CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-20 12:30 UTC )
This week: 5,118 CVEs published, 325 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,118 Show in the list Critical, last 7 days 325 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,748 Show in the list Showing CVEs that name the product linux:linux . Show all products
CVE Severity Title Published CVE-2026-90261 Not yet scored btrfs: zoned: flush active metadata block group at btree_writepages() start Assigned by Linux
Sep 17, 2026 CVE-2026-90260 High 7.1 btrfs: zoned: don't clobber the extent buffer when zeroing it out Assigned by Linux
Sep 17, 2026 CVE-2026-90259 Not yet scored btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() Assigned by Linux
Sep 17, 2026 CVE-2026-90258 Not yet scored pinctrl: airoha: add missed IRQ resource helpers Assigned by Linux
Sep 17, 2026 CVE-2026-90257 Not yet scored Bluetooth: virtio_bt: avoid OOB read of build info string Assigned by Linux
Sep 17, 2026 CVE-2026-90256 High 8.8 Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind Assigned by Linux
Sep 17, 2026 CVE-2026-90255 High 8.8 Bluetooth: hci_conn: fix the SCO setup context lifetime Assigned by Linux
Sep 17, 2026 CVE-2026-90254 Not yet scored Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths Assigned by Linux
Sep 17, 2026 CVE-2026-90253 Not yet scored Bluetooth: MGMT: free the mesh send cancel command when it is cancelled Assigned by Linux
Sep 17, 2026 CVE-2026-90252 Not yet scored Bluetooth: MGMT: free the HCI command when it is cancelled Assigned by Linux
Sep 17, 2026 CVE-2026-90251 Not yet scored Bluetooth: MSFT: validate evt_prefix_len against the response length Assigned by Linux
Sep 17, 2026 CVE-2026-90250 Not yet scored bpf, cgroup: Fix storage null-ptr-deref after replacing prog Assigned by Linux
Sep 17, 2026 CVE-2026-90249 Not yet scored iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes Assigned by Linux
Sep 17, 2026 CVE-2026-90248 Not yet scored net/sched: cls_api: fix teardown of an adopted proto on insert-race loss Assigned by Linux
Sep 17, 2026 CVE-2026-90247 Not yet scored bpf: Fix mmap_lock leak in irq_work path Assigned by Linux
Sep 17, 2026 CVE-2026-90246 High 7.1 apparmor: fix integer overflow in verify_tags() bounds check Assigned by Linux
Sep 17, 2026 CVE-2026-90245 Not yet scored fbdev: kyro: Validate overlay viewport coordinates Assigned by Linux
Sep 17, 2026 CVE-2026-90244 High 7.8 iommu/dma: Restore locking around msi_page_list Assigned by Linux
Sep 17, 2026 CVE-2026-90243 High 8.1 iommu/vt-d: Clear Present bit before tearing down copied context entry Assigned by Linux
Sep 17, 2026 CVE-2026-90242 Not yet scored iommu/vt-d: Fix iopf_refcount leak on RID domain replacement Assigned by Linux
Sep 17, 2026 CVE-2026-90241 High 8.2 iommu/vt-d: Tear down scalable-mode context on probe failure Assigned by Linux
Sep 17, 2026 CVE-2026-90240 High 8.8 iommu/vt-d: Flush context cache with correct SID when tearing down aliases Assigned by Linux
Sep 17, 2026 CVE-2026-90239 Not yet scored media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() Assigned by Linux
Sep 17, 2026 CVE-2026-90238 Not yet scored media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path Assigned by Linux
Sep 17, 2026 CVE-2026-90237 High 7.8 netfilter: nft_ct: move custom expectation support to helper Assigned by Linux
Sep 17, 2026 CVE-2026-90236 Not yet scored NFSD: Release the export reference when reaping open stateids Assigned by Linux
Sep 17, 2026 CVE-2026-90235 Critical 9.8 sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE Assigned by Linux
Sep 17, 2026 CVE-2026-90234 High 7.5 NFS: Return a delegation the client fails to record Assigned by Linux
Sep 17, 2026 CVE-2026-90233 Not yet scored nvme-pci: release descriptor pools on probe failure Assigned by Linux
Sep 17, 2026 CVE-2026-90232 Not yet scored amt: Don't support cross-netns setup. Assigned by Linux
Sep 17, 2026 CVE-2026-90231 High 8.4 apparmor: fix unconfined user namespace restriction forced stack Assigned by Linux
Sep 17, 2026 CVE-2026-90230 Critical 9.1 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() Assigned by Linux
Sep 17, 2026 CVE-2026-90229 High 7.4 nvme-apple: Destroy the admin queue on removal Assigned by Linux
Sep 17, 2026 CVE-2026-90228 High 7.5 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() Assigned by Linux
Sep 17, 2026 CVE-2026-90227 High 7.8 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Assigned by Linux
Sep 17, 2026 CVE-2026-90226 Not yet scored nfc: llcp: avoid userspace overflow on invalid optlen Assigned by Linux
Sep 17, 2026 CVE-2026-90225 High 7.8 nfc: llcp: read llcp_sock->local under the socket lock in getsockopt Assigned by Linux
Sep 17, 2026 CVE-2026-90224 High 7.5 nfc: nci: fix double completion race in nci_data_exchange_complete Assigned by Linux
Sep 17, 2026 CVE-2026-90223 High 7.1 nfc: llcp: bound SNL TLV parsing to the skb and add length checks Assigned by Linux
Sep 17, 2026 CVE-2026-90222 Not yet scored nfc: pn533: hold a reference to the request skb during send_frame Assigned by Linux
Sep 17, 2026 CVE-2026-90221 Not yet scored nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing Assigned by Linux
Sep 17, 2026 CVE-2026-90220 Not yet scored ALSA: seq: Don't leak the extension cell pointer in the bounce payload Assigned by Linux
Sep 17, 2026 CVE-2026-90219 Not yet scored RDMA/cxgb4: Free debugfs on registration failure Assigned by Linux
Sep 17, 2026 CVE-2026-90218 Not yet scored RDMA/cma: Fix WARNING in res_to_rt Assigned by Linux
Sep 17, 2026 CVE-2026-90217 High 7.8 bpf: Compare iterator types during state pruning Assigned by Linux
Sep 17, 2026 CVE-2026-90216 Not yet scored ubi: Fix rollback for explicit UBI device numbers Assigned by Linux
Sep 17, 2026 CVE-2026-90215 Not yet scored mtd: ubi: Release device reference on busy detach Assigned by Linux
Sep 17, 2026 CVE-2026-90214 Not yet scored ASoC: xilinx: formatter_pcm: fix stream_data leak on open error Assigned by Linux
Sep 17, 2026 CVE-2026-90213 Not yet scored firewire: core: fix memory leak in error path of build_tree() Assigned by Linux
Sep 17, 2026 CVE-2026-90212 Not yet scored arm64/efi: Avoid voluntary preemption with efi_mm installed Assigned by Linux
Sep 17, 2026
Previous Page 35 of 150 Next CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
