CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-20 02:30 UTC )
This week: 5,214 CVEs published, 334 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,214 Show in the list Critical, last 7 days 334 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,748 Show in the list Showing CVEs that name the product linux:linux . Show all products
CVE Severity Title Published CVE-2026-97548 High 7.8 xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions Assigned by Linux
Sep 25, 2026 CVE-2026-97547 Not yet scored xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN Assigned by Linux
Sep 25, 2026 CVE-2026-97546 Not yet scored xfs: don't spin forever on zero-length dirents when salvaging them Assigned by Linux
Sep 25, 2026 CVE-2026-97545 Not yet scored xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails Assigned by Linux
Sep 25, 2026 CVE-2026-97544 Not yet scored xfs: don't leak dqacct if rhashtable insertion fails Assigned by Linux
Sep 25, 2026 CVE-2026-97543 Not yet scored xfs: destroy seen inode bitmap when we fail to add a dirpath Assigned by Linux
Sep 25, 2026 CVE-2026-97542 Not yet scored xfs: bail out on bitmap errors in xrep_agfl_fill Assigned by Linux
Sep 25, 2026 CVE-2026-97541 Not yet scored wifi: ath9k_htc: don't store usb_device_id Assigned by Linux
Sep 25, 2026 CVE-2026-97540 Not yet scored net: usb: pegasus: don't rely on id table pointer arithmetic Assigned by Linux
Sep 25, 2026 CVE-2026-97539 Not yet scored usb: xusbatm: don't rely on id table pointer arithmetic Assigned by Linux
Sep 25, 2026 CVE-2026-97538 Not yet scored hwmon: (asus_rog_ryujin) Validate HID report lengths Assigned by Linux
Sep 25, 2026 CVE-2026-97537 Not yet scored scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking Assigned by Linux
Sep 25, 2026 CVE-2026-97536 High 7.5 scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown Assigned by Linux
Sep 25, 2026 CVE-2026-97535 Not yet scored scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size Assigned by Linux
Sep 25, 2026 CVE-2026-97534 Not yet scored f2fs: accurately adjust free_sections during free_segment_range Assigned by Linux
Sep 25, 2026 CVE-2026-97533 Not yet scored x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF Assigned by Linux
Sep 25, 2026 CVE-2026-97532 Not yet scored scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path Assigned by Linux
Sep 25, 2026 CVE-2026-97531 High 7.5 scsi: qla2xxx: Skip vport under deletion in report ID acquisition Assigned by Linux
Sep 25, 2026 CVE-2026-97530 Not yet scored scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature Assigned by Linux
Sep 25, 2026 CVE-2026-97529 Not yet scored scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] Assigned by Linux
Sep 25, 2026 CVE-2026-97528 High 8.8 scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error Assigned by Linux
Sep 25, 2026 CVE-2026-97527 High 8.8 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock Assigned by Linux
Sep 25, 2026 CVE-2026-97526 Not yet scored s390/pai: Support CPU hotplug for PMU PAI Assigned by Linux
Sep 25, 2026 CVE-2026-97525 High 8.2 x86/mm/pat: Allocate split page tables as kernel page tables Assigned by Linux
Sep 25, 2026 CVE-2026-97524 High 7.5 mptcp: avoid unneeded actions on subflow reset Assigned by Linux
Sep 25, 2026 CVE-2026-97523 High 7.5 mptcp: close race between scheduler and state change Assigned by Linux
Sep 25, 2026 CVE-2026-97522 Not yet scored mptcp: fix bad accounting in __mptcp_subflow_push_pending() Assigned by Linux
Sep 25, 2026 CVE-2026-97521 Not yet scored gfs2: fix quota init duplicate scan Assigned by Linux
Sep 24, 2026 CVE-2026-97520 High 7.1 gfs2: move quota_init qc iterator increment Assigned by Linux
Sep 24, 2026 CVE-2026-97519 Not yet scored drm/xe: Fix null pointer dereference in devcoredump cleanup Assigned by Linux
Sep 24, 2026 CVE-2026-97518 Not yet scored wifi: cfg80211: reject duplicate wiphy cipher suite entries Assigned by Linux
Sep 24, 2026 CVE-2026-97517 Not yet scored wifi: nl80211: reject beacons with bad HE operation Assigned by Linux
Sep 24, 2026 CVE-2026-97516 Not yet scored wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() Assigned by Linux
Sep 24, 2026 CVE-2026-97515 Not yet scored i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 Assigned by Linux
Sep 24, 2026 CVE-2026-97514 Not yet scored media: chips-media: wave5: Fix Reports from Kernel Lock Validator Assigned by Linux
Sep 24, 2026 CVE-2026-97513 High 7.8 media: chips-media: wave5: Release m2m_ctx after Instance Removed from List Assigned by Linux
Sep 24, 2026 CVE-2026-97512 Not yet scored spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM Assigned by Linux
Sep 24, 2026 CVE-2026-97511 Not yet scored wifi: mac80211: avoid out-of-bounds access in monitor Assigned by Linux
Sep 24, 2026 CVE-2026-97510 Not yet scored thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() Assigned by Linux
Sep 24, 2026 CVE-2026-97509 High 8.8 thunderbolt: Keep XDomain reference during the lifetime of a service Assigned by Linux
Sep 24, 2026 CVE-2026-97508 High 7.5 thunderbolt: Set tb->root_switch to NULL when domain is stopped Assigned by Linux
Sep 24, 2026 CVE-2026-97507 Not yet scored media: dm1105: fix missing error check for dma_alloc_coherent Assigned by Linux
Sep 24, 2026 CVE-2026-97506 Not yet scored crypto: ixp4xx - fix buffer chain unwind on allocation failure Assigned by Linux
Sep 24, 2026 CVE-2026-97505 Not yet scored PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() Assigned by Linux
Sep 24, 2026 CVE-2026-97504 Not yet scored watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk Assigned by Linux
Sep 24, 2026 CVE-2026-97503 Not yet scored genirq/proc: Size interrupt directory names for 10-digit interrupt numbers Assigned by Linux
Sep 24, 2026 CVE-2026-97502 Not yet scored mmc: davinci: avoid NULL deref of host->data in IRQ handler Assigned by Linux
Sep 24, 2026 CVE-2026-97501 Not yet scored pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction Assigned by Linux
Sep 24, 2026 CVE-2026-97500 Not yet scored wifi: rtw89: phy: check length before parsing PHY status IE Assigned by Linux
Sep 24, 2026 CVE-2026-97499 Not yet scored coresight: perf: Retrieve path and source from event data Assigned by Linux
Sep 24, 2026
Previous Page 22 of 149 Next CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
