linux	Linux	—	bpf: Fix out-of-bounds read of rtt_min in sock_ops
CVE-2026-98644	await	—	Linux	Linux	—	bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
CVE-2026-98645	await	—	Linux	Linux	—	HID: winwing: fix use-after-free in force feedback teardown
CVE-2026-98646	await	—	Linux	Linux	—	tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
CVE-2026-98647	await	—	Linux	Linux	—	bpf: Fix divide-by-zero in btf_struct_walk()
CVE-2026-98648	await	—	Linux	Linux	—	s390/uv: Prevent potential out-of-bounds read
CVE-2026-98649	await	—	Linux	Linux	—	KVM: s390: Fix race in _destroy_pages_crste()
CVE-2026-98650	await	—	Linux	Linux	—	KVM: s390: Fix potential races in dat skey functions
CVE-2026-98651	await	—	Linux	Linux	—	KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()
CVE-2026-98652	await	—	Linux	Linux	—	KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
CVE-2026-98653	await	—	Linux	Linux	—	KVM: s390: Fix _gaccess_shadow_fault()
CVE-2026-98654	await	—	Linux	Linux	—	drm/amd/display: Atomize IRQ register read/modify/write ops
CVE-2026-98655	await	—	Linux	Linux	—	perf: Require kernel access for text poke events
CVE-2026-98656	await	—	Linux	Linux	—	iio: trigger: cancel reenable_work before freeing trigger
CVE-2026-98657	await	—	Linux	Linux	—	iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
CVE-2026-98658	await	—	Linux	Linux	—	iio: proximity: aw96103: validate firmware data length
CVE-2026-98659	await	—	Linux	Linux	—	iio: pressure: rohm-bm1390: Return error when read fails
CVE-2026-98660	await	—	Linux	Linux	—	iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
CVE-2026-98661	await	—	Linux	Linux	—	iio: light: rohm-bu27034: Fix infinite delay on error
CVE-2026-98662	await	—	Linux	Linux	—	iio: light: gp2ap020a00f: drain irq_work after free_irq
CVE-2026-98663	await	—	Linux	Linux	—	iio: imu: adis16480: fix unprotected debugfs reads
CVE-2026-98664	await	—	Linux	Linux	—	iio: imu: adis16400: fix unprotected debugfs reads
CVE-2026-98665	await	—	Linux	Linux	—	iio: health: max30102: fix NULL dereference in interrupt handler
CVE-2026-98666	await	—	Linux	Linux	—	iio: gyro: adis16136: fix unprotected debugfs reads
CVE-2026-98667	await	—	Linux	Linux	—	iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data
CVE-2026-98668	await	—	Linux	Linux	—	iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
CVE-2026-98669	await	—	Linux	Linux	—	iio: buffer: serialize buffer teardown with mode claims
CVE-2026-98670	await	—	Linux	Linux	—	iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
CVE-2026-98671	await	—	Linux	Linux	—	iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
CVE-2026-98672	await	—	Linux	Linux	—	iio: adc: stm32-adc: fix possible division by zero in processed channel
CVE-2026-98673	await	—	Linux	Linux	—	iio: adc: pac1934: check ACPI label duplication
CVE-2026-98674	await	—	Linux	Linux	—	iio: adc: adi-axi-adc: Initialize state mutex
CVE-2026-98675	await	—	Linux	Linux	—	iio: adc: ade9000: handle Phase C dip events in IRQ1 handler
CVE-2026-98676	await	—	Linux	Linux	—	iio: adc: ade9000: fix NULL pointer dereference in clkout registration
CVE-2026-98677	await	—	Linux	Linux	—	iio: adc: ad_sigma_delta: fix use-after-free on unbind
CVE-2026-98678	await	—	Linux	Linux	—	iio: adc: ad4030: fix invalid oversampling_ratio validation
CVE-2026-98679	await	—	Linux	Linux	—	iio: accel: kxcjk-1013: reject duplicate event disable
CVE-2026-98680	await	—	Linux	Linux	—	iio: accel: kionix-kx022a: Prevent memory leak and fix state
CVE-2026-98681	await	—	Linux	Linux	—	smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
CVE-2026-98682	await	—	Linux	Linux	—	smb: client: drain and invalidate before server-side copy/clone
CVE-2026-98683	await	—	Linux	Linux	—	smb: client: flush dirty data before zeroing a range
CVE-2026-98684	await	—	Linux	Linux	—	smb: client: flush and commit data before querying allocated ranges
CVE-2026-98685	await	—	Linux	Linux	—	smb: client: discard post-EOF pagecache when extending a file via clone range
CVE-2026-98686	await	—	Linux	Linux	—	smb: client: discard post-EOF pagecache when extending a file via zero range
CVE-2026-98687	await	—	Linux	Linux	—	thunderbolt: Reject oversized XDomain properties responses
CVE-2026-98688	await	—	Linux	Linux	—	thunderbolt: Fix NULL dereference in tb_remove_work()
CVE-2026-98689	await	—	Linux	Linux	—	thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
CVE-2026-98690	await	—	Linux	Linux	—	thunderbolt: Fix domain reference leak when DPRX read is canceled
CVE-2026-98691	await	—	Linux	Linux	—	thunderbolt: Tear down inactive DP tunnels when the domain is stopped
CVE-2026-98692	await	—	Linux	Linux	—	thunderbolt: Make the DP tunnel activation callback mandatory
CVE-2026-98693	await	—	Linux	Linux	—	thunderbolt: Hold a router reference for each allocated HopID
CVE-2026-98694	await	—	Linux	Linux	—	thunderbolt: Fix KASAN reported use-after-free when request is canceled
CVE-2026-98695	await	—	Linux	Linux	—	USB: serial: fix ioctl hangup race
CVE-2026-98696	await	—	Linux	Linux	—	USB: serial: fix driver deregistration order
CVE-2026-98697	await	—	Linux	Linux	—	USB: serial: fix dynamic id driver deregistration race
CVE-2026-98698	await	—	Linux	Linux	—	wifi: mac80211: handle empty FILS association request payload
CVE-2026-98699	await	—	Linux	Linux	—	wifi: mac80211: fix mesh fast xmit path deletion UAF
CVE-2026-98700	await	—	Linux	Linux	—	wifi: mac80211: set info->band for 802.3 encap offload frames
CVE-2026-98701	await	—	Linux	Linux	—	wifi: mac80211: release mesh path quota on failed additions
CVE-2026-98702	await	—	Linux	Linux	—	wifi: mac80211: reject invalid 320 MHz CSA bandwidth
CVE-2026-98703	await	—	Linux	Linux	—	wifi: mac80211: minstrel_ht: validate fixed rate index
CVE-2026-98704	await	—	Linux	Linux	—	wifi: mac80211: keep fallback association elements alive
CVE-2026-98705	await	—	Linux	Linux	—	wifi: mac80211: account proxy paths against the mesh path limit
CVE-2026-98706	await	—	Linux	Linux	—	wifi: mac80211: drain PS delivery work during station teardown
CVE-2026-98707	await	—	Linux	Linux	—	wifi: mac80211: shut down RX BA session timer on teardown
CVE-2026-98708	await	—	Linux	Linux	—	wifi: mac80211: keep paired old chanctx alive
CVE-2026-98709	await	—	Linux	Linux	—	wifi: mac80211: count only matching reservations in reserved switch
CVE-2026-98710	await	—	Linux	Linux	—	wifi: iwlegacy: 3945: free EEPROM data on remove
CVE-2026-98711	await	—	Linux	Linux	—	wifi: cw1200: fix TX padding OOB read leaking heap data to device
CVE-2026-98712	await	—	Linux	Linux	—	KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
CVE-2026-98713	await	—	Linux	Linux	—	KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
CVE-2026-98714	await	—	Linux	Linux	—	KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded
CVE-2026-98715	await	—	Linux	Linux	—	KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
CVE-2026-98716	await	—	Linux	Linux	—	KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
CVE-2026-98717	await	—	Linux	Linux	—	KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
CVE-2026-98718	await	—	Linux	Linux	—	KVM: SEV: Do cache maintenance on the source VM before clearing SEV state
CVE-2026-98719	await	—	Linux	Linux	—	KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
CVE-2026-98720	await	—	Linux	Linux	—	KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
CVE-2026-98721	await	—	Linux	Linux	—	mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
CVE-2026-98722	await	—	Linux	Linux	—	mtd: block2mtd: Fix divide error when erase_size is zero
CVE-2026-98723	await	—	Linux	Linux	—	nvmet: copy the hostid into the ctrl before creating PR pc_refs
CVE-2026-98724	await	—	Linux	Linux	—	nvmet: pci-epf: reject too-short SGL segments
CVE-2026-98725	await	—	Linux	Linux	—	nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
CVE-2026-98726	await	—	Linux	Linux	—	nvme-multipath: fix underflow in ANA log bounds checks

Results continue: ranks 401–552.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-10-18 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.