{
  "day": "2026-08-15",
  "boundary": "UTC calendar day",
  "published_count": 925,
  "by_severity": {
    "CRITICAL": 149,
    "HIGH": 403,
    "MEDIUM": 26,
    "LOW": 11
  },
  "kev_count": 0,
  "exploit_reference_count": 16,
  "awaiting_enrichment_count": 336,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-19900",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.01793,
      "epss_percentile": 0.76633,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LB-LINK",
      "product": "X-PRO",
      "cwe": "CWE-798",
      "title": "LB-LINK X-PRO shadow hard-coded credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19900"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-18855",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01206,
      "epss_percentile": 0.65868,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jackdewey",
      "product": "Link Library",
      "cwe": "CWE-22",
      "title": "Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18855"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-18438",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00983,
      "epss_percentile": 0.59526,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpdevteam",
      "product": "Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!",
      "cwe": "CWE-434",
      "title": "Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18438"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-15826",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00805,
      "epss_percentile": 0.53931,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cozmoslabs",
      "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor",
      "cwe": "CWE-704",
      "title": "User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15826"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-14484",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00762,
      "epss_percentile": 0.52537,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pietror91",
      "product": "RapiSafe – Secure Multi File Upload for Contact Form 7",
      "cwe": "CWE-22",
      "title": "RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14484"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-72319",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00755,
      "epss_percentile": 0.5228,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipvs: ensure inner headers in ICMP errors are in headroom",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72319"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-72339",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00755,
      "epss_percentile": 0.52279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "qede: fix off-by-one in BD ring consumption on build_skb failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72339"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-72351",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00755,
      "epss_percentile": 0.52279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gue: validate REMCSUM private option length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72351"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-72194",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00744,
      "epss_percentile": 0.5191,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72194"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-72033",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00739,
      "epss_percentile": 0.51753,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "orangefs: keep the readdir entry size 64-bit in fill_from_part()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72033"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-72192",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00738,
      "epss_percentile": 0.51706,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72192"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-72083",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00734,
      "epss_percentile": 0.51583,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72083"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-72322",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00734,
      "epss_percentile": 0.51583,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: mcast: Fix potential UAF in MLD delayed work",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72322"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-72491",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00734,
      "epss_percentile": 0.51582,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/9p: fix race condition on rdma->state in trans_rdma.c",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72491"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-73634",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0073,
      "epss_percentile": 0.51427,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Struts",
      "cwe": "CWE-400",
      "title": "Apache Struts: Unbounded read of a Content Security Policy violation report",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73634"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-72084",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00728,
      "epss_percentile": 0.51366,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: target: Bound PR-OUT TransportID parsing to the received buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72084"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-72130",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00728,
      "epss_percentile": 0.51356,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvmet-auth: reject short AUTH_RECEIVE buffers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72130"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-72466",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00728,
      "epss_percentile": 0.51366,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xprtrdma: Fix bcall rep leak and unbounded peek",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72466"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-72374",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00716,
      "epss_percentile": 0.50939,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix callback service message parsers to pass through -EAGAIN",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72374"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-72378",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00716,
      "epss_percentile": 0.5094,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix error code in afs_extract_vl_addrs()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72378"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-72418",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00716,
      "epss_percentile": 0.50939,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_conncount: prevent connlimit drops for early confirmed ct",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72418"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-72436",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00712,
      "epss_percentile": 0.50774,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72436"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-74280",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.50487,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "crypto: marvell/octeontx - fix DMA cleanup using wrong loop index",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74280"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-68477",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.50488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipvs: fix more places with wrong ipv6 transport offsets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68477"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-72020",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.50489,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipvs: reset full ip_vs_seq structs in ip_vs_conn_new",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72020"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-72129",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.50488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvmet-rdma: handle inline data with a nonzero offset",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72129"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-72226",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.50486,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tt: prevent TVLV OOB check overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72226"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-72251",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.50487,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_nat_sip: reload possible stale data pointer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72251"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-72398",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.505,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: add INIT verification after cookie unpacking",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72398"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-74267",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.50488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74267"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-72296",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00704,
      "epss_percentile": 0.50487,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ife: require ETH_HLEN to be pullable in ife_decode()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72296"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-73635",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00698,
      "epss_percentile": 0.50254,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Struts",
      "cwe": "CWE-770",
      "title": "Apache Struts: Unbounded growth of localized-text caches driven by the request locale",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73635"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-72231",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00686,
      "epss_percentile": 0.49842,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: tt: avoid request storms during pending request",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72231"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-72247",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00686,
      "epss_percentile": 0.49843,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_conncount: fix zone comparison in tuple dedup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72247"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-72409",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00686,
      "epss_percentile": 0.49843,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mvneta: re-enable percpu interrupt on resume",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72409"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-72502",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00686,
      "epss_percentile": 0.49842,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72502"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-74282",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00686,
      "epss_percentile": 0.49843,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: prevent snt_unacked underflow on CONN_ACK",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74282"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-72234",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00684,
      "epss_percentile": 0.49756,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: access unicast_ttvn skb->data only after skb realloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72234"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-72464",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00675,
      "epss_percentile": 0.49424,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xprtrdma: Repost Receive buffers for malformed replies",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72464"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-72014",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00674,
      "epss_percentile": 0.49366,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drbd: reject data replies with an out-of-range payload size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72014"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-72399",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00672,
      "epss_percentile": 0.49269,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: enetc: check the number of BDs needed for xdp_frame",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72399"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-72451",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00671,
      "epss_percentile": 0.4924,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: Fix xfrm state cache insertion race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72451"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-74281",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0067,
      "epss_percentile": 0.49199,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: reject inverted service ranges from peer bindings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74281"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-72422",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00668,
      "epss_percentile": 0.49127,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72422"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-72473",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00664,
      "epss_percentile": 0.48956,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xprtrdma: Decouple req recycling from RPC completion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72473"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-72065",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00663,
      "epss_percentile": 0.48932,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mana: Validate the packet length reported by the NIC",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72065"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-72069",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00663,
      "epss_percentile": 0.48933,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72069"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-72299",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00663,
      "epss_percentile": 0.48932,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: restrict socket queue dumps in enqueue tracepoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72299"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-72149",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00655,
      "epss_percentile": 0.48614,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dmaengine: tegra: Fix burst size calculation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72149"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-72465",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00655,
      "epss_percentile": 0.48614,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xprtrdma: Sanitize the reply credit grant after parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72465"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-72317",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00652,
      "epss_percentile": 0.48503,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "SUNRPC: pin upper rpc_clnt across the TLS connect_worker",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72317"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-72381",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00652,
      "epss_percentile": 0.48503,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: fix use-after-free of fp->owner.name in durable handle owner check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72381"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-72098",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00646,
      "epss_percentile": 0.48215,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-verity: fix buffer overflow in FEC calculation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72098"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-72323",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00644,
      "epss_percentile": 0.48124,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72323"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-72472",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00644,
      "epss_percentile": 0.48124,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfs: use nfsi->rwsem to protect traversal of the file lock list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72472"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-72310",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00642,
      "epss_percentile": 0.48037,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: fix overflow in passthrough ioctl bounds check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72310"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-72366",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00641,
      "epss_percentile": 0.47965,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix netfs_create_write_req() to handle async cache object creation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72366"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-72107",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00632,
      "epss_percentile": 0.47596,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm era: fix out-of-bounds memory access for non-zero start sector",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72107"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-72160",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00632,
      "epss_percentile": 0.47596,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: reject dinodes with non-canonical i_mode type",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72160"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-72330",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47467,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/tls: Consume empty data records in tls_sw_read_sock()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72330"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-72356",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47467,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cifs: Fix missing credit release on failure in cifs_issue_read()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72356"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-68476",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00626,
      "epss_percentile": 0.4731,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipvs: reload ip header after head reallocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68476"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-72041",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00626,
      "epss_percentile": 0.47311,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "espintcp: use sk_msg_free_partial to fix partial send",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72041"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-72046",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00626,
      "epss_percentile": 0.47311,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gve: fix header buffer corruption with header-split and HW-GRO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72046"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-72137",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00626,
      "epss_percentile": 0.47312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: nat_keepalive: avoid double free on send error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72137"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-72185",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00626,
      "epss_percentile": 0.473,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72185"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-72217",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00626,
      "epss_percentile": 0.47312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72217"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-72221",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00626,
      "epss_percentile": 0.47311,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sunrpc: wait for in-flight TLS handshake callback when cancel loses race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72221"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-72222",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00626,
      "epss_percentile": 0.47312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sunrpc: pin svc_xprt across the asynchronous TLS handshake callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72222"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-72348",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00625,
      "epss_percentile": 0.47274,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72348"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-72373",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00622,
      "epss_percentile": 0.47119,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix missing NULL pointer check in afs_break_some_callbacks()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72373"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-72191",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00618,
      "epss_percentile": 0.46921,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs3: validate split-point offset in indx_insert_into_buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72191"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-15689",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00608,
      "epss_percentile": 0.46438,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ABEVERLEY",
      "product": "Dancer2::Plugin::Auth::Extensible",
      "cwe": "CWE-640",
      "title": "Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15689"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-72429",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00605,
      "epss_percentile": 0.46333,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: ioam: fix type confusion of dst_entry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72429"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-74268",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00605,
      "epss_percentile": 0.46333,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tcp: clear sock_ops cb flags before force-closing a child socket",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74268"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-72200",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00598,
      "epss_percentile": 0.45996,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: detect mapping-pairs LCN accumulator overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72200"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-72242",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00595,
      "epss_percentile": 0.4585,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72242"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-72253",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00595,
      "epss_percentile": 0.45849,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_conntrack_sip: validate skb_dst() before accessing it",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72253"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-72254",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00595,
      "epss_percentile": 0.45849,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nft_fib: reject fib expression on the netdev egress hook",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72254"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-72382",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00589,
      "epss_percentile": 0.45568,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: reject undersized DACLs before parsing ACEs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72382"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-72139",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00588,
      "epss_percentile": 0.45561,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tcp: defer md5sig_info kfree past RCU grace period in tcp_connect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72139"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-72220",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00588,
      "epss_percentile": 0.45561,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sunrpc: harden rq_procinfo lifecycle to prevent double-free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72220"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-72393",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00588,
      "epss_percentile": 0.45561,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "eth: fbnic: don't cache shinfo across skb realloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72393"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-72318",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00586,
      "epss_percentile": 0.45463,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cifs: validate DFS referral string offsets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72318"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-72141",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00583,
      "epss_percentile": 0.4532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72141"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-72367",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00582,
      "epss_percentile": 0.45246,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iomap: guard io_size EOF trim against concurrent truncate underflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72367"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-15965",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0058,
      "epss_percentile": 0.45151,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sadathimel",
      "product": "MaxUpload – Big File Uploads – Increase Maximum File Upload Size",
      "cwe": "CWE-434",
      "title": "MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15965"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-72021",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.0058,
      "epss_percentile": 0.4517,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipvs: use parsed transport offset in SCTP state lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72021"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-72203",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00576,
      "epss_percentile": 0.44955,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: skip extent mft records in writeback to prevent deadlock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72203"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-72100",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0056,
      "epss_percentile": 0.44156,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-integrity: fix a bug if the bio is out of limits",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72100"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-72421",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00555,
      "epss_percentile": 0.43892,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv4: fib: Don't ignore error route in local/main tables.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72421"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-72355",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00554,
      "epss_percentile": 0.43847,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix barriering when walking subrequest list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72355"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-72064",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00553,
      "epss_percentile": 0.43818,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mana: Sync page pool RX frags for CPU",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72064"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-72417",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00553,
      "epss_percentile": 0.43818,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72417"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-72442",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00553,
      "epss_percentile": 0.43819,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: flowtable: fix and simplify IP6IP6 tunnel handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72442"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-72057",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00552,
      "epss_percentile": 0.43786,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: act_ct: preserve tc_skb_cb across defragmentation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72057"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-74394",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00547,
      "epss_percentile": 0.43474,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/srpt: fix integer overflow in immediate data length check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74394"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-72035",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00536,
      "epss_percentile": 0.42903,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72035"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-72320",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00523,
      "epss_percentile": 0.42177,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nft_lookup: fix catchall element handling with inverted lookups",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72320"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-74279",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00521,
      "epss_percentile": 0.42036,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "crypto: cavium/cpt - fix DMA cleanup using wrong loop index",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74279"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-74384",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00521,
      "epss_percentile": 0.42037,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme-multipath: fix flex array size in struct nvme_ns_head",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74384"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-74398",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00521,
      "epss_percentile": 0.42037,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74398"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-74287",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00521,
      "epss_percentile": 0.42036,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: validate embedded address parameter length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74287"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-74396",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00519,
      "epss_percentile": 0.41948,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74396"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-72407",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41738,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "geneve: validate inner network offset in geneve_gro_complete()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72407"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-72199",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41777,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: validate resident index root values on lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72199"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-72201",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41778,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: validate index entries on reading",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72201"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-72206",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41778,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: validate index block header more strictly",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72206"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-72207",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41778,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: not change 0-byte $DATA attribute to non-resident",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72207"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-72208",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41779,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: add bounds check before accessing EA entries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72208"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-72209",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41738,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: validate attribute values on lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72209"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-72210",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41778,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: fix off-by-one in mapping pairs decoding bounds checks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72210"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-72211",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41779,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: grow index root value before reparent header update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72211"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-72248",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41739,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: flowtable: support IPIP tunnel with direct xmit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72248"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-72249",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41738,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: flowtable: use dst in this direction when pushing IPIP header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72249"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-72477",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00516,
      "epss_percentile": 0.41739,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: call _ntfs_bad_inode() when failing to rename",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72477"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-73194",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00512,
      "epss_percentile": 0.41498,
      "kev": false,
      "kev_due_at": null,
      "vendor": null,
      "product": "DBI",
      "cwe": "CWE-1284",
      "title": "DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73194"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-74376",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00509,
      "epss_percentile": 0.41291,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid10: reset read_slot when reusing r10bio for discard",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74376"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-74478",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00509,
      "epss_percentile": 0.41312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "um: vector: fix use-after-free in vector_mmsg_rx()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74478"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-72353",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00508,
      "epss_percentile": 0.41246,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: avoid stale runlist element dereference in fallocate",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72353"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-72354",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00508,
      "epss_percentile": 0.41246,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: avoid stale runlist element dereference in MFT writeback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72354"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-74321",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00508,
      "epss_percentile": 0.41226,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74321"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-74255",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00506,
      "epss_percentile": 0.4114,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: fix UAF in tipc_l2_send_msg()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74255"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-74406",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00497,
      "epss_percentile": 0.40623,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74406"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-73193",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00495,
      "epss_percentile": 0.40496,
      "kev": false,
      "kev_due_at": null,
      "vendor": null,
      "product": "DBI",
      "cwe": "CWE-190",
      "title": "DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73193"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-68457",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00485,
      "epss_percentile": 0.39825,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: use opener credentials for FSCTL mutations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68457"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-19898",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00482,
      "epss_percentile": 0.39656,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "VictoriaMetrics",
      "cwe": "CWE-307",
      "title": "VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19898"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-72492",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00477,
      "epss_percentile": 0.39354,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: fix use-after-free in same_client_has_lease()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72492"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-72202",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00468,
      "epss_percentile": 0.38708,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: avoid heap allocation for free-cluster readahead state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72202"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-72186",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00467,
      "epss_percentile": 0.38682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: make system files immutable to prevent corruption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72186"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-72188",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00467,
      "epss_percentile": 0.38682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72188"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-72099",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00459,
      "epss_percentile": 0.38193,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-integrity: don't increment hash_offset twice",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72099"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-74473",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00457,
      "epss_percentile": 0.38061,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vxlan: use pskb_network_may_pull() in route_shortcircuit()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74473"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-74480",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00457,
      "epss_percentile": 0.3806,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: bridge: stop fast-leave after deleting a port group",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74480"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-74495",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00457,
      "epss_percentile": 0.38059,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "igbvf: Fix leak in TX DMA error cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74495"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-74545",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00457,
      "epss_percentile": 0.38059,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rtase: fix double free of multi-frag skb on DMA map failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74545"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-74476",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00457,
      "epss_percentile": 0.38061,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "veth: convert frag_list skbs before running XDP",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74476"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-19901",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00454,
      "epss_percentile": 0.37866,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LB-LINK",
      "product": "X-PRO",
      "cwe": "CWE-259",
      "title": "LB-LINK X-PRO easycwmp hard-coded credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19901"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-74345",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0045,
      "epss_percentile": 0.37584,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/siw: Fix endpoint/socket association handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74345"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-74401",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0045,
      "epss_percentile": 0.37585,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dlm: fix add msg handle in send_queue ordered",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74401"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-74309",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00448,
      "epss_percentile": 0.37439,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74309"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-74361",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00448,
      "epss_percentile": 0.37439,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme: fix FDP fdpcidx bounds check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74361"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-74316",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00446,
      "epss_percentile": 0.37295,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "NFSD: Handle layout stid in nfsd4_drop_revoked_stid()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74316"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-72420",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00445,
      "epss_percentile": 0.37181,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid5: avoid R5_Overlap races while breaking stripe batches",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72420"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-74493",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00444,
      "epss_percentile": 0.37151,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/smc: fix socket use-after-free during link group termination",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74493"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-15303",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00443,
      "epss_percentile": 0.3702,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sixstorage",
      "product": "6Storage Rentals",
      "cwe": "CWE-287",
      "title": "6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15303"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-74474",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00442,
      "epss_percentile": 0.36977,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vxlan: use pskb_network_may_pull() for transmit path header pulls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74474"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-74523",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00441,
      "epss_percentile": 0.36846,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "qede: sync udp_tunnel ports outside qede_lock in the recovery path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74523"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-74550",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00441,
      "epss_percentile": 0.36847,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: do not send ICMP/NDISC Redirects when peer allocation fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74550"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-74385",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00432,
      "epss_percentile": 0.36146,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74385"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2026-19598",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00427,
      "epss_percentile": 0.35769,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sc0ttkclark",
      "product": "Pods – Custom Content Types and Fields",
      "cwe": "CWE-863",
      "title": "Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19598"
    },
    {
      "rank": 152,
      "cve_id": "CVE-2026-73046",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00425,
      "epss_percentile": 0.35673,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-307",
      "title": "SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73046"
    },
    {
      "rank": 153,
      "cve_id": "CVE-2026-74469",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00415,
      "epss_percentile": 0.34777,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: prevent peer transport count overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74469"
    },
    {
      "rank": 154,
      "cve_id": "CVE-2026-12248",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0041,
      "epss_percentile": 0.34345,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPML",
      "product": "WPML Multilingual CMS",
      "cwe": "CWE-89",
      "title": "WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12248"
    },
    {
      "rank": 155,
      "cve_id": "CVE-2026-72408",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00407,
      "epss_percentile": 0.34078,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72408"
    },
    {
      "rank": 156,
      "cve_id": "CVE-2026-72463",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00407,
      "epss_percentile": 0.34078,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: Fix dev use-after-free in xfrm async resumption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72463"
    },
    {
      "rank": 157,
      "cve_id": "CVE-2026-72494",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00407,
      "epss_percentile": 0.34079,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/irdma: Replace waitqueue and flag with completion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72494"
    },
    {
      "rank": 158,
      "cve_id": "CVE-2026-74764",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00405,
      "epss_percentile": 0.33883,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pandora-analysis",
      "product": "pandora",
      "cwe": "CWE-22",
      "title": "Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74764"
    },
    {
      "rank": 159,
      "cve_id": "CVE-2026-74427",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00404,
      "epss_percentile": 0.33819,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix netns teardown to cancel the preallocation charger",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74427"
    },
    {
      "rank": 160,
      "cve_id": "CVE-2026-72029",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00403,
      "epss_percentile": 0.33654,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: wwan: iosm: bound device offsets in the MUX downlink decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72029"
    },
    {
      "rank": 161,
      "cve_id": "CVE-2026-74490",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00403,
      "epss_percentile": 0.33758,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: avoid use-after-free in poll trace queue dumps",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74490"
    },
    {
      "rank": 162,
      "cve_id": "CVE-2026-74522",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00403,
      "epss_percentile": 0.33758,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: fix use-after-free in __close_file_table_ids()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74522"
    },
    {
      "rank": 163,
      "cve_id": "CVE-2026-19895",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00402,
      "epss_percentile": 0.33605,
      "kev": false,
      "kev_due_at": null,
      "vendor": "opensourcepos",
      "product": "Open Source Point of Sale",
      "cwe": "CWE-307",
      "title": "opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19895"
    },
    {
      "rank": 164,
      "cve_id": "CVE-2026-74475",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00399,
      "epss_percentile": 0.33231,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vxlan: use neigh_ha_snapshot() in route_shortcircuit()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74475"
    },
    {
      "rank": 165,
      "cve_id": "CVE-2026-18387",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00392,
      "epss_percentile": 0.32468,
      "kev": false,
      "kev_due_at": null,
      "vendor": "trainingbusinesspros",
      "product": "Groundhogg — CRM, Newsletters, and Marketing Automation",
      "cwe": "CWE-89",
      "title": "Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18387"
    },
    {
      "rank": 166,
      "cve_id": "CVE-2026-15001",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0039,
      "epss_percentile": 0.32307,
      "kev": false,
      "kev_due_at": null,
      "vendor": "connectordev",
      "product": "bLoyal: Loyalty & Promotions by bLoyal",
      "cwe": "CWE-269",
      "title": "bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15001"
    },
    {
      "rank": 167,
      "cve_id": "CVE-2026-74269",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00379,
      "epss_percentile": 0.31225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bnxt: fix head underflow on XDP head-grow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74269"
    },
    {
      "rank": 168,
      "cve_id": "CVE-2026-74315",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00379,
      "epss_percentile": 0.31224,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74315"
    },
    {
      "rank": 169,
      "cve_id": "CVE-2026-74350",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00379,
      "epss_percentile": 0.31225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: validate fast symlink target during inode read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74350"
    },
    {
      "rank": 170,
      "cve_id": "CVE-2026-16142",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00377,
      "epss_percentile": 0.3099,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themetechmount",
      "product": "TrueBooker – Appointment Booking and Scheduler System",
      "cwe": "CWE-639",
      "title": "TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16142"
    },
    {
      "rank": 171,
      "cve_id": "CVE-2026-74576",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00376,
      "epss_percentile": 0.30861,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/slab: prevent unbounded recursion in free path with new kmalloc type",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74576"
    },
    {
      "rank": 172,
      "cve_id": "CVE-2026-73631",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00375,
      "epss_percentile": 0.30827,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Struts",
      "cwe": "CWE-567",
      "title": "Apache Struts: Shared parsing state in the JSON plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73631"
    },
    {
      "rank": 173,
      "cve_id": "CVE-2026-73632",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00375,
      "epss_percentile": 0.30827,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Struts",
      "cwe": "CWE-567",
      "title": "Apache Struts: Shared serialization state in the JSON plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73632"
    },
    {
      "rank": 174,
      "cve_id": "CVE-2026-72493",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00373,
      "epss_percentile": 0.30639,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: serialize netif_running() check in enqueue_to_backlog()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72493"
    },
    {
      "rank": 175,
      "cve_id": "CVE-2026-73043",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00372,
      "epss_percentile": 0.30432,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-79",
      "title": "SiYuan before v3.7.4 Remote Code Execution via Template Calculation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73043"
    },
    {
      "rank": 176,
      "cve_id": "CVE-2026-19897",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.0037,
      "epss_percentile": 0.30235,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mangroup",
      "product": "dtale",
      "cwe": "CWE-307",
      "title": "mangroup dtale Login Endpoint auth.py login excessive authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19897"
    },
    {
      "rank": 177,
      "cve_id": "CVE-2026-74436",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00364,
      "epss_percentile": 0.296,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: serialize kernel accept preallocation with socket teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74436"
    },
    {
      "rank": 178,
      "cve_id": "CVE-2026-72440",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00364,
      "epss_percentile": 0.29647,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid1: fix writes_pending and barrier reference leaks on write failures",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72440"
    },
    {
      "rank": 179,
      "cve_id": "CVE-2026-74556",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00359,
      "epss_percentile": 0.29134,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74556"
    },
    {
      "rank": 180,
      "cve_id": "CVE-2026-72438",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00359,
      "epss_percentile": 0.29105,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid10: fix writes_pending and barrier reference leaks on discard failures",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72438"
    },
    {
      "rank": 181,
      "cve_id": "CVE-2026-74428",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00352,
      "epss_percentile": 0.28369,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Fix double unlock in rxrpc_recvmsg()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74428"
    },
    {
      "rank": 182,
      "cve_id": "CVE-2026-74433",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00352,
      "epss_percentile": 0.28368,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Fix UAF in rxgk_issue_challenge()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74433"
    },
    {
      "rank": 183,
      "cve_id": "CVE-2026-74425",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0035,
      "epss_percentile": 0.28222,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: handle CB.InitCallBackState3 requests without a server record",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74425"
    },
    {
      "rank": 184,
      "cve_id": "CVE-2026-74435",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0035,
      "epss_percentile": 0.28221,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74435"
    },
    {
      "rank": 185,
      "cve_id": "CVE-2026-74569",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00349,
      "epss_percentile": 0.28072,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74569"
    },
    {
      "rank": 186,
      "cve_id": "CVE-2026-12128",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00348,
      "epss_percentile": 0.27995,
      "kev": false,
      "kev_due_at": null,
      "vendor": "dotonpaper",
      "product": "Pinpoint Booking System – Version 2",
      "cwe": "CWE-20",
      "title": "Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12128"
    },
    {
      "rank": 187,
      "cve_id": "CVE-2026-74572",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00346,
      "epss_percentile": 0.27746,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "btrfs: zoned: fix deadlock between metadata writeback and transaction commit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74572"
    },
    {
      "rank": 188,
      "cve_id": "CVE-2026-16094",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00346,
      "epss_percentile": 0.27763,
      "kev": false,
      "kev_due_at": null,
      "vendor": "matthiasnordwig",
      "product": "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms",
      "cwe": "CWE-89",
      "title": "Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16094"
    },
    {
      "rank": 189,
      "cve_id": "CVE-2026-72003",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00344,
      "epss_percentile": 0.27519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: brcmfmac: cyw: fix heap overflow on a short auth frame",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72003"
    },
    {
      "rank": 190,
      "cve_id": "CVE-2026-15162",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00343,
      "epss_percentile": 0.2742,
      "kev": false,
      "kev_due_at": null,
      "vendor": "minnpost",
      "product": "Object Sync for Salesforce",
      "cwe": "CWE-89",
      "title": "Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15162"
    },
    {
      "rank": 191,
      "cve_id": "CVE-2026-74374",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00343,
      "epss_percentile": 0.2747,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid1,raid10: fix error-path detection with md_cloned_bio()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74374"
    },
    {
      "rank": 192,
      "cve_id": "CVE-2026-74434",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00342,
      "epss_percentile": 0.2732,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Don't move a peeked OOB message onto the pending queue",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74434"
    },
    {
      "rank": 193,
      "cve_id": "CVE-2026-74341",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00342,
      "epss_percentile": 0.27383,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: wcn36xx: fix heap overflow from oversized firmware HAL response",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74341"
    },
    {
      "rank": 194,
      "cve_id": "CVE-2026-72334",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00341,
      "epss_percentile": 0.27213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: fix malformed ISO_END/CONT handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72334"
    },
    {
      "rank": 195,
      "cve_id": "CVE-2026-18549",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0034,
      "epss_percentile": 0.27166,
      "kev": false,
      "kev_due_at": null,
      "vendor": "@fastify/multipart",
      "product": "@fastify/multipart",
      "cwe": "CWE-400",
      "title": "@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18549"
    },
    {
      "rank": 196,
      "cve_id": "CVE-2026-72233",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00339,
      "epss_percentile": 0.2702,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: bla: reacquire gw address after skb realloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72233"
    },
    {
      "rank": 197,
      "cve_id": "CVE-2026-72235",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00339,
      "epss_percentile": 0.27021,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: retrieve ethhdr after potential skb realloc on RX",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72235"
    },
    {
      "rank": 198,
      "cve_id": "CVE-2026-74429",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00339,
      "epss_percentile": 0.26954,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Fix the reception of a reply packet before data transmission",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74429"
    },
    {
      "rank": 199,
      "cve_id": "CVE-2026-74430",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00339,
      "epss_percentile": 0.26958,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Fix ACKALL packet handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74430"
    },
    {
      "rank": 200,
      "cve_id": "CVE-2026-74431",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00339,
      "epss_percentile": 0.26958,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Fix potential infinite loop in rxrpc_recvmsg()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74431"
    },
    {
      "rank": 201,
      "cve_id": "CVE-2026-72227",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00336,
      "epss_percentile": 0.26591,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: mcast: avoid OOB read of num_dests header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72227"
    },
    {
      "rank": 202,
      "cve_id": "CVE-2026-15341",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00333,
      "epss_percentile": 0.26319,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rafasashi",
      "product": "User Session Synchronizer",
      "cwe": "CWE-287",
      "title": "User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15341"
    },
    {
      "rank": 203,
      "cve_id": "CVE-2026-72121",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00333,
      "epss_percentile": 0.26353,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: add locking when updating filter and timer values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72121"
    },
    {
      "rank": 204,
      "cve_id": "CVE-2026-72124",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00333,
      "epss_percentile": 0.26353,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: isotp: serialize TX state transitions under so->rx_lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72124"
    },
    {
      "rank": 205,
      "cve_id": "CVE-2026-72157",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00333,
      "epss_percentile": 0.26353,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: thunderbolt: Fix frags[] overflow by bounding frame_count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72157"
    },
    {
      "rank": 206,
      "cve_id": "CVE-2026-19906",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00329,
      "epss_percentile": 0.25869,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pkp",
      "product": "pkp-lib",
      "cwe": "CWE-331",
      "title": "pkp pkp-lib API Key Generation APIProfileForm.php setData entropy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19906"
    },
    {
      "rank": 207,
      "cve_id": "CVE-2026-16586",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00328,
      "epss_percentile": 0.25784,
      "kev": false,
      "kev_due_at": null,
      "vendor": "contest-gallery",
      "product": "Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe",
      "cwe": "CWE-89",
      "title": "Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16586"
    },
    {
      "rank": 208,
      "cve_id": "CVE-2026-72148",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00322,
      "epss_percentile": 0.25067,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72148"
    },
    {
      "rank": 209,
      "cve_id": "CVE-2026-68471",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00318,
      "epss_percentile": 0.24642,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ieee80211: validate MLE common info length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68471"
    },
    {
      "rank": 210,
      "cve_id": "CVE-2026-72469",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00317,
      "epss_percentile": 0.24582,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xprtrdma: Fix ep kref imbalance on ADDR_CHANGE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72469"
    },
    {
      "rank": 211,
      "cve_id": "CVE-2026-74521",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00315,
      "epss_percentile": 0.24292,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: use memcmp() to compare ClientGUIDs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74521"
    },
    {
      "rank": 212,
      "cve_id": "CVE-2026-8840",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00315,
      "epss_percentile": 0.24291,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpdevart",
      "product": "Booking calendar, Appointment Booking System",
      "cwe": "CWE-862",
      "title": "Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8840"
    },
    {
      "rank": 213,
      "cve_id": "CVE-2026-72471",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00314,
      "epss_percentile": 0.24263,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: prevent potential lcn remains uninitialized",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72471"
    },
    {
      "rank": 214,
      "cve_id": "CVE-2026-73054",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00313,
      "epss_percentile": 0.24167,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-287",
      "title": "SiYuan before v3.7.4 Authentication Bypass via WebSocket",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73054"
    },
    {
      "rank": 215,
      "cve_id": "CVE-2026-19903",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00311,
      "epss_percentile": 0.23923,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Online Clothing Store",
      "cwe": "CWE-552",
      "title": "SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19903"
    },
    {
      "rank": 216,
      "cve_id": "CVE-2026-15993",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00311,
      "epss_percentile": 0.23847,
      "kev": false,
      "kev_due_at": null,
      "vendor": "10web",
      "product": "Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder",
      "cwe": "CWE-89",
      "title": "Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15993"
    },
    {
      "rank": 217,
      "cve_id": "CVE-2026-74570",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00308,
      "epss_percentile": 0.23495,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: harden runlist realloc size calculations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74570"
    },
    {
      "rank": 218,
      "cve_id": "CVE-2026-19896",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00308,
      "epss_percentile": 0.23518,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mangroup",
      "product": "dtale",
      "cwe": "CWE-310",
      "title": "mangroup dtale Flask Session Cookie app.py build_secret_key random values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19896"
    },
    {
      "rank": 219,
      "cve_id": "CVE-2026-73045",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00302,
      "epss_percentile": 0.22926,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-307",
      "title": "SiYuan before 3.7.4 Brute-Force via authFilePublishAccess",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73045"
    },
    {
      "rank": 220,
      "cve_id": "CVE-2026-73042",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.003,
      "epss_percentile": 0.22623,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-79",
      "title": "SiYuan before v3.7.4 Remote Code Execution via Menu Metadata",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73042"
    },
    {
      "rank": 221,
      "cve_id": "CVE-2026-73052",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.003,
      "epss_percentile": 0.22623,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-79",
      "title": "SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73052"
    },
    {
      "rank": 222,
      "cve_id": "CVE-2026-68472",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00298,
      "epss_percentile": 0.22457,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: cfg80211: validate EHT MLE before MLD ID read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68472"
    },
    {
      "rank": 223,
      "cve_id": "CVE-2026-16146",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00294,
      "epss_percentile": 0.2205,
      "kev": false,
      "kev_due_at": null,
      "vendor": "matthiasnordwig",
      "product": "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms",
      "cwe": "CWE-89",
      "title": "Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16146"
    },
    {
      "rank": 224,
      "cve_id": "CVE-2026-74557",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00292,
      "epss_percentile": 0.2183,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74557"
    },
    {
      "rank": 225,
      "cve_id": "CVE-2026-72380",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00289,
      "epss_percentile": 0.21466,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xen/pvcalls: bound backend response req_id before indexing rsp[]",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72380"
    },
    {
      "rank": 226,
      "cve_id": "CVE-2026-68470",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00288,
      "epss_percentile": 0.21432,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: validate extension-frame layout before RX",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68470"
    },
    {
      "rank": 227,
      "cve_id": "CVE-2026-18216",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00286,
      "epss_percentile": 0.2121,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Backup Migration",
      "cwe": "CWE-287",
      "title": "Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18216"
    },
    {
      "rank": 228,
      "cve_id": "CVE-2026-19893",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00286,
      "epss_percentile": 0.212,
      "kev": false,
      "kev_due_at": null,
      "vendor": "D-Link",
      "product": "DIR-842",
      "cwe": "CWE-266",
      "title": "D-Link DIR-842 vsftpd vsftpd.conf default permission",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19893"
    },
    {
      "rank": 229,
      "cve_id": "CVE-2026-73053",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00284,
      "epss_percentile": 0.20945,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-79",
      "title": "SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73053"
    },
    {
      "rank": 230,
      "cve_id": "CVE-2026-14279",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00283,
      "epss_percentile": 0.20912,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cedcommerce",
      "product": "Wholesale Market",
      "cwe": "CWE-269",
      "title": "Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14279"
    },
    {
      "rank": 231,
      "cve_id": "CVE-2026-15312",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00283,
      "epss_percentile": 0.20913,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fassionstorage",
      "product": "Propovoice: All-in-One Client Management System",
      "cwe": "CWE-269",
      "title": "Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15312"
    },
    {
      "rank": 232,
      "cve_id": "CVE-2026-72115",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00281,
      "epss_percentile": 0.20675,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: track a single source interface for ANYDEV timeout/throttle ops",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72115"
    },
    {
      "rank": 233,
      "cve_id": "CVE-2026-74410",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00278,
      "epss_percentile": 0.20368,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74410"
    },
    {
      "rank": 234,
      "cve_id": "CVE-2026-19474",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00278,
      "epss_percentile": 0.20396,
      "kev": false,
      "kev_due_at": null,
      "vendor": "@fastify/multipart",
      "product": "@fastify/multipart",
      "cwe": "CWE-459",
      "title": "@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19474"
    },
    {
      "rank": 235,
      "cve_id": "CVE-2026-74340",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00277,
      "epss_percentile": 0.20252,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74340"
    },
    {
      "rank": 236,
      "cve_id": "CVE-2026-74408",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00266,
      "epss_percentile": 0.186,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath9k: fix OOB access from firmware tx status queue ID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74408"
    },
    {
      "rank": 237,
      "cve_id": "CVE-2026-16145",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00266,
      "epss_percentile": 0.18669,
      "kev": false,
      "kev_due_at": null,
      "vendor": "matthiasnordwig",
      "product": "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms",
      "cwe": "CWE-79",
      "title": "Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16145"
    },
    {
      "rank": 238,
      "cve_id": "CVE-2026-19899",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00263,
      "epss_percentile": 0.18301,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-89",
      "title": "SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19899"
    },
    {
      "rank": 239,
      "cve_id": "CVE-2026-19919",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00263,
      "epss_percentile": 0.18301,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Shopping System",
      "cwe": "CWE-89",
      "title": "code-projects Online Shopping System Login login.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19919"
    },
    {
      "rank": 240,
      "cve_id": "CVE-2026-74300",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0026,
      "epss_percentile": 0.17861,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci: validate codec capability element length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74300"
    },
    {
      "rank": 241,
      "cve_id": "CVE-2026-74411",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00257,
      "epss_percentile": 0.17554,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: rtw89: Correct data type for scan index to avoid infinite loop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74411"
    },
    {
      "rank": 242,
      "cve_id": "CVE-2026-16611",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00256,
      "epss_percentile": 0.17421,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Product Feed PRO for WooCommerce by AdTribes",
      "cwe": "CWE-200",
      "title": "Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16611"
    },
    {
      "rank": 243,
      "cve_id": "CVE-2026-74508",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.17109,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: HIDP: reject frames without a transaction header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74508"
    },
    {
      "rank": 244,
      "cve_id": "CVE-2026-74531",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.1711,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_conn: hold conn reference in abort_conn_sync()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74531"
    },
    {
      "rank": 245,
      "cve_id": "CVE-2026-19905",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00254,
      "epss_percentile": 0.17147,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Jinher",
      "product": "OA",
      "cwe": "CWE-89",
      "title": "Jinher OA attendance_out_approve.aspx sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19905"
    },
    {
      "rank": 246,
      "cve_id": "CVE-2026-74767",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00253,
      "epss_percentile": 0.16991,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pandora-analysis",
      "product": "pandora",
      "cwe": "CWE-434",
      "title": "Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74767"
    },
    {
      "rank": 247,
      "cve_id": "CVE-2026-19894",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0025,
      "epss_percentile": 0.1664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Hospital Management System",
      "cwe": "CWE-89",
      "title": "itsourcecode Hospital Management System viewmedicine.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19894"
    },
    {
      "rank": 248,
      "cve_id": "CVE-2026-74539",
      "cvss_base": 8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00249,
      "epss_percentile": 0.16507,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: lock sk in iso_sock_getname",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74539"
    },
    {
      "rank": 249,
      "cve_id": "CVE-2026-15453",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00249,
      "epss_percentile": 0.16518,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iqonicdesign",
      "product": "KiviCare – Clinic & Patient Management System (EHR)",
      "cwe": "CWE-89",
      "title": "KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15453"
    },
    {
      "rank": 250,
      "cve_id": "CVE-2026-16080",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00249,
      "epss_percentile": 0.16517,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fishpie",
      "product": "Image Uploader for Welcart",
      "cwe": "CWE-89",
      "title": "Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16080"
    },
    {
      "rank": 251,
      "cve_id": "CVE-2026-73044",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00247,
      "epss_percentile": 0.16308,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-79",
      "title": "SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73044"
    },
    {
      "rank": 252,
      "cve_id": "CVE-2026-73050",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00247,
      "epss_percentile": 0.16307,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-79",
      "title": "SiYuan before v3.7.4 Stored XSS via select option color",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73050"
    },
    {
      "rank": 253,
      "cve_id": "CVE-2026-74488",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00247,
      "epss_percentile": 0.16244,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74488"
    },
    {
      "rank": 254,
      "cve_id": "CVE-2026-74540",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00247,
      "epss_percentile": 0.16244,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74540"
    },
    {
      "rank": 255,
      "cve_id": "CVE-2026-74541",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00247,
      "epss_percentile": 0.16243,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: clear iso_data always when detaching conn from hcon",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74541"
    },
    {
      "rank": 256,
      "cve_id": "CVE-2026-13360",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00247,
      "epss_percentile": 0.16259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wplegalpages",
      "product": "WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode",
      "cwe": "CWE-79",
      "title": "Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13360"
    },
    {
      "rank": 257,
      "cve_id": "CVE-2026-74409",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00243,
      "epss_percentile": 0.15729,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: rtw89: add bounds check on firmware mac_id in link lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74409"
    },
    {
      "rank": 258,
      "cve_id": "CVE-2026-74412",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00243,
      "epss_percentile": 0.1573,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74412"
    },
    {
      "rank": 259,
      "cve_id": "CVE-2026-74413",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00243,
      "epss_percentile": 0.15729,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74413"
    },
    {
      "rank": 260,
      "cve_id": "CVE-2026-74323",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00242,
      "epss_percentile": 0.15633,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74323"
    },
    {
      "rank": 261,
      "cve_id": "CVE-2026-74535",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.15588,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: avoid deadlocks in iso_sock_timeout",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74535"
    },
    {
      "rank": 262,
      "cve_id": "CVE-2026-74534",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00239,
      "epss_percentile": 0.15222,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: fix refcounting of iso_conn",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74534"
    },
    {
      "rank": 263,
      "cve_id": "CVE-2026-74537",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00239,
      "epss_percentile": 0.15222,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: hold sk properly in iso_conn_ready",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74537"
    },
    {
      "rank": 264,
      "cve_id": "CVE-2026-74538",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00239,
      "epss_percentile": 0.15222,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: lock sk in iso_connect_ind",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74538"
    },
    {
      "rank": 265,
      "cve_id": "CVE-2026-14433",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00236,
      "epss_percentile": 0.14902,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vcita",
      "product": "Online Booking & Scheduling Calendar for WordPress by vcita",
      "cwe": "CWE-79",
      "title": "Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14433"
    },
    {
      "rank": 266,
      "cve_id": "CVE-2026-74509",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00235,
      "epss_percentile": 0.14663,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sync: Fix advertising data UAFs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74509"
    },
    {
      "rank": 267,
      "cve_id": "CVE-2026-74356",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00235,
      "epss_percentile": 0.14788,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vhost: fix vhost_get_avail_idx for a non empty ring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74356"
    },
    {
      "rank": 268,
      "cve_id": "CVE-2026-17090",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00235,
      "epss_percentile": 0.14668,
      "kev": false,
      "kev_due_at": null,
      "vendor": "beaverbuilder",
      "product": "Beaver Builder Page Builder – Drag and Drop Website Builder",
      "cwe": "CWE-79",
      "title": "Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17090"
    },
    {
      "rank": 269,
      "cve_id": "CVE-2026-73041",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00234,
      "epss_percentile": 0.14545,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-79",
      "title": "SiYuan before v3.7.4 Remote Code Execution via PDF Annotations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73041"
    },
    {
      "rank": 270,
      "cve_id": "CVE-2026-74507",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00231,
      "epss_percentile": 0.14208,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: HIDP: validate numbered report payloads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74507"
    },
    {
      "rank": 271,
      "cve_id": "CVE-2026-74575",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0023,
      "epss_percentile": 0.14043,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Prevent XDomain delayed work use-after-free on disconnect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74575"
    },
    {
      "rank": 272,
      "cve_id": "CVE-2026-74528",
      "cvss_base": 8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0023,
      "epss_percentile": 0.14087,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sync: hold conn in hci_past_sync() callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74528"
    },
    {
      "rank": 273,
      "cve_id": "CVE-2026-19918",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00228,
      "epss_percentile": 0.13879,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SpaceX",
      "product": "Starlink Router Gen 3",
      "cwe": "CWE-266",
      "title": "SpaceX Starlink Router Gen 3 gRPC Management get_status access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19918"
    },
    {
      "rank": 274,
      "cve_id": "CVE-2026-72441",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00226,
      "epss_percentile": 0.13613,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ieee802154: fix kernel-infoleak in dgram_recvmsg()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72441"
    },
    {
      "rank": 275,
      "cve_id": "CVE-2026-72245",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00221,
      "epss_percentile": 0.12907,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72245"
    },
    {
      "rank": 276,
      "cve_id": "CVE-2026-72056",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12744,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ena: clean up XDP TX queues when regular TX setup fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72056"
    },
    {
      "rank": 277,
      "cve_id": "CVE-2026-72068",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12743,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72068"
    },
    {
      "rank": 278,
      "cve_id": "CVE-2026-72074",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12743,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: ims-pcu - fix type confusion in CDC union descriptor parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72074"
    },
    {
      "rank": 279,
      "cve_id": "CVE-2026-72076",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12745,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72076"
    },
    {
      "rank": 280,
      "cve_id": "CVE-2026-72078",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12745,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: ims-pcu - validate control endpoint type",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72078"
    },
    {
      "rank": 281,
      "cve_id": "CVE-2026-72079",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12744,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: ims-pcu - fix use-after-free and double-free in disconnect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72079"
    },
    {
      "rank": 282,
      "cve_id": "CVE-2026-72223",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12741,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvdimm/btt: Free arena sub-allocations on discover_arenas() error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72223"
    },
    {
      "rank": 283,
      "cve_id": "CVE-2026-72224",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12741,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvdimm/btt: Free arenas on btt_init() error paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72224"
    },
    {
      "rank": 284,
      "cve_id": "CVE-2026-72307",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12742,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72307"
    },
    {
      "rank": 285,
      "cve_id": "CVE-2026-72316",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12743,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm era: fix NULL pointer dereference in metadata_open()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72316"
    },
    {
      "rank": 286,
      "cve_id": "CVE-2026-72326",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12742,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: cake: reject overhead values that underflow length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72326"
    },
    {
      "rank": 287,
      "cve_id": "CVE-2026-72349",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12741,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72349"
    },
    {
      "rank": 288,
      "cve_id": "CVE-2026-72396",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12742,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: adm1275: Prevent reading uninitialized stack",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72396"
    },
    {
      "rank": 289,
      "cve_id": "CVE-2026-72414",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12741,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: dsa: sja1105: round up PTP perout pin duration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72414"
    },
    {
      "rank": 290,
      "cve_id": "CVE-2026-72447",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0022,
      "epss_percentile": 0.12743,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: hold socket lock when dumping endpoints in sctp_diag",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72447"
    },
    {
      "rank": 291,
      "cve_id": "CVE-2026-16541",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00219,
      "epss_percentile": 0.1264,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Simply Schedule Appointments",
      "cwe": "CWE-200",
      "title": "Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16541"
    },
    {
      "rank": 292,
      "cve_id": "CVE-2026-72073",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00219,
      "epss_percentile": 0.12712,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mmc: vub300: fix use-after-free on probe failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72073"
    },
    {
      "rank": 293,
      "cve_id": "CVE-2026-74407",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00218,
      "epss_percentile": 0.12568,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath11k: cancel SSR work items during PCI shutdown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74407"
    },
    {
      "rank": 294,
      "cve_id": "CVE-2026-74489",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00218,
      "epss_percentile": 0.12595,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: fix tid_tx use-after-free on BA session stop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74489"
    },
    {
      "rank": 295,
      "cve_id": "CVE-2026-74530",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00218,
      "epss_percentile": 0.12596,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74530"
    },
    {
      "rank": 296,
      "cve_id": "CVE-2026-74533",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00218,
      "epss_percentile": 0.12595,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74533"
    },
    {
      "rank": 297,
      "cve_id": "CVE-2026-72106",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00216,
      "epss_percentile": 0.12368,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-ioctl: fix a possible overflow in list_version_get_info",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72106"
    },
    {
      "rank": 298,
      "cve_id": "CVE-2026-72058",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.1214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ixp4xx_hss: fix duplicate HDLC netdev allocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72058"
    },
    {
      "rank": 299,
      "cve_id": "CVE-2026-72059",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.12141,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: wwan: t7xx: destroy DMA pool on CLDMA late init failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72059"
    },
    {
      "rank": 300,
      "cve_id": "CVE-2026-72075",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.12178,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: ims-pcu - fix race condition in reset_device sysfs callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72075"
    },
    {
      "rank": 301,
      "cve_id": "CVE-2026-72081",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.1214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: elx: efct: Fix I/O leak on unsupported additional CDB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72081"
    },
    {
      "rank": 302,
      "cve_id": "CVE-2026-72082",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.12139,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72082"
    },
    {
      "rank": 303,
      "cve_id": "CVE-2026-72087",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.12178,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72087"
    },
    {
      "rank": 304,
      "cve_id": "CVE-2026-72236",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.12241,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72236"
    },
    {
      "rank": 305,
      "cve_id": "CVE-2026-72276",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.1214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: metronomefb: fix potential memory leak in metronomefb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72276"
    },
    {
      "rank": 306,
      "cve_id": "CVE-2026-72306",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.12141,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72306"
    },
    {
      "rank": 307,
      "cve_id": "CVE-2026-72437",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00215,
      "epss_percentile": 0.12141,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72437"
    },
    {
      "rank": 308,
      "cve_id": "CVE-2026-15142",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00214,
      "epss_percentile": 0.12033,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WebCodingPlace",
      "product": "Real Estate Manager Pro",
      "cwe": "CWE-269",
      "title": "Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15142"
    },
    {
      "rank": 309,
      "cve_id": "CVE-2026-72011",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00213,
      "epss_percentile": 0.11877,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72011"
    },
    {
      "rank": 310,
      "cve_id": "CVE-2026-68469",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00212,
      "epss_percentile": 0.11752,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mwifiex: fix permanently busy scans after multiple roam iterations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68469"
    },
    {
      "rank": 311,
      "cve_id": "CVE-2026-14229",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00211,
      "epss_percentile": 0.11681,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "ECS",
      "cwe": "CWE-284",
      "title": "ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14229"
    },
    {
      "rank": 312,
      "cve_id": "CVE-2026-15948",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0021,
      "epss_percentile": 0.11573,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themefic",
      "product": "Hydra Booking — Appointment Scheduling & Booking Calendar",
      "cwe": "CWE-79",
      "title": "Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15948"
    },
    {
      "rank": 313,
      "cve_id": "CVE-2026-19904",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.0021,
      "epss_percentile": 0.11521,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Online Book Store System",
      "cwe": "CWE-79",
      "title": "SourceCodester Online Book Store System System Settings index.php site_settings cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19904"
    },
    {
      "rank": 314,
      "cve_id": "CVE-2026-68475",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11562,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "reset: sunxi: fix memory region leak on ioremap failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68475"
    },
    {
      "rank": 315,
      "cve_id": "CVE-2026-68478",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11564,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "memstick: ms_block: reject a card that reports too many blocks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68478"
    },
    {
      "rank": 316,
      "cve_id": "CVE-2026-72004",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11565,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: fix memory leak in ieee80211_register_hw()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72004"
    },
    {
      "rank": 317,
      "cve_id": "CVE-2026-72010",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.1157,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72010"
    },
    {
      "rank": 318,
      "cve_id": "CVE-2026-72022",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11564,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "llc: fix SAP refcount leak in llc_ui_autobind()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72022"
    },
    {
      "rank": 319,
      "cve_id": "CVE-2026-72025",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11562,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/monwriter: Reject buffer reuse with different data length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72025"
    },
    {
      "rank": 320,
      "cve_id": "CVE-2026-72038",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.1156,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: liquidio: fix BAR resource leak on PF number failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72038"
    },
    {
      "rank": 321,
      "cve_id": "CVE-2026-72039",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11561,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72039"
    },
    {
      "rank": 322,
      "cve_id": "CVE-2026-72047",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.1156,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72047"
    },
    {
      "rank": 323,
      "cve_id": "CVE-2026-72048",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11562,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ieee802154: ca8210: fix cas_ctl leak on spi_async failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72048"
    },
    {
      "rank": 324,
      "cve_id": "CVE-2026-72088",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11569,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72088"
    },
    {
      "rank": 325,
      "cve_id": "CVE-2026-72138",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11569,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xen/gntdev: fix error handling in ioctl",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72138"
    },
    {
      "rank": 326,
      "cve_id": "CVE-2026-72140",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11569,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72140"
    },
    {
      "rank": 327,
      "cve_id": "CVE-2026-72153",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11563,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "irqchip/crossbar: Use correct index in crossbar_domain_free()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72153"
    },
    {
      "rank": 328,
      "cve_id": "CVE-2026-72159",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11561,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: reject non-inline dinodes with i_size and zero i_clusters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72159"
    },
    {
      "rank": 329,
      "cve_id": "CVE-2026-72163",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.1156,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72163"
    },
    {
      "rank": 330,
      "cve_id": "CVE-2026-72182",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11561,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "power: supply: charger-manager: fix refcount leak in is_full_charged()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72182"
    },
    {
      "rank": 331,
      "cve_id": "CVE-2026-72215",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11564,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72215"
    },
    {
      "rank": 332,
      "cve_id": "CVE-2026-72218",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11566,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72218"
    },
    {
      "rank": 333,
      "cve_id": "CVE-2026-72219",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11564,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "lockd: Plug nlm_file leak when nlm_do_fopen() fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72219"
    },
    {
      "rank": 334,
      "cve_id": "CVE-2026-72228",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11568,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: frag: fix primary_if leak on failed linearization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72228"
    },
    {
      "rank": 335,
      "cve_id": "CVE-2026-72229",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11568,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: clean untagged VLAN on netdev registration failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72229"
    },
    {
      "rank": 336,
      "cve_id": "CVE-2026-72230",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11567,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: frag: free unfragmentable packet",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72230"
    },
    {
      "rank": 337,
      "cve_id": "CVE-2026-72238",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11565,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "x86/boot: Validate console=uart8250 baud rate to fix early boot hang",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72238"
    },
    {
      "rank": 338,
      "cve_id": "CVE-2026-72240",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11566,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mfd: sm501: Fix reference leak on failed device registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72240"
    },
    {
      "rank": 339,
      "cve_id": "CVE-2026-72241",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11566,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "leds: uleds: Fix potential buffer overread",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72241"
    },
    {
      "rank": 340,
      "cve_id": "CVE-2026-72256",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11567,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: xt_cluster: reject template conntracks in hash match",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72256"
    },
    {
      "rank": 341,
      "cve_id": "CVE-2026-72260",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11529,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: mediatek: mt8192: Check runtime resume during probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72260"
    },
    {
      "rank": 342,
      "cve_id": "CVE-2026-72264",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11569,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: tridentfb: fix potential memory leak in trident_pci_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72264"
    },
    {
      "rank": 343,
      "cve_id": "CVE-2026-72265",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.1157,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: nvidia: fix potential memory leak in nvidiafb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72265"
    },
    {
      "rank": 344,
      "cve_id": "CVE-2026-72267",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11571,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72267"
    },
    {
      "rank": 345,
      "cve_id": "CVE-2026-72268",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.1157,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72268"
    },
    {
      "rank": 346,
      "cve_id": "CVE-2026-72269",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11571,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: uvesafb: fix potential memory leak in uvesafb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72269"
    },
    {
      "rank": 347,
      "cve_id": "CVE-2026-72270",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.1157,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: s3fb: fix potential memory leak in s3_pci_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72270"
    },
    {
      "rank": 348,
      "cve_id": "CVE-2026-72271",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11563,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: i740fb: fix potential memory leak in i740fb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72271"
    },
    {
      "rank": 349,
      "cve_id": "CVE-2026-72272",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11562,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: radeon: fix potential memory leak in radeonfb_pci_register()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72272"
    },
    {
      "rank": 350,
      "cve_id": "CVE-2026-72401",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11485,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix insn_aux_data leak on verifier err_free_env path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72401"
    },
    {
      "rank": 351,
      "cve_id": "CVE-2026-72428",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11565,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix stack slot index in nospec checks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72428"
    },
    {
      "rank": 352,
      "cve_id": "CVE-2026-72433",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11563,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72433"
    },
    {
      "rank": 353,
      "cve_id": "CVE-2026-72479",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11567,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: accel: mma8452: handle I2C read error(s) in mma8452_read()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72479"
    },
    {
      "rank": 354,
      "cve_id": "CVE-2026-72481",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11567,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: magnetometer: ak8975: fix potential kernel stack memory leak",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72481"
    },
    {
      "rank": 355,
      "cve_id": "CVE-2026-72484",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11566,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "staging: most: video: avoid double free on video register failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72484"
    },
    {
      "rank": 356,
      "cve_id": "CVE-2026-74284",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0021,
      "epss_percentile": 0.11568,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: sch_hfsc: Don't make class passive twice",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74284"
    },
    {
      "rank": 357,
      "cve_id": "CVE-2026-72062",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11375,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: mt7621: avoid corruption of shared interrupt trigger state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72062"
    },
    {
      "rank": 358,
      "cve_id": "CVE-2026-72063",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11373,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: tegra: do not call pinctrl for GPIO direction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72063"
    },
    {
      "rank": 359,
      "cve_id": "CVE-2026-72070",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11373,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72070"
    },
    {
      "rank": 360,
      "cve_id": "CVE-2026-72077",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11374,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Input: ims-pcu - fix firmware leak in async update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72077"
    },
    {
      "rank": 361,
      "cve_id": "CVE-2026-72308",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11372,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72308"
    },
    {
      "rank": 362,
      "cve_id": "CVE-2026-72324",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11373,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: mvebu: free generic chips on unbind",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72324"
    },
    {
      "rank": 363,
      "cve_id": "CVE-2026-72325",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11374,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "perf/x86/amd/core: Avoid enabling BRS from the SVM reload path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72325"
    },
    {
      "rank": 364,
      "cve_id": "CVE-2026-72327",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11342,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/v3d: Reject invalid indirect BO handle in indirect CSD setup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72327"
    },
    {
      "rank": 365,
      "cve_id": "CVE-2026-72333",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11374,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: L2CAP: fix tx ident leak for commands without a response",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72333"
    },
    {
      "rank": 366,
      "cve_id": "CVE-2026-72361",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11344,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe/hw_engine: Fix double-free of managed BO in error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72361"
    },
    {
      "rank": 367,
      "cve_id": "CVE-2026-72376",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11373,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix misplaced inc of net->cells_outstanding",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72376"
    },
    {
      "rank": 368,
      "cve_id": "CVE-2026-72379",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11375,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72379"
    },
    {
      "rank": 369,
      "cve_id": "CVE-2026-72474",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00209,
      "epss_percentile": 0.11343,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72474"
    },
    {
      "rank": 370,
      "cve_id": "CVE-2026-73055",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00207,
      "epss_percentile": 0.11108,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ericcornelissen",
      "product": "shescape",
      "cwe": "CWE-116",
      "title": "Shescape before 2.1.15 Home Directory Disclosure via BusyBox",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73055"
    },
    {
      "rank": 371,
      "cve_id": "CVE-2026-72321",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00207,
      "epss_percentile": 0.11073,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72321"
    },
    {
      "rank": 372,
      "cve_id": "CVE-2026-72341",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00207,
      "epss_percentile": 0.11073,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5e: Fix publication race for priv->channel_stats[]",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72341"
    },
    {
      "rank": 373,
      "cve_id": "CVE-2026-72365",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00207,
      "epss_percentile": 0.11072,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix writethrough to use collection offload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72365"
    },
    {
      "rank": 374,
      "cve_id": "CVE-2026-72060",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.11045,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ethernet: ti: icssg: guard PA stat lookups",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72060"
    },
    {
      "rank": 375,
      "cve_id": "CVE-2026-72092",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.11043,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: reject command submission on devices without a submit op",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72092"
    },
    {
      "rank": 376,
      "cve_id": "CVE-2026-72152",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10954,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72152"
    },
    {
      "rank": 377,
      "cve_id": "CVE-2026-72155",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10953,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: spi-nor: swp: Improve locking user experience",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72155"
    },
    {
      "rank": 378,
      "cve_id": "CVE-2026-72166",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10952,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/9p: fix infinite loop in p9_client_rpc on fatal signal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72166"
    },
    {
      "rank": 379,
      "cve_id": "CVE-2026-72179",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10953,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "riscv: cacheinfo: Fix node reference leak in populate_cache_leaves",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72179"
    },
    {
      "rank": 380,
      "cve_id": "CVE-2026-72363",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.11044,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix folio state after ENOMEM whilst under writeback iteration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72363"
    },
    {
      "rank": 381,
      "cve_id": "CVE-2026-72384",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10952,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "irqchip/ts4800: Fix missing chained handler cleanup on remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72384"
    },
    {
      "rank": 382,
      "cve_id": "CVE-2026-72392",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.10951,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72392"
    },
    {
      "rank": 383,
      "cve_id": "CVE-2026-72445",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.11043,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: usb-audio: qcom: clear opened when stream enable fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72445"
    },
    {
      "rank": 384,
      "cve_id": "CVE-2026-72457",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00206,
      "epss_percentile": 0.11044,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: fail policy unpack on accept2 allocation failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72457"
    },
    {
      "rank": 385,
      "cve_id": "CVE-2026-72013",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10912,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "riscv: Prevent NULL pointer dereference in machine_kexec_prepare()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72013"
    },
    {
      "rank": 386,
      "cve_id": "CVE-2026-72037",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10914,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: lan743x: Initialize eth_syslock spinlock before use",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72037"
    },
    {
      "rank": 387,
      "cve_id": "CVE-2026-72086",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10909,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: xen: scsiback: Free the command tag on the TMR submit-failure path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72086"
    },
    {
      "rank": 388,
      "cve_id": "CVE-2026-72097",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10913,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-verity: fix a possible NULL pointer dereference",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72097"
    },
    {
      "rank": 389,
      "cve_id": "CVE-2026-72156",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.1091,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72156"
    },
    {
      "rank": 390,
      "cve_id": "CVE-2026-72161",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10911,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: add journal NULL check in ocfs2_checkpoint_inode()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72161"
    },
    {
      "rank": 391,
      "cve_id": "CVE-2026-72167",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10911,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: rawnand: pl353: fix probe resource allocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72167"
    },
    {
      "rank": 392,
      "cve_id": "CVE-2026-72177",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.1091,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72177"
    },
    {
      "rank": 393,
      "cve_id": "CVE-2026-72193",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10911,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs3: cap RESTART_TABLE free-chain walker at rt->used",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72193"
    },
    {
      "rank": 394,
      "cve_id": "CVE-2026-72214",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10909,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72214"
    },
    {
      "rank": 395,
      "cve_id": "CVE-2026-72257",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.1091,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72257"
    },
    {
      "rank": 396,
      "cve_id": "CVE-2026-72274",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10912,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: hecubafb: fix potential memory leak in hecubafb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72274"
    },
    {
      "rank": 397,
      "cve_id": "CVE-2026-72275",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10914,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72275"
    },
    {
      "rank": 398,
      "cve_id": "CVE-2026-72290",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10913,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: pci: Fix GISC refcount leak on AIF enable failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72290"
    },
    {
      "rank": 399,
      "cve_id": "CVE-2026-72391",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10913,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72391"
    },
    {
      "rank": 400,
      "cve_id": "CVE-2026-72467",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10912,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xprtrdma: Check frwr_wp_create() during connect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72467"
    },
    {
      "rank": 401,
      "cve_id": "CVE-2026-74265",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.1091,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mana: initialize gdma queue id to INVALID_QUEUE_ID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74265"
    },
    {
      "rank": 402,
      "cve_id": "CVE-2026-74271",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00205,
      "epss_percentile": 0.10912,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "power: supply: core: fix supplied_from allocations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74271"
    },
    {
      "rank": 403,
      "cve_id": "CVE-2026-74554",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00204,
      "epss_percentile": 0.1074,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74554"
    },
    {
      "rank": 404,
      "cve_id": "CVE-2026-16007",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00203,
      "epss_percentile": 0.10651,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AppFlowy-IO",
      "product": "AppFlowy-Cloud",
      "cwe": "CWE-89",
      "title": "Authenticated SQL Injection in AppFlowy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16007"
    },
    {
      "rank": 405,
      "cve_id": "CVE-2026-72180",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00201,
      "epss_percentile": 0.10327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72180"
    },
    {
      "rank": 406,
      "cve_id": "CVE-2026-19917",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.002,
      "epss_percentile": 0.10239,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Food Order System",
      "cwe": "CWE-89",
      "title": "code-projects Online Food Order System delete_food_items1.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19917"
    },
    {
      "rank": 407,
      "cve_id": "CVE-2026-19920",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.002,
      "epss_percentile": 0.10241,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Shopping System",
      "cwe": "CWE-74",
      "title": "code-projects Online Shopping System action.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19920"
    },
    {
      "rank": 408,
      "cve_id": "CVE-2026-72007",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10196,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "pmdomain: imx: Fix i.MX8MP VC8000E power up sequence",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72007"
    },
    {
      "rank": 409,
      "cve_id": "CVE-2026-72015",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10196,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72015"
    },
    {
      "rank": 410,
      "cve_id": "CVE-2026-72017",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10186,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: macb: drop in-flight Tx SKBs on close",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72017"
    },
    {
      "rank": 411,
      "cve_id": "CVE-2026-72023",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-pf: fix SQB pointer leak on init failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72023"
    },
    {
      "rank": 412,
      "cve_id": "CVE-2026-72026",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72026"
    },
    {
      "rank": 413,
      "cve_id": "CVE-2026-72028",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10185,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "riscv: probes: save original sp in rethook trampoline",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72028"
    },
    {
      "rank": 414,
      "cve_id": "CVE-2026-72030",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10192,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ata: libata-core: Reject an invalid concurrent positioning ranges count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72030"
    },
    {
      "rank": 415,
      "cve_id": "CVE-2026-72032",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5: HWS, fix matcher leak on resize target setup failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72032"
    },
    {
      "rank": 416,
      "cve_id": "CVE-2026-72040",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10195,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipmi: fix refcount leak in i_ipmi_request()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72040"
    },
    {
      "rank": 417,
      "cve_id": "CVE-2026-72050",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10183,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-af: Free BPID bitmap on setup failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72050"
    },
    {
      "rank": 418,
      "cve_id": "CVE-2026-72096",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10229,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-verity: make error counter atomic",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72096"
    },
    {
      "rank": 419,
      "cve_id": "CVE-2026-72101",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10184,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-integrity: fix leaking uninitialized kernel memory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72101"
    },
    {
      "rank": 420,
      "cve_id": "CVE-2026-72117",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10227,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72117"
    },
    {
      "rank": 421,
      "cve_id": "CVE-2026-72118",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10226,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: fix CAN frame rx/tx statistics",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72118"
    },
    {
      "rank": 422,
      "cve_id": "CVE-2026-72127",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10185,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netdev-genl: report NAPI thread PID in the caller's pid namespace",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72127"
    },
    {
      "rank": 423,
      "cve_id": "CVE-2026-72132",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10186,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "NFS: Charge unstable writes by request size, not folio size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72132"
    },
    {
      "rank": 424,
      "cve_id": "CVE-2026-72142",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10226,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72142"
    },
    {
      "rank": 425,
      "cve_id": "CVE-2026-72147",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10226,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dmaengine: dw-edma-pcie: Reject devices without driver data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72147"
    },
    {
      "rank": 426,
      "cve_id": "CVE-2026-72158",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10188,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fpga: dfl: add bounds check in dfh_get_param_size()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72158"
    },
    {
      "rank": 427,
      "cve_id": "CVE-2026-72168",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10226,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: maps: vmu-flash: fix fault in unaligned fixup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72168"
    },
    {
      "rank": 428,
      "cve_id": "CVE-2026-72174",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72174"
    },
    {
      "rank": 429,
      "cve_id": "CVE-2026-72176",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72176"
    },
    {
      "rank": 430,
      "cve_id": "CVE-2026-72178",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10193,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/damon/core: always put unsuccessfully committed target pids",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72178"
    },
    {
      "rank": 431,
      "cve_id": "CVE-2026-72212",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10197,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/memory_hotplug: fix incorrect altmap passing in error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72212"
    },
    {
      "rank": 432,
      "cve_id": "CVE-2026-72216",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "remoteproc: qcom: Fix leak when custom dump_segments addition fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72216"
    },
    {
      "rank": 433,
      "cve_id": "CVE-2026-72237",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10229,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "perf/x86/amd/brs: Fix kernel address leakage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72237"
    },
    {
      "rank": 434,
      "cve_id": "CVE-2026-72258",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10195,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: mediatek: mt8183: Release reserved memory on cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72258"
    },
    {
      "rank": 435,
      "cve_id": "CVE-2026-72259",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10196,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: mediatek: mt8192: Release reserved memory on cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72259"
    },
    {
      "rank": 436,
      "cve_id": "CVE-2026-72266",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10195,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: vesafb: fix memory leak in vesafb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72266"
    },
    {
      "rank": 437,
      "cve_id": "CVE-2026-72273",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10181,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: efifb: fix memory leak in efifb_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72273"
    },
    {
      "rank": 438,
      "cve_id": "CVE-2026-72300",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10185,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SOF: topology: validate vendor array size before parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72300"
    },
    {
      "rank": 439,
      "cve_id": "CVE-2026-72305",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.1023,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "VDUSE: avoid leaking information to userspace",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72305"
    },
    {
      "rank": 440,
      "cve_id": "CVE-2026-72336",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.1023,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: 6lowpan: hold L2CAP conn across debugfs control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72336"
    },
    {
      "rank": 441,
      "cve_id": "CVE-2026-72362",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10192,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72362"
    },
    {
      "rank": 442,
      "cve_id": "CVE-2026-72386",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10188,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72386"
    },
    {
      "rank": 443,
      "cve_id": "CVE-2026-72387",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72387"
    },
    {
      "rank": 444,
      "cve_id": "CVE-2026-72394",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10188,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72394"
    },
    {
      "rank": 445,
      "cve_id": "CVE-2026-72430",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10191,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: act_ct: fix nf_connlabels leak on two error paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72430"
    },
    {
      "rank": 446,
      "cve_id": "CVE-2026-72468",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10197,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xprtrdma: Initialize re_id before removal registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72468"
    },
    {
      "rank": 447,
      "cve_id": "CVE-2026-72475",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.002,
      "epss_percentile": 0.10194,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72475"
    },
    {
      "rank": 448,
      "cve_id": "CVE-2026-19916",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00199,
      "epss_percentile": 0.1003,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Food Order System",
      "cwe": "CWE-79",
      "title": "code-projects Online Food Order System edit_food_items.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19916"
    },
    {
      "rank": 449,
      "cve_id": "CVE-2026-72006",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09937,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5: free mlx5_st_idx_data on final dealloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72006"
    },
    {
      "rank": 450,
      "cve_id": "CVE-2026-72016",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09934,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72016"
    },
    {
      "rank": 451,
      "cve_id": "CVE-2026-72091",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09929,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: reject user command submission without a command BO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72091"
    },
    {
      "rank": 452,
      "cve_id": "CVE-2026-72094",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.0993,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dma-buf: dma-fence: Fix potential NULL pointer dereference",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72094"
    },
    {
      "rank": 453,
      "cve_id": "CVE-2026-72104",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09936,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-pcache: reject option groups without values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72104"
    },
    {
      "rank": 454,
      "cve_id": "CVE-2026-72128",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09936,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvmet: fix refcount leak in nvmet_sq_create()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72128"
    },
    {
      "rank": 455,
      "cve_id": "CVE-2026-72131",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09938,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme-apple: Prevent shared tags across queues on Apple A11",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72131"
    },
    {
      "rank": 456,
      "cve_id": "CVE-2026-72150",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09962,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sunrpc: fix uninitialized xprt_create_args structure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72150"
    },
    {
      "rank": 457,
      "cve_id": "CVE-2026-72169",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09937,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72169"
    },
    {
      "rank": 458,
      "cve_id": "CVE-2026-72205",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09954,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: free volume-wide resources on fill_super failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72205"
    },
    {
      "rank": 459,
      "cve_id": "CVE-2026-72281",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09928,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: account pKVM reclaim against the VM mm",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72281"
    },
    {
      "rank": 460,
      "cve_id": "CVE-2026-72292",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09929,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72292"
    },
    {
      "rank": 461,
      "cve_id": "CVE-2026-72309",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09926,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72309"
    },
    {
      "rank": 462,
      "cve_id": "CVE-2026-72311",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09927,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe: free madvise VMA array on L2 flush failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72311"
    },
    {
      "rank": 463,
      "cve_id": "CVE-2026-72332",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09925,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72332"
    },
    {
      "rank": 464,
      "cve_id": "CVE-2026-72337",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09954,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: 6lowpan: avoid untracked enable work",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72337"
    },
    {
      "rank": 465,
      "cve_id": "CVE-2026-72346",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09927,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72346"
    },
    {
      "rank": 466,
      "cve_id": "CVE-2026-72359",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09926,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe: fix NPD in bo_meminfo()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72359"
    },
    {
      "rank": 467,
      "cve_id": "CVE-2026-72370",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09927,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iomap: release pages on atomic dio size mismatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72370"
    },
    {
      "rank": 468,
      "cve_id": "CVE-2026-72377",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09929,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72377"
    },
    {
      "rank": 469,
      "cve_id": "CVE-2026-72385",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09938,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72385"
    },
    {
      "rank": 470,
      "cve_id": "CVE-2026-72403",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09938,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: FCP: Fix NULL pointer dereference in interface lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72403"
    },
    {
      "rank": 471,
      "cve_id": "CVE-2026-72431",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09937,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "alloc_tag: fix use-after-free in /proc/allocinfo after module unload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72431"
    },
    {
      "rank": 472,
      "cve_id": "CVE-2026-72432",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09929,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tpm_crb: Check ACPI_COMPANION() against NULL during probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72432"
    },
    {
      "rank": 473,
      "cve_id": "CVE-2026-72453",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09928,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "regcache: Do not overwrite error code when finalizing cache after error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72453"
    },
    {
      "rank": 474,
      "cve_id": "CVE-2026-72458",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09935,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: fix NULL pointer dereference in unpack_pdb",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72458"
    },
    {
      "rank": 475,
      "cve_id": "CVE-2026-74261",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09938,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: avoid stale FIFO cells during resize",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74261"
    },
    {
      "rank": 476,
      "cve_id": "CVE-2026-74266",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.09935,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74266"
    },
    {
      "rank": 477,
      "cve_id": "CVE-2026-72343",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00196,
      "epss_percentile": 0.09648,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72343"
    },
    {
      "rank": 478,
      "cve_id": "CVE-2026-74382",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00195,
      "epss_percentile": 0.09559,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: cls_bpf: prevent unbounded recursion in offload rollback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74382"
    },
    {
      "rank": 479,
      "cve_id": "CVE-2026-72277",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00194,
      "epss_percentile": 0.09415,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72277"
    },
    {
      "rank": 480,
      "cve_id": "CVE-2026-72278",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00194,
      "epss_percentile": 0.09414,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: nv: Re-translate VNCR before injecting abort",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72278"
    },
    {
      "rank": 481,
      "cve_id": "CVE-2026-72342",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00193,
      "epss_percentile": 0.09359,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5e: Fix HV VHCA stats agent registration race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72342"
    },
    {
      "rank": 482,
      "cve_id": "CVE-2026-74331",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0019,
      "epss_percentile": 0.09004,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "firmware_loader: Fix recursive lock in device_cache_fw_images()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74331"
    },
    {
      "rank": 483,
      "cve_id": "CVE-2026-72279",
      "cvss_base": 9,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00189,
      "epss_percentile": 0.08852,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72279"
    },
    {
      "rank": 484,
      "cve_id": "CVE-2026-72008",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08914,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72008"
    },
    {
      "rank": 485,
      "cve_id": "CVE-2026-72031",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08916,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72031"
    },
    {
      "rank": 486,
      "cve_id": "CVE-2026-72145",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08913,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "platform/x86/intel/tpmi: use cleanup helpers in mem_write()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72145"
    },
    {
      "rank": 487,
      "cve_id": "CVE-2026-72173",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08915,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/proc/task_mmu: do not warn on seeing non-migration pmd entry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72173"
    },
    {
      "rank": 488,
      "cve_id": "CVE-2026-72184",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08915,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: fix hole runlist memory leak in insert range error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72184"
    },
    {
      "rank": 489,
      "cve_id": "CVE-2026-72187",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08913,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: avoid self-deadlock during inode eviction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72187"
    },
    {
      "rank": 490,
      "cve_id": "CVE-2026-72189",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08913,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: fail attrlist updates when the superblock is inactive",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72189"
    },
    {
      "rank": 491,
      "cve_id": "CVE-2026-72190",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08914,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: fix mrec_lock ABBA deadlock in rename",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72190"
    },
    {
      "rank": 492,
      "cve_id": "CVE-2026-72263",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08915,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SOF: topology: fix memory leak in snd_sof_load_topology",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72263"
    },
    {
      "rank": 493,
      "cve_id": "CVE-2026-72293",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08916,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: vsie: Add missing radix_tree_preload() in _gaccess_shadow_fault()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72293"
    },
    {
      "rank": 494,
      "cve_id": "CVE-2026-72313",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08914,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/fb-helper: Only consider active CRTCs for vblank sync",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72313"
    },
    {
      "rank": 495,
      "cve_id": "CVE-2026-72388",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08946,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72388"
    },
    {
      "rank": 496,
      "cve_id": "CVE-2026-72402",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08946,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Mask pseudo pointer values in verifier logs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72402"
    },
    {
      "rank": 497,
      "cve_id": "CVE-2026-72413",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08947,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: fix err_chunk memory leaks in INIT handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72413"
    },
    {
      "rank": 498,
      "cve_id": "CVE-2026-72456",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00189,
      "epss_percentile": 0.08917,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: release exe file resources on path failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72456"
    },
    {
      "rank": 499,
      "cve_id": "CVE-2026-72284",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00187,
      "epss_percentile": 0.08627,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72284"
    },
    {
      "rank": 500,
      "cve_id": "CVE-2026-72280",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00186,
      "epss_percentile": 0.08508,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72280"
    },
    {
      "rank": 501,
      "cve_id": "CVE-2026-72425",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00186,
      "epss_percentile": 0.08508,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72425"
    },
    {
      "rank": 502,
      "cve_id": "CVE-2026-72448",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00184,
      "epss_percentile": 0.08348,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-pf: Fix leak of SQ timestamp buffer on teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72448"
    },
    {
      "rank": 503,
      "cve_id": "CVE-2026-72289",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00182,
      "epss_percentile": 0.08145,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: vgic: Check the interrupt is still ours before migrating it",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72289"
    },
    {
      "rank": 504,
      "cve_id": "CVE-2026-72133",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00182,
      "epss_percentile": 0.08146,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "spi: uniphier: Fix completion initialization order before devm_request_irq()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72133"
    },
    {
      "rank": 505,
      "cve_id": "CVE-2026-72151",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00182,
      "epss_percentile": 0.08144,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72151"
    },
    {
      "rank": 506,
      "cve_id": "CVE-2026-72196",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00182,
      "epss_percentile": 0.08145,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72196"
    },
    {
      "rank": 507,
      "cve_id": "CVE-2026-72197",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00182,
      "epss_percentile": 0.08145,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: bound DeleteIndexEntryAllocation memmove length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72197"
    },
    {
      "rank": 508,
      "cve_id": "CVE-2026-72298",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00182,
      "epss_percentile": 0.08146,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72298"
    },
    {
      "rank": 509,
      "cve_id": "CVE-2026-74256",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00182,
      "epss_percentile": 0.08144,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74256"
    },
    {
      "rank": 510,
      "cve_id": "CVE-2026-74259",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00182,
      "epss_percentile": 0.08144,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cifs: remove all cifs files before kill super",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74259"
    },
    {
      "rank": 511,
      "cve_id": "CVE-2026-72483",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00181,
      "epss_percentile": 0.08017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72483"
    },
    {
      "rank": 512,
      "cve_id": "CVE-2026-72329",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0018,
      "epss_percentile": 0.0784,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/liquidio: drop cached VF pci_dev LUT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72329"
    },
    {
      "rank": 513,
      "cve_id": "CVE-2026-72412",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0018,
      "epss_percentile": 0.07823,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/mm: Fix handling of _PAGE_UNUSED pte bit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72412"
    },
    {
      "rank": 514,
      "cve_id": "CVE-2026-72146",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.0018,
      "epss_percentile": 0.07901,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dmaengine: sh: rz-dmac: Move interrupt request after everything is set up",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72146"
    },
    {
      "rank": 515,
      "cve_id": "CVE-2026-72426",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.0018,
      "epss_percentile": 0.07823,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Preserve pointer spill metadata during half-slot cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72426"
    },
    {
      "rank": 516,
      "cve_id": "CVE-2026-72487",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0018,
      "epss_percentile": 0.079,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "PCI: Check ROM header and data structure addr before accessing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72487"
    },
    {
      "rank": 517,
      "cve_id": "CVE-2026-72116",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0018,
      "epss_percentile": 0.07876,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: fix stale rx/tx ops after device removal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72116"
    },
    {
      "rank": 518,
      "cve_id": "CVE-2026-72424",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0018,
      "epss_percentile": 0.07899,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rtc: msc313: fix NULL deref in shared IRQ handler at probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72424"
    },
    {
      "rank": 519,
      "cve_id": "CVE-2026-72486",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0018,
      "epss_percentile": 0.07899,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mailbox: mtk-adsp: fix UAF during device teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72486"
    },
    {
      "rank": 520,
      "cve_id": "CVE-2026-72283",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00179,
      "epss_percentile": 0.07721,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72283"
    },
    {
      "rank": 521,
      "cve_id": "CVE-2026-72288",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00178,
      "epss_percentile": 0.07657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72288"
    },
    {
      "rank": 522,
      "cve_id": "CVE-2026-72495",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00178,
      "epss_percentile": 0.07657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/bnxt_re: Avoid repeated requests to allocate WC pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72495"
    },
    {
      "rank": 523,
      "cve_id": "CVE-2026-72085",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00177,
      "epss_percentile": 0.07584,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: xen: scsiback: Free unsubmitted command instead of double-putting it",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72085"
    },
    {
      "rank": 524,
      "cve_id": "CVE-2026-72262",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00177,
      "epss_percentile": 0.07527,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72262"
    },
    {
      "rank": 525,
      "cve_id": "CVE-2026-72302",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00177,
      "epss_percentile": 0.07582,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72302"
    },
    {
      "rank": 526,
      "cve_id": "CVE-2026-74402",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00177,
      "epss_percentile": 0.07554,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "crypto: atmel-sha204a - fix blocking and non-blocking rng logic",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74402"
    },
    {
      "rank": 527,
      "cve_id": "CVE-2026-74416",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00177,
      "epss_percentile": 0.07555,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/radeon: fix memory leak in radeon_ring_restore() on lock failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74416"
    },
    {
      "rank": 528,
      "cve_id": "CVE-2026-72061",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07423,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: sit: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72061"
    },
    {
      "rank": 529,
      "cve_id": "CVE-2026-72066",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07447,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cpu: hotplug: Bound hotplug states sysfs output",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72066"
    },
    {
      "rank": 530,
      "cve_id": "CVE-2026-72067",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07421,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cpu: hotplug: Preserve per instance callback errors",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72067"
    },
    {
      "rank": 531,
      "cve_id": "CVE-2026-72282",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07422,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72282"
    },
    {
      "rank": 532,
      "cve_id": "CVE-2026-72314",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07423,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72314"
    },
    {
      "rank": 533,
      "cve_id": "CVE-2026-72350",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07422,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: xt_u32: reject invalid shift counts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72350"
    },
    {
      "rank": 534,
      "cve_id": "CVE-2026-72371",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07422,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix the volume AFS_VOLUME_RM_TREE is set on",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72371"
    },
    {
      "rank": 535,
      "cve_id": "CVE-2026-72450",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07423,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: validate selector family and prefixlen during match",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72450"
    },
    {
      "rank": 536,
      "cve_id": "CVE-2026-68456",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00176,
      "epss_percentile": 0.07488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68456"
    },
    {
      "rank": 537,
      "cve_id": "CVE-2026-68460",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00176,
      "epss_percentile": 0.07488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: fix potential deadlock in f2fs_balance_fs()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68460"
    },
    {
      "rank": 538,
      "cve_id": "CVE-2026-74276",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00176,
      "epss_percentile": 0.07487,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "spi: xilinx: use FIFO occupancy register to determine buffer size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74276"
    },
    {
      "rank": 539,
      "cve_id": "CVE-2026-74320",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00176,
      "epss_percentile": 0.07489,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbdev: sm501fb: Fix buffer errors in OF binding code",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74320"
    },
    {
      "rank": 540,
      "cve_id": "CVE-2026-74348",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00176,
      "epss_percentile": 0.07488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2/dlm: require a ref for locking_state debugfs open",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74348"
    },
    {
      "rank": 541,
      "cve_id": "CVE-2026-74351",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00176,
      "epss_percentile": 0.07489,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: rebase copied fsdlm LVB pointers in locking_state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74351"
    },
    {
      "rank": 542,
      "cve_id": "CVE-2026-74395",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00176,
      "epss_percentile": 0.0749,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74395"
    },
    {
      "rank": 543,
      "cve_id": "CVE-2026-72286",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07335,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72286"
    },
    {
      "rank": 544,
      "cve_id": "CVE-2026-72027",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07334,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/compaction: handle free_pages_prepare() properly in compaction_free()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72027"
    },
    {
      "rank": 545,
      "cve_id": "CVE-2026-72340",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07333,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: microchip: vcap: fix races on the shared Super VCAP block",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72340"
    },
    {
      "rank": 546,
      "cve_id": "CVE-2026-72352",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07335,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: bpf: Fix hid_bpf_get_data() range check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72352"
    },
    {
      "rank": 547,
      "cve_id": "CVE-2026-72369",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07362,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "minix: avoid overflow in bitmap block count calculation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72369"
    },
    {
      "rank": 548,
      "cve_id": "CVE-2026-72372",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07337,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix lack of locking around modifications of net->cells_dyn_ino",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72372"
    },
    {
      "rank": 549,
      "cve_id": "CVE-2026-72452",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07336,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/i915: clear CRTC color blob pointers after dropping refs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72452"
    },
    {
      "rank": 550,
      "cve_id": "CVE-2026-72443",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00175,
      "epss_percentile": 0.07338,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72443"
    },
    {
      "rank": 551,
      "cve_id": "CVE-2026-72347",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00174,
      "epss_percentile": 0.07155,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: xt_connmark: reject invalid shift parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72347"
    },
    {
      "rank": 552,
      "cve_id": "CVE-2026-72154",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.07084,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "openrisc: Fix jump_label smp syncing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72154"
    },
    {
      "rank": 553,
      "cve_id": "CVE-2026-72357",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.07083,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72357"
    },
    {
      "rank": 554,
      "cve_id": "CVE-2026-72375",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.07113,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix reinitialisation of the inode, in particular ->lock_work",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72375"
    },
    {
      "rank": 555,
      "cve_id": "CVE-2026-72416",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.07063,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nft_compat: ebtables emulation must reject non-bridge targets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72416"
    },
    {
      "rank": 556,
      "cve_id": "CVE-2026-72111",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00172,
      "epss_percentile": 0.06917,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Reset register bounds before narrowing retval range in check_mem_access()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72111"
    },
    {
      "rank": 557,
      "cve_id": "CVE-2026-72225",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00172,
      "epss_percentile": 0.06989,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72225"
    },
    {
      "rank": 558,
      "cve_id": "CVE-2026-68459",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07003,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68459"
    },
    {
      "rank": 559,
      "cve_id": "CVE-2026-74274",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07009,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cxl/region: Fill first free targets[] slot during auto-discovery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74274"
    },
    {
      "rank": 560,
      "cve_id": "CVE-2026-74290",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07002,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: cls_flow: Dont expose folded kernel pointers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74290"
    },
    {
      "rank": 561,
      "cve_id": "CVE-2026-74327",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07004,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74327"
    },
    {
      "rank": 562,
      "cve_id": "CVE-2026-74329",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07002,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "watchdog: unregister PM notifier on watchdog unregister",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74329"
    },
    {
      "rank": 563,
      "cve_id": "CVE-2026-74339",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07005,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: Clear variable event pointer on read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74339"
    },
    {
      "rank": 564,
      "cve_id": "CVE-2026-74346",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07005,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/irdma: Fix OOB read during CQ MR registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74346"
    },
    {
      "rank": 565,
      "cve_id": "CVE-2026-74373",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07009,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid1,raid10: fix bio accounting for split md cloned bios",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74373"
    },
    {
      "rank": 566,
      "cve_id": "CVE-2026-74379",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07004,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dax/kmem: account for partial discontiguous resource upon removal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74379"
    },
    {
      "rank": 567,
      "cve_id": "CVE-2026-74381",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07004,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpu: host1x: Allow entries in BO caches to be freed",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74381"
    },
    {
      "rank": 568,
      "cve_id": "CVE-2026-74399",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00172,
      "epss_percentile": 0.07004,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "evm: terminate and bound the evm_xattrs read buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74399"
    },
    {
      "rank": 569,
      "cve_id": "CVE-2026-72360",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06849,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72360"
    },
    {
      "rank": 570,
      "cve_id": "CVE-2026-72072",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06862,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72072"
    },
    {
      "rank": 571,
      "cve_id": "CVE-2026-72335",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06863,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: MGMT: Fix adv monitor add failure cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72335"
    },
    {
      "rank": 572,
      "cve_id": "CVE-2026-72449",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06863,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72449"
    },
    {
      "rank": 573,
      "cve_id": "CVE-2026-72476",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06863,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dmaengine: Fix possible use after free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72476"
    },
    {
      "rank": 574,
      "cve_id": "CVE-2026-72175",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06906,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72175"
    },
    {
      "rank": 575,
      "cve_id": "CVE-2026-72364",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.0685,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix writeback error handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72364"
    },
    {
      "rank": 576,
      "cve_id": "CVE-2026-72071",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.06788,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tracing/user_events: Fix use-after-free in user_event_mm_dup()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72071"
    },
    {
      "rank": 577,
      "cve_id": "CVE-2026-74466",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.0017,
      "epss_percentile": 0.06777,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/zcrypt: Close speculative mem read possibility",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74466"
    },
    {
      "rank": 578,
      "cve_id": "CVE-2026-72183",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00169,
      "epss_percentile": 0.06711,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72183"
    },
    {
      "rank": 579,
      "cve_id": "CVE-2026-72395",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00169,
      "epss_percentile": 0.06711,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (pmbus) Fix passing events to regulator core",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72395"
    },
    {
      "rank": 580,
      "cve_id": "CVE-2026-72239",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00168,
      "epss_percentile": 0.06487,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "x86/virt/sev: Revert \"Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN\"",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72239"
    },
    {
      "rank": 581,
      "cve_id": "CVE-2026-72291",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00168,
      "epss_percentile": 0.06488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: Fix unlikely race in try_get_locked_pte()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72291"
    },
    {
      "rank": 582,
      "cve_id": "CVE-2026-72204",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: centalize $INDEX_ROOT header validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72204"
    },
    {
      "rank": 583,
      "cve_id": "CVE-2026-72080",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06614,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/resctrl: Fix use-after-free during unmount",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72080"
    },
    {
      "rank": 584,
      "cve_id": "CVE-2026-72093",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06614,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72093"
    },
    {
      "rank": 585,
      "cve_id": "CVE-2026-72328",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06614,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Fix potential amdxdna_umap lifetime race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72328"
    },
    {
      "rank": 586,
      "cve_id": "CVE-2026-74263",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06502,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: wwan: t7xx: check skb_clone in control TX",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74263"
    },
    {
      "rank": 587,
      "cve_id": "CVE-2026-74278",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06504,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: Fix kernel heap address leak in bounce_error_event()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74278"
    },
    {
      "rank": 588,
      "cve_id": "CVE-2026-74286",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06504,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: pfcp: allocate per-cpu tstats for PFCP netdevs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74286"
    },
    {
      "rank": 589,
      "cve_id": "CVE-2026-74301",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06508,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74301"
    },
    {
      "rank": 590,
      "cve_id": "CVE-2026-74303",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06503,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74303"
    },
    {
      "rank": 591,
      "cve_id": "CVE-2026-74308",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06504,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ext4: fix kernel BUG in ext4_write_inline_data_end",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74308"
    },
    {
      "rank": 592,
      "cve_id": "CVE-2026-74318",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06501,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "btrfs: fix deadlock cloning inline extent when using flushoncommit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74318"
    },
    {
      "rank": 593,
      "cve_id": "CVE-2026-74352",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06505,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74352"
    },
    {
      "rank": 594,
      "cve_id": "CVE-2026-74353",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06505,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: always resume_all after suspend_all",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74353"
    },
    {
      "rank": 595,
      "cve_id": "CVE-2026-74362",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06502,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ext2: fix ignored return value of generic_write_sync()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74362"
    },
    {
      "rank": 596,
      "cve_id": "CVE-2026-74386",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06591,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvmet-tcp: fix page fragment cache leak in error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74386"
    },
    {
      "rank": 597,
      "cve_id": "CVE-2026-74389",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06509,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/hns: Fix log flood after cmd_mbox failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74389"
    },
    {
      "rank": 598,
      "cve_id": "CVE-2026-74391",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06591,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tracing: Bound synthetic-field strings with seq_buf",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74391"
    },
    {
      "rank": 599,
      "cve_id": "CVE-2026-74393",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06509,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/syncobj: Fix memory leak in drm_syncobj_find_fence()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74393"
    },
    {
      "rank": 600,
      "cve_id": "CVE-2026-74441",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06536,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: ucsi: Fix race condition and ordering in port unregistration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74441"
    },
    {
      "rank": 601,
      "cve_id": "CVE-2026-74442",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.0653,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74442"
    },
    {
      "rank": 602,
      "cve_id": "CVE-2026-74445",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06537,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/vmwgfx: reject DX_BIND_QUERY without a DX context",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74445"
    },
    {
      "rank": 603,
      "cve_id": "CVE-2026-74448",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06537,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: fix QID bit leak in pqm_create_queue()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74448"
    },
    {
      "rank": 604,
      "cve_id": "CVE-2026-74455",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.0654,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: peak_usb: validate uCAN receive record lengths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74455"
    },
    {
      "rank": 605,
      "cve_id": "CVE-2026-74457",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.0653,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: peak_usb: add bounds check for USB channel index",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74457"
    },
    {
      "rank": 606,
      "cve_id": "CVE-2026-74458",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06531,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74458"
    },
    {
      "rank": 607,
      "cve_id": "CVE-2026-74459",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74459"
    },
    {
      "rank": 608,
      "cve_id": "CVE-2026-74460",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: ems_usb: validate CPC message lengths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74460"
    },
    {
      "rank": 609,
      "cve_id": "CVE-2026-74463",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06529,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74463"
    },
    {
      "rank": 610,
      "cve_id": "CVE-2026-74464",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06528,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: openvswitch: fix skb leak on flow key update failure during ct",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74464"
    },
    {
      "rank": 611,
      "cve_id": "CVE-2026-74468",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: pch: use raw_spinlock_t for the register lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74468"
    },
    {
      "rank": 612,
      "cve_id": "CVE-2026-74472",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06534,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74472"
    },
    {
      "rank": 613,
      "cve_id": "CVE-2026-74484",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06533,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binfmt_misc: don't let an 'F' entry pin its own instance",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74484"
    },
    {
      "rank": 614,
      "cve_id": "CVE-2026-74498",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06542,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74498"
    },
    {
      "rank": 615,
      "cve_id": "CVE-2026-74499",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06533,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74499"
    },
    {
      "rank": 616,
      "cve_id": "CVE-2026-74500",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06541,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: usb-audio: fix stack info leak in RME Digiface status",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74500"
    },
    {
      "rank": 617,
      "cve_id": "CVE-2026-74501",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06542,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: usb-audio: fix use-after-free in ump_to_endpoint()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74501"
    },
    {
      "rank": 618,
      "cve_id": "CVE-2026-74502",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06535,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: ump: fix double free of out_cvts on rawmidi error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74502"
    },
    {
      "rank": 619,
      "cve_id": "CVE-2026-74504",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06529,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: Fix division by zero in initialize_timer()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74504"
    },
    {
      "rank": 620,
      "cve_id": "CVE-2026-74505",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: 6fire: Fix UAF at error handling during probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74505"
    },
    {
      "rank": 621,
      "cve_id": "CVE-2026-74524",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.0654,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74524"
    },
    {
      "rank": 622,
      "cve_id": "CVE-2026-74525",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06538,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: sxgbe: free TX rings on RX allocation failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74525"
    },
    {
      "rank": 623,
      "cve_id": "CVE-2026-74532",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06529,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btintel: Validate length before parsing diagnostics TLV",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74532"
    },
    {
      "rank": 624,
      "cve_id": "CVE-2026-74536",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06535,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: fix leaking sk after socket release",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74536"
    },
    {
      "rank": 625,
      "cve_id": "CVE-2026-74543",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.0662,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74543"
    },
    {
      "rank": 626,
      "cve_id": "CVE-2026-74546",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06534,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74546"
    },
    {
      "rank": 627,
      "cve_id": "CVE-2026-74547",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.0662,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74547"
    },
    {
      "rank": 628,
      "cve_id": "CVE-2026-74552",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00168,
      "epss_percentile": 0.06542,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (lm90) Only report alarms if driver is ready",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74552"
    },
    {
      "rank": 629,
      "cve_id": "CVE-2026-72019",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00167,
      "epss_percentile": 0.06476,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "macsec: don't read an unset MAC header in macsec_encrypt()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72019"
    },
    {
      "rank": 630,
      "cve_id": "CVE-2026-72338",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00166,
      "epss_percentile": 0.06367,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72338"
    },
    {
      "rank": 631,
      "cve_id": "CVE-2026-72089",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00166,
      "epss_percentile": 0.06315,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/ivpu: Reject firmware log with size smaller than header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72089"
    },
    {
      "rank": 632,
      "cve_id": "CVE-2026-68463",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06318,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68463"
    },
    {
      "rank": 633,
      "cve_id": "CVE-2026-68464",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06322,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68464"
    },
    {
      "rank": 634,
      "cve_id": "CVE-2026-68465",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.0632,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68465"
    },
    {
      "rank": 635,
      "cve_id": "CVE-2026-72498",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06321,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/bnxt_re: Avoid displaying the kernel pointer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72498"
    },
    {
      "rank": 636,
      "cve_id": "CVE-2026-72501",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/bnxt_re: Initialize dpi variable to zero",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72501"
    },
    {
      "rank": 637,
      "cve_id": "CVE-2026-74307",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06319,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74307"
    },
    {
      "rank": 638,
      "cve_id": "CVE-2026-74322",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06317,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74322"
    },
    {
      "rank": 639,
      "cve_id": "CVE-2026-74324",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06316,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mt76: mt7925: validate skb length in testmode query",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74324"
    },
    {
      "rank": 640,
      "cve_id": "CVE-2026-74335",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06317,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix NULL pointer dereference in bpf_task_from_vpid()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74335"
    },
    {
      "rank": 641,
      "cve_id": "CVE-2026-74337",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06319,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix NMI/tracepoint re-entry deadlock on lru locks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74337"
    },
    {
      "rank": 642,
      "cve_id": "CVE-2026-74358",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.0632,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ext4: fix fast commit wait/wake bit mapping on 64-bit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74358"
    },
    {
      "rank": 643,
      "cve_id": "CVE-2026-74360",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06318,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Reject exclusive maps for bpf_map_elem iterators",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74360"
    },
    {
      "rank": 644,
      "cve_id": "CVE-2026-74366",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06319,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath12k: fix NULL deref in change_sta_links for unready link",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74366"
    },
    {
      "rank": 645,
      "cve_id": "CVE-2026-74372",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.0632,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74372"
    },
    {
      "rank": 646,
      "cve_id": "CVE-2026-74400",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06321,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74400"
    },
    {
      "rank": 647,
      "cve_id": "CVE-2026-74462",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06338,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "i2c: imx: mark I2C adapter when hardware is powered down",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74462"
    },
    {
      "rank": 648,
      "cve_id": "CVE-2026-74477",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06339,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "uprobes: Fix NULL pointer dereference in hprobe_expire()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74477"
    },
    {
      "rank": 649,
      "cve_id": "CVE-2026-74486",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06341,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binfmt_misc: use exe_file_deny_write_access() for the interpreter clone",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74486"
    },
    {
      "rank": 650,
      "cve_id": "CVE-2026-74487",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06342,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binfmt_misc: restore write access when removing an entry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74487"
    },
    {
      "rank": 651,
      "cve_id": "CVE-2026-74491",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06343,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "of/address: Fix NULL bus dereference in of_pci_range_parser_one()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74491"
    },
    {
      "rank": 652,
      "cve_id": "CVE-2026-74494",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06337,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ksmbd: reject repeated SMB2 NEGOTIATE requests",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74494"
    },
    {
      "rank": 653,
      "cve_id": "CVE-2026-74514",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06337,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: pci: Fix memory accounting for pinned/unpinned pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74514"
    },
    {
      "rank": 654,
      "cve_id": "CVE-2026-74559",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00166,
      "epss_percentile": 0.06341,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xsk: drain continuation descs after overflow in xsk_build_skb()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74559"
    },
    {
      "rank": 655,
      "cve_id": "CVE-2026-72134",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.06213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "spi: imx: reconfigure for PIO when DMA cannot be started",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72134"
    },
    {
      "rank": 656,
      "cve_id": "CVE-2026-72315",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.0624,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: fix busy dentry warning on unmount after DIO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72315"
    },
    {
      "rank": 657,
      "cve_id": "CVE-2026-72331",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.06214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Fix VMA access race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72331"
    },
    {
      "rank": 658,
      "cve_id": "CVE-2026-72344",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.06213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72344"
    },
    {
      "rank": 659,
      "cve_id": "CVE-2026-72345",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.06212,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5: LAG, Fix off-by-one in single-FDB error rollback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72345"
    },
    {
      "rank": 660,
      "cve_id": "CVE-2026-72358",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.06214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe/pt: prevent invalid cursor access for purged BOs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72358"
    },
    {
      "rank": 661,
      "cve_id": "CVE-2026-72368",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.06213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cachefiles: Fix double unlock in nomem_d_alloc error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72368"
    },
    {
      "rank": 662,
      "cve_id": "CVE-2026-74426",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00165,
      "epss_percentile": 0.06203,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: fix NULL pointer dereference in afs_get_tree()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74426"
    },
    {
      "rank": 663,
      "cve_id": "CVE-2026-72052",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06097,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72052"
    },
    {
      "rank": 664,
      "cve_id": "CVE-2026-72053",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06094,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ipip: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72053"
    },
    {
      "rank": 665,
      "cve_id": "CVE-2026-72054",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06098,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72054"
    },
    {
      "rank": 666,
      "cve_id": "CVE-2026-72055",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06098,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72055"
    },
    {
      "rank": 667,
      "cve_id": "CVE-2026-72136",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06096,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72136"
    },
    {
      "rank": 668,
      "cve_id": "CVE-2026-68474",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06095,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68474"
    },
    {
      "rank": 669,
      "cve_id": "CVE-2026-68479",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06096,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btrtl: validate firmware patch bounds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68479"
    },
    {
      "rank": 670,
      "cve_id": "CVE-2026-72005",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06092,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: rt2x00: avoid full teardown before work setup in probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72005"
    },
    {
      "rank": 671,
      "cve_id": "CVE-2026-72024",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06093,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mac802154: remove interfaces with RCU list deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72024"
    },
    {
      "rank": 672,
      "cve_id": "CVE-2026-72036",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06098,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72036"
    },
    {
      "rank": 673,
      "cve_id": "CVE-2026-72102",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06098,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm_early_create: fix freeing used table on dm_resume failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72102"
    },
    {
      "rank": 674,
      "cve_id": "CVE-2026-72105",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06092,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-log: fix a bitset_size overflow on 32bit machines",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72105"
    },
    {
      "rank": 675,
      "cve_id": "CVE-2026-72108",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06092,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm thin metadata: fix metadata snapshot consistency on commit failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72108"
    },
    {
      "rank": 676,
      "cve_id": "CVE-2026-72109",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06095,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: sparx5: unregister blocking notifier on init failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72109"
    },
    {
      "rank": 677,
      "cve_id": "CVE-2026-72120",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06099,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: add missing rcu list annotations and operations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72120"
    },
    {
      "rank": 678,
      "cve_id": "CVE-2026-72123",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06117,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72123"
    },
    {
      "rank": 679,
      "cve_id": "CVE-2026-72135",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06099,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tpm: Make the TPM character devices non-seekable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72135"
    },
    {
      "rank": 680,
      "cve_id": "CVE-2026-72164",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06093,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: avoid moving extents to occupied clusters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72164"
    },
    {
      "rank": 681,
      "cve_id": "CVE-2026-72165",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06093,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: rawnand: fix condition in 'nand_select_target()'",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72165"
    },
    {
      "rank": 682,
      "cve_id": "CVE-2026-72171",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06095,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: slram: remove failed entries from the device list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72171"
    },
    {
      "rank": 683,
      "cve_id": "CVE-2026-72181",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06115,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mips: sched: Fix CPUMASK_OFFSTACK memory corruption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72181"
    },
    {
      "rank": 684,
      "cve_id": "CVE-2026-72195",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06091,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: bound attr_off in UpdateResidentValue against data_off",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72195"
    },
    {
      "rank": 685,
      "cve_id": "CVE-2026-72250",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06097,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72250"
    },
    {
      "rank": 686,
      "cve_id": "CVE-2026-72255",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06116,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72255"
    },
    {
      "rank": 687,
      "cve_id": "CVE-2026-72261",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06096,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72261"
    },
    {
      "rank": 688,
      "cve_id": "CVE-2026-72301",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06093,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72301"
    },
    {
      "rank": 689,
      "cve_id": "CVE-2026-72400",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06095,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "seg6: validate SRH length before reading fixed fields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72400"
    },
    {
      "rank": 690,
      "cve_id": "CVE-2026-72406",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.0609,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: sungem: fix probe error cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72406"
    },
    {
      "rank": 691,
      "cve_id": "CVE-2026-72419",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.0609,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72419"
    },
    {
      "rank": 692,
      "cve_id": "CVE-2026-72435",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.0609,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72435"
    },
    {
      "rank": 693,
      "cve_id": "CVE-2026-74283",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06094,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: require net admin for TIPCv2 netlink mutators",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74283"
    },
    {
      "rank": 694,
      "cve_id": "CVE-2026-72045",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72045"
    },
    {
      "rank": 695,
      "cve_id": "CVE-2026-72051",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06021,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72051"
    },
    {
      "rank": 696,
      "cve_id": "CVE-2026-72294",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06021,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72294"
    },
    {
      "rank": 697,
      "cve_id": "CVE-2026-72012",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tracing/osnoise: Call synchronize_rcu() when unregistering",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72012"
    },
    {
      "rank": 698,
      "cve_id": "CVE-2026-72018",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dibs: loopback: validate offset and size in move_data()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72018"
    },
    {
      "rank": 699,
      "cve_id": "CVE-2026-72034",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.0602,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fhandle: reject detached mounts in capable_wrt_mount()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72034"
    },
    {
      "rank": 700,
      "cve_id": "CVE-2026-72110",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf,fork: wipe ->bpf_storage before bailouts that access it",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72110"
    },
    {
      "rank": 701,
      "cve_id": "CVE-2026-72113",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06039,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: add missing device refcount for CAN filter removal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72113"
    },
    {
      "rank": 702,
      "cve_id": "CVE-2026-72114",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: validate frame length in bcm_rx_setup() for RTR replies",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72114"
    },
    {
      "rank": 703,
      "cve_id": "CVE-2026-72119",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06037,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: extend bcm_tx_lock usage for data and timer updates",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72119"
    },
    {
      "rank": 704,
      "cve_id": "CVE-2026-72144",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "platform/x86: dell-laptop: fix missing cleanups in init error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72144"
    },
    {
      "rank": 705,
      "cve_id": "CVE-2026-72170",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.0604,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "9p: skip nlink update in cacheless mode to fix WARN_ON",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72170"
    },
    {
      "rank": 706,
      "cve_id": "CVE-2026-72172",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06039,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72172"
    },
    {
      "rank": 707,
      "cve_id": "CVE-2026-72244",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.0602,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpu/buddy: bail out of try_harder when alignment cannot be honoured",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72244"
    },
    {
      "rank": 708,
      "cve_id": "CVE-2026-72252",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06039,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nft_set_pipapo: don't leak bad clone into future transaction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72252"
    },
    {
      "rank": 709,
      "cve_id": "CVE-2026-72304",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.0602,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72304"
    },
    {
      "rank": 710,
      "cve_id": "CVE-2026-72410",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06021,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-af: Validate NIX maximum LFs correctly",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72410"
    },
    {
      "rank": 711,
      "cve_id": "CVE-2026-72434",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00163,
      "epss_percentile": 0.06038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: ipset: make sure gc is properly stopped",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72434"
    },
    {
      "rank": 712,
      "cve_id": "CVE-2026-72162",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00162,
      "epss_percentile": 0.05868,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72162"
    },
    {
      "rank": 713,
      "cve_id": "CVE-2026-72198",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00162,
      "epss_percentile": 0.05867,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ntfs: reject non-resident records for resident-only attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72198"
    },
    {
      "rank": 714,
      "cve_id": "CVE-2026-72390",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00162,
      "epss_percentile": 0.05942,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72390"
    },
    {
      "rank": 715,
      "cve_id": "CVE-2026-72488",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00162,
      "epss_percentile": 0.05867,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "soundwire: fix bug in sdw_add_element_group_count found by syzkaller",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72488"
    },
    {
      "rank": 716,
      "cve_id": "CVE-2026-72439",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00162,
      "epss_percentile": 0.0594,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid10: fix writes_pending leak on write request failures",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72439"
    },
    {
      "rank": 717,
      "cve_id": "CVE-2026-72490",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00162,
      "epss_percentile": 0.0594,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72490"
    },
    {
      "rank": 718,
      "cve_id": "CVE-2026-72295",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00161,
      "epss_percentile": 0.05848,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "LoongArch: KVM: Validate irqchip index in irqfd routing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72295"
    },
    {
      "rank": 719,
      "cve_id": "CVE-2026-72500",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00161,
      "epss_percentile": 0.05847,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/bnxt_re: Free SRQ toggle page after firmware teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72500"
    },
    {
      "rank": 720,
      "cve_id": "CVE-2026-72243",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00161,
      "epss_percentile": 0.0576,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "selinux: check connect-related permissions on TCP Fast Open",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72243"
    },
    {
      "rank": 721,
      "cve_id": "CVE-2026-72009",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00161,
      "epss_percentile": 0.05848,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72009"
    },
    {
      "rank": 722,
      "cve_id": "CVE-2026-72042",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00161,
      "epss_percentile": 0.05849,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipmi: Fix user refcount underflow in event delivery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72042"
    },
    {
      "rank": 723,
      "cve_id": "CVE-2026-72095",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00161,
      "epss_percentile": 0.05849,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dma-fence: Make dma_fence_dedup_array() robust against 0-count input",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72095"
    },
    {
      "rank": 724,
      "cve_id": "CVE-2026-74264",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00161,
      "epss_percentile": 0.05848,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: watchdog: fix refcount tracking races",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74264"
    },
    {
      "rank": 725,
      "cve_id": "CVE-2026-74424",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00161,
      "epss_percentile": 0.0582,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fbcon: fix NULL pointer dereference for a console without vc_data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74424"
    },
    {
      "rank": 726,
      "cve_id": "CVE-2026-72389",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0016,
      "epss_percentile": 0.05646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bridge: stp: Fix a potential use-after-free when deleting a bridge",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72389"
    },
    {
      "rank": 727,
      "cve_id": "CVE-2026-72122",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.0016,
      "epss_percentile": 0.05679,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72122"
    },
    {
      "rank": 728,
      "cve_id": "CVE-2026-72043",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0016,
      "epss_percentile": 0.05746,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72043"
    },
    {
      "rank": 729,
      "cve_id": "CVE-2026-72049",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0016,
      "epss_percentile": 0.05745,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ieee802154: admin-gate legacy LLSEC dump operations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72049"
    },
    {
      "rank": 730,
      "cve_id": "CVE-2026-72125",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00159,
      "epss_percentile": 0.05571,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72125"
    },
    {
      "rank": 731,
      "cve_id": "CVE-2026-72126",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00159,
      "epss_percentile": 0.0562,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: isotp: use unconditional synchronize_rcu() in isotp_release()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72126"
    },
    {
      "rank": 732,
      "cve_id": "CVE-2026-72103",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00159,
      "epss_percentile": 0.05587,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm: avoid leaking the caller's thread keyring via the table device file",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72103"
    },
    {
      "rank": 733,
      "cve_id": "CVE-2026-72213",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00159,
      "epss_percentile": 0.05622,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72213"
    },
    {
      "rank": 734,
      "cve_id": "CVE-2026-72297",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00159,
      "epss_percentile": 0.05629,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: atm: reject out-of-range traffic classes in QoS validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72297"
    },
    {
      "rank": 735,
      "cve_id": "CVE-2026-72383",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00157,
      "epss_percentile": 0.05399,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: fix addr_wq_timer race in sctp_free_addr_wq()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72383"
    },
    {
      "rank": 736,
      "cve_id": "CVE-2026-72143",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00157,
      "epss_percentile": 0.05434,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "platform/x86: ISST: Restore SST-PP control to all domains",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72143"
    },
    {
      "rank": 737,
      "cve_id": "CVE-2026-74553",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00157,
      "epss_percentile": 0.05385,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (nct6775-core) Fix number of temperature registers for NCT6116",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74553"
    },
    {
      "rank": 738,
      "cve_id": "CVE-2026-74577",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00157,
      "epss_percentile": 0.05385,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mpls: initialize rtm_tos in mpls_getroute()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74577"
    },
    {
      "rank": 739,
      "cve_id": "CVE-2026-72232",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00156,
      "epss_percentile": 0.05263,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "batman-adv: ensure minimal ethernet header on TX",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72232"
    },
    {
      "rank": 740,
      "cve_id": "CVE-2026-74392",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00156,
      "epss_percentile": 0.05267,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm: limit target bio polling to one shot",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74392"
    },
    {
      "rank": 741,
      "cve_id": "CVE-2026-74432",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00156,
      "epss_percentile": 0.05327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74432"
    },
    {
      "rank": 742,
      "cve_id": "CVE-2026-74555",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00156,
      "epss_percentile": 0.0534,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74555"
    },
    {
      "rank": 743,
      "cve_id": "CVE-2026-74566",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00156,
      "epss_percentile": 0.05339,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "keys: make keyring key-chunk byte order agree with keyring_diff_objects()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74566"
    },
    {
      "rank": 744,
      "cve_id": "CVE-2026-18500",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00155,
      "epss_percentile": 0.05195,
      "kev": false,
      "kev_due_at": null,
      "vendor": "@fastify/jwt",
      "product": "@fastify/jwt",
      "cwe": "CWE-347",
      "title": "@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18500"
    },
    {
      "rank": 745,
      "cve_id": "CVE-2026-68455",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05217,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "liveupdate: validate session type before performing operation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68455"
    },
    {
      "rank": 746,
      "cve_id": "CVE-2026-68468",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: virt-concat: free duplicate generated name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68468"
    },
    {
      "rank": 747,
      "cve_id": "CVE-2026-74272",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05216,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cxl/region: Resolve region deletion races",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74272"
    },
    {
      "rank": 748,
      "cve_id": "CVE-2026-74273",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05217,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cxl/region: Block region delete during region creation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74273"
    },
    {
      "rank": 749,
      "cve_id": "CVE-2026-74291",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05212,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: topology: Check PCM and DAI name strings before use",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74291"
    },
    {
      "rank": 750,
      "cve_id": "CVE-2026-74298",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05211,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/core: Fix FRMR set pinned push error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74298"
    },
    {
      "rank": 751,
      "cve_id": "CVE-2026-74299",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05211,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/core: Fix FRMR aging push to queue error flow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74299"
    },
    {
      "rank": 752,
      "cve_id": "CVE-2026-74304",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05217,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74304"
    },
    {
      "rank": 753,
      "cve_id": "CVE-2026-74319",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "btrfs: zoned: fix deadlock waiting for ticket during data relocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74319"
    },
    {
      "rank": 754,
      "cve_id": "CVE-2026-74326",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05215,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mt76: mt7921: fix resource leak in probe error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74326"
    },
    {
      "rank": 755,
      "cve_id": "CVE-2026-74336",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05215,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: bound S1G TIM PVB walk to the TIM element",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74336"
    },
    {
      "rank": 756,
      "cve_id": "CVE-2026-74342",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05211,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "kernfs: link kn to its parent before the LSM init hook",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74342"
    },
    {
      "rank": 757,
      "cve_id": "CVE-2026-74368",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05215,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74368"
    },
    {
      "rank": 758,
      "cve_id": "CVE-2026-74369",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74369"
    },
    {
      "rank": 759,
      "cve_id": "CVE-2026-74370",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05211,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "liveupdate: fix TOCTOU race in luo_session_retrieve()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74370"
    },
    {
      "rank": 760,
      "cve_id": "CVE-2026-74375",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05216,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "md/raid1,raid10: fix deadlock in read error recovery path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74375"
    },
    {
      "rank": 761,
      "cve_id": "CVE-2026-74414",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05216,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hfsplus: Remove the duplicate attr inode dirty marking action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74414"
    },
    {
      "rank": 762,
      "cve_id": "CVE-2026-74415",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05212,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "spi: atcspi200: fix use-after-free when driver unbind",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74415"
    },
    {
      "rank": 763,
      "cve_id": "CVE-2026-74420",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05175,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74420"
    },
    {
      "rank": 764,
      "cve_id": "CVE-2026-74421",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05175,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/rockchip: dw_dp: Switch to drmm_kzalloc()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74421"
    },
    {
      "rank": 765,
      "cve_id": "CVE-2026-74483",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05242,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binfmt_misc: don't leak the user namespace when the mount fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74483"
    },
    {
      "rank": 766,
      "cve_id": "CVE-2026-74526",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05243,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74526"
    },
    {
      "rank": 767,
      "cve_id": "CVE-2026-74542",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05242,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: Fix folio_queue ENOMEM in writeback by adding a mempool",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74542"
    },
    {
      "rank": 768,
      "cve_id": "CVE-2026-74560",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00155,
      "epss_percentile": 0.05152,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74560"
    },
    {
      "rank": 769,
      "cve_id": "CVE-2026-72423",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05085,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Guard conntrack opts error writes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72423"
    },
    {
      "rank": 770,
      "cve_id": "CVE-2026-74277",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05073,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74277"
    },
    {
      "rank": 771,
      "cve_id": "CVE-2026-72478",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05087,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: add bounds check to run_get_highest_vcn()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72478"
    },
    {
      "rank": 772,
      "cve_id": "CVE-2026-72312",
      "cvss_base": 7.9,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05102,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-af: fix VF bringup affecting PF promiscuous state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72312"
    },
    {
      "rank": 773,
      "cve_id": "CVE-2026-68473",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05073,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68473"
    },
    {
      "rank": 774,
      "cve_id": "CVE-2026-72090",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05074,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Use caller client for debug BO sync",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72090"
    },
    {
      "rank": 775,
      "cve_id": "CVE-2026-72112",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05075,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "io_uring/bpf-ops: reject re-registration of an already-bound ops",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72112"
    },
    {
      "rank": 776,
      "cve_id": "CVE-2026-72285",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05075,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: TDX: Reject concurrent change to CPUID entry count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72285"
    },
    {
      "rank": 777,
      "cve_id": "CVE-2026-72303",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05074,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SOF: ipc4-control: Validate notification payload size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72303"
    },
    {
      "rank": 778,
      "cve_id": "CVE-2026-72404",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05086,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72404"
    },
    {
      "rank": 779,
      "cve_id": "CVE-2026-72411",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05072,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72411"
    },
    {
      "rank": 780,
      "cve_id": "CVE-2026-72485",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05086,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "coresight: platform: defer connection counter increment until alloc succeeds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72485"
    },
    {
      "rank": 781,
      "cve_id": "CVE-2026-74258",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05073,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Guard __get_user acesss with access_ok for uprobe_multi data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74258"
    },
    {
      "rank": 782,
      "cve_id": "CVE-2026-74260",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00154,
      "epss_percentile": 0.05073,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74260"
    },
    {
      "rank": 783,
      "cve_id": "CVE-2026-74418",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00154,
      "epss_percentile": 0.05038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dma-fence: Fix potential tracepoint null pointer dereferences",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74418"
    },
    {
      "rank": 784,
      "cve_id": "CVE-2026-74423",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00154,
      "epss_percentile": 0.05133,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Fix leak when pinning ubuf pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74423"
    },
    {
      "rank": 785,
      "cve_id": "CVE-2026-74437",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00154,
      "epss_percentile": 0.05133,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74437"
    },
    {
      "rank": 786,
      "cve_id": "CVE-2026-72446",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00153,
      "epss_percentile": 0.05024,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: usb-audio: qcom: reject stream disable with no active interface",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72446"
    },
    {
      "rank": 787,
      "cve_id": "CVE-2026-18807",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00152,
      "epss_percentile": 0.04905,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "ECS",
      "cwe": "CWE-862",
      "title": "ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18807"
    },
    {
      "rank": 788,
      "cve_id": "CVE-2026-72397",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00151,
      "epss_percentile": 0.0484,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72397"
    },
    {
      "rank": 789,
      "cve_id": "CVE-2026-72489",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.0015,
      "epss_percentile": 0.04694,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "staging: nvec: fix use-after-free in nvec_rx_completed()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72489"
    },
    {
      "rank": 790,
      "cve_id": "CVE-2026-72415",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0015,
      "epss_percentile": 0.04689,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SDCA: Validate written enum value in ge_put_enum_double()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72415"
    },
    {
      "rank": 791,
      "cve_id": "CVE-2026-74519",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00145,
      "epss_percentile": 0.04309,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "pinctrl: devicetree: don't free uninitialized dev_name on error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74519"
    },
    {
      "rank": 792,
      "cve_id": "CVE-2026-74422",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00145,
      "epss_percentile": 0.04302,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/rockchip: inno-hdmi: Switch to drmm_kzalloc()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74422"
    },
    {
      "rank": 793,
      "cve_id": "CVE-2026-74558",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00145,
      "epss_percentile": 0.04276,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xsk: reclaim invalid Tx descriptors in ZC batch path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74558"
    },
    {
      "rank": 794,
      "cve_id": "CVE-2026-74571",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00145,
      "epss_percentile": 0.04323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "btrfs: skip global block reserve accounting for rescue mounts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74571"
    },
    {
      "rank": 795,
      "cve_id": "CVE-2026-74332",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00144,
      "epss_percentile": 0.04158,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: amd: acp-sdw-sof: Bound DAI link iteration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74332"
    },
    {
      "rank": 796,
      "cve_id": "CVE-2026-74333",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00142,
      "epss_percentile": 0.04005,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: amd: acp-sdw-legacy: Bound DAI link iteration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74333"
    },
    {
      "rank": 797,
      "cve_id": "CVE-2026-74383",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00142,
      "epss_percentile": 0.04047,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74383"
    },
    {
      "rank": 798,
      "cve_id": "CVE-2026-74492",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00142,
      "epss_percentile": 0.03985,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: ipset: do not update comments from kernel-side hash adds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74492"
    },
    {
      "rank": 799,
      "cve_id": "CVE-2026-74497",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00142,
      "epss_percentile": 0.03984,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: usb-audio: Clamp frame size in implicit-feedback mode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74497"
    },
    {
      "rank": 800,
      "cve_id": "CVE-2026-74378",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00142,
      "epss_percentile": 0.04043,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74378"
    },
    {
      "rank": 801,
      "cve_id": "CVE-2026-74404",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00142,
      "epss_percentile": 0.04029,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74404"
    },
    {
      "rank": 802,
      "cve_id": "CVE-2026-74452",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00142,
      "epss_percentile": 0.04008,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/panthor: reject firmware sections with oversized data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74452"
    },
    {
      "rank": 803,
      "cve_id": "CVE-2026-72287",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00141,
      "epss_percentile": 0.03965,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into \"normal\" checks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72287"
    },
    {
      "rank": 804,
      "cve_id": "CVE-2026-74310",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0014,
      "epss_percentile": 0.038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vhost/net: complete zerocopy ubufs only once",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74310"
    },
    {
      "rank": 805,
      "cve_id": "CVE-2026-72482",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0014,
      "epss_percentile": 0.03808,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpib: fix double decrement of descriptor_busy in command_ioctl()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72482"
    },
    {
      "rank": 806,
      "cve_id": "CVE-2026-74510",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00139,
      "epss_percentile": 0.03748,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: mgmt: fix UAF in pair command cancellation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74510"
    },
    {
      "rank": 807,
      "cve_id": "CVE-2026-74461",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00138,
      "epss_percentile": 0.03641,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "i2c: imx: Cancel hrtimer before clearing slave pointer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74461"
    },
    {
      "rank": 808,
      "cve_id": "CVE-2026-72444",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00138,
      "epss_percentile": 0.03706,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "flow_dissector: check device type before reading ETH_ADDRS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72444"
    },
    {
      "rank": 809,
      "cve_id": "CVE-2026-72459",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00138,
      "epss_percentile": 0.03705,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: aa_label_alloc use aa_label_free on alloc failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72459"
    },
    {
      "rank": 810,
      "cve_id": "CVE-2026-72470",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00138,
      "epss_percentile": 0.03647,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: resize log->one_page_buf when adopting on-disk page size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72470"
    },
    {
      "rank": 811,
      "cve_id": "CVE-2026-72480",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00138,
      "epss_percentile": 0.03705,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72480"
    },
    {
      "rank": 812,
      "cve_id": "CVE-2026-72462",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00136,
      "epss_percentile": 0.03536,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: fix race in unix socket mediation when peer_path is used",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72462"
    },
    {
      "rank": 813,
      "cve_id": "CVE-2026-72461",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00136,
      "epss_percentile": 0.03537,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: fix refcount leak when updating the sk_ctx",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72461"
    },
    {
      "rank": 814,
      "cve_id": "CVE-2026-74262",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00136,
      "epss_percentile": 0.03506,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "kcm: use WRITE_ONCE() when changing lower socket callbacks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74262"
    },
    {
      "rank": 815,
      "cve_id": "CVE-2026-74439",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00134,
      "epss_percentile": 0.03347,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74439"
    },
    {
      "rank": 816,
      "cve_id": "CVE-2026-74516",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00134,
      "epss_percentile": 0.03377,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74516"
    },
    {
      "rank": 817,
      "cve_id": "CVE-2026-72405",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00134,
      "epss_percentile": 0.03372,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72405"
    },
    {
      "rank": 818,
      "cve_id": "CVE-2026-72427",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00134,
      "epss_percentile": 0.03374,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix effective prog array index with BPF_F_PREORDER",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72427"
    },
    {
      "rank": 819,
      "cve_id": "CVE-2026-73047",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00133,
      "epss_percentile": 0.03285,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-200",
      "title": "siyuan before v3.7.4 Server-Side Template Injection via attribute-view",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73047"
    },
    {
      "rank": 820,
      "cve_id": "CVE-2026-74438",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00133,
      "epss_percentile": 0.03261,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "crypto: sun4i-ss - Remove insecure and unused rng_alg",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74438"
    },
    {
      "rank": 821,
      "cve_id": "CVE-2026-14230",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00133,
      "epss_percentile": 0.03276,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "ECS",
      "cwe": "CWE-79",
      "title": "ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14230"
    },
    {
      "rank": 822,
      "cve_id": "CVE-2026-74355",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00132,
      "epss_percentile": 0.03248,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommu/vt-d: Fix RB-tree corruption in probe error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74355"
    },
    {
      "rank": 823,
      "cve_id": "CVE-2026-74481",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00132,
      "epss_percentile": 0.03198,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/page_reporting: use system_freezable_wq to fix UAF during suspend",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74481"
    },
    {
      "rank": 824,
      "cve_id": "CVE-2026-74365",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00132,
      "epss_percentile": 0.03216,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvdimm/btt: Handle preemption in BTT lane acquisition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74365"
    },
    {
      "rank": 825,
      "cve_id": "CVE-2026-74364",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00132,
      "epss_percentile": 0.0323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Reject exclusive maps as inner maps in map-in-map",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74364"
    },
    {
      "rank": 826,
      "cve_id": "CVE-2026-74517",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00131,
      "epss_percentile": 0.03163,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74517"
    },
    {
      "rank": 827,
      "cve_id": "CVE-2026-74573",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00131,
      "epss_percentile": 0.03117,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74573"
    },
    {
      "rank": 828,
      "cve_id": "CVE-2026-74275",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00131,
      "epss_percentile": 0.03154,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74275"
    },
    {
      "rank": 829,
      "cve_id": "CVE-2026-72460",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00131,
      "epss_percentile": 0.03158,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: check label build before no_new_privs test",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72460"
    },
    {
      "rank": 830,
      "cve_id": "CVE-2026-68466",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02996,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68466"
    },
    {
      "rank": 831,
      "cve_id": "CVE-2026-74380",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02995,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpu: host1x: Fix iommu_map_sgtable() return value check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74380"
    },
    {
      "rank": 832,
      "cve_id": "CVE-2026-74443",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02947,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/vmwgfx: bound DMA command body size against suffix pointer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74443"
    },
    {
      "rank": 833,
      "cve_id": "CVE-2026-74515",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02949,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: pci: Reject adapter interrupt forwarding if already enabled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74515"
    },
    {
      "rank": 834,
      "cve_id": "CVE-2026-68461",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02995,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "device property: initialize the remaining fields of fwnode_handle in fwnode_init()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68461"
    },
    {
      "rank": 835,
      "cve_id": "CVE-2026-68467",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02994,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: mchp23k256: use SPI match data for chip caps",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68467"
    },
    {
      "rank": 836,
      "cve_id": "CVE-2026-72454",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.03007,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72454"
    },
    {
      "rank": 837,
      "cve_id": "CVE-2026-74288",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02997,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74288"
    },
    {
      "rank": 838,
      "cve_id": "CVE-2026-74293",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02995,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: fsl: fsl_audmix: Validate written enum values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74293"
    },
    {
      "rank": 839,
      "cve_id": "CVE-2026-74296",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02994,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74296"
    },
    {
      "rank": 840,
      "cve_id": "CVE-2026-74297",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02998,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/mlx5: Fix undefined shift of user RQ WQE size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74297"
    },
    {
      "rank": 841,
      "cve_id": "CVE-2026-74305",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02998,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Tighten cgroup storage cookie checks for prog arrays",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74305"
    },
    {
      "rank": 842,
      "cve_id": "CVE-2026-74312",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02998,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vhost/vdpa: validate virtqueue index in mmap and fault paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74312"
    },
    {
      "rank": 843,
      "cve_id": "CVE-2026-74314",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02978,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Cancel special fields on map value recycle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74314"
    },
    {
      "rank": 844,
      "cve_id": "CVE-2026-74330",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02997,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "configfs: fix lockless traversals of ->s_children",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74330"
    },
    {
      "rank": 845,
      "cve_id": "CVE-2026-74377",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02996,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74377"
    },
    {
      "rank": 846,
      "cve_id": "CVE-2026-74390",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.03044,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74390"
    },
    {
      "rank": 847,
      "cve_id": "CVE-2026-74397",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02988,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74397"
    },
    {
      "rank": 848,
      "cve_id": "CVE-2026-74440",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02946,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe: Wait on external BO kernel fences in exec IOCTL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74440"
    },
    {
      "rank": 849,
      "cve_id": "CVE-2026-74444",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02954,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/vmwgfx: validate DRAW_PRIMITIVES header size before division",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74444"
    },
    {
      "rank": 850,
      "cve_id": "CVE-2026-74446",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02944,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: hold event_mutex while checkpointing CRIU events",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74446"
    },
    {
      "rank": 851,
      "cve_id": "CVE-2026-74447",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02945,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74447"
    },
    {
      "rank": 852,
      "cve_id": "CVE-2026-74451",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02955,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/panthor: validate firmware interface structure sizes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74451"
    },
    {
      "rank": 853,
      "cve_id": "CVE-2026-74453",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02949,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/vc4: Zero the tile state data array before each BIN job",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74453"
    },
    {
      "rank": 854,
      "cve_id": "CVE-2026-74454",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02958,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74454"
    },
    {
      "rank": 855,
      "cve_id": "CVE-2026-74456",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02942,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74456"
    },
    {
      "rank": 856,
      "cve_id": "CVE-2026-74467",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02943,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/qeth: Check CAP_NET_ADMIN for private ioctls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74467"
    },
    {
      "rank": 857,
      "cve_id": "CVE-2026-74470",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02944,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74470"
    },
    {
      "rank": 858,
      "cve_id": "CVE-2026-74503",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02955,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74503"
    },
    {
      "rank": 859,
      "cve_id": "CVE-2026-74549",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.03002,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (nct6775-core) Prevent access to unsupported weight registers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74549"
    },
    {
      "rank": 860,
      "cve_id": "CVE-2026-74551",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02942,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hwmon: (nzxt-smart2) DMA-align output buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74551"
    },
    {
      "rank": 861,
      "cve_id": "CVE-2026-72455",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.03009,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "apparmor: fix uninitialised pointer passed to audit_log_untrustedstring()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72455"
    },
    {
      "rank": 862,
      "cve_id": "CVE-2026-74270",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00128,
      "epss_percentile": 0.02933,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "handshake: Require admin permission for DONE command",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74270"
    },
    {
      "rank": 863,
      "cve_id": "CVE-2026-74306",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00128,
      "epss_percentile": 0.02932,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vfio/qat: fix f_pos race in qat_vf_resume_write()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74306"
    },
    {
      "rank": 864,
      "cve_id": "CVE-2026-74338",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00128,
      "epss_percentile": 0.02856,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Reject sleepable BPF_LSM_CGROUP programs at load time",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74338"
    },
    {
      "rank": 865,
      "cve_id": "CVE-2026-74405",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00128,
      "epss_percentile": 0.02842,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "OPP: Fix race between OPP addition and lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74405"
    },
    {
      "rank": 866,
      "cve_id": "CVE-2026-74520",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02807,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommu/iommufd: Fix IOPF group ownership UAF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74520"
    },
    {
      "rank": 867,
      "cve_id": "CVE-2026-68458",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02789,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binder: cache secctx size before release zeroes it",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68458"
    },
    {
      "rank": 868,
      "cve_id": "CVE-2026-74311",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.0279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "virtio: rtc: tear down old virtqueues before restore",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74311"
    },
    {
      "rank": 869,
      "cve_id": "CVE-2026-74325",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02789,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74325"
    },
    {
      "rank": 870,
      "cve_id": "CVE-2026-74344",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.0279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Clear rb node linkage when freeing bpf_rb_root",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74344"
    },
    {
      "rank": 871,
      "cve_id": "CVE-2026-74371",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02788,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74371"
    },
    {
      "rank": 872,
      "cve_id": "CVE-2026-74292",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.02664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: tegra: tegra210_ahub: Validate written enum value",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74292"
    },
    {
      "rank": 873,
      "cve_id": "CVE-2026-74295",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.02665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: codecs: hdac_hdmi: Validate written enum value",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74295"
    },
    {
      "rank": 874,
      "cve_id": "CVE-2026-74349",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.02698,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ocfs2: reject FITRIM ranges shorter than a cluster",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74349"
    },
    {
      "rank": 875,
      "cve_id": "CVE-2026-74313",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vduse: hold vduse_lock across IDR lookup in open path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74313"
    },
    {
      "rank": 876,
      "cve_id": "CVE-2026-74302",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02617,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_core: Fix UAF in hci_unregister_dev()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74302"
    },
    {
      "rank": 877,
      "cve_id": "CVE-2026-74359",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02658,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "configfs_lookup(): don't leave ->s_dentry dangling on failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74359"
    },
    {
      "rank": 878,
      "cve_id": "CVE-2026-74363",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02658,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74363"
    },
    {
      "rank": 879,
      "cve_id": "CVE-2026-74387",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: midi: Serialize output teardown with event_input",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74387"
    },
    {
      "rank": 880,
      "cve_id": "CVE-2026-74465",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02629,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: openvswitch: fix potential UAF on meter attach failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74465"
    },
    {
      "rank": 881,
      "cve_id": "CVE-2026-74471",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.0263,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tracing: Check return value of __register_event() in trace_module_add_events()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74471"
    },
    {
      "rank": 882,
      "cve_id": "CVE-2026-74482",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.0263,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74482"
    },
    {
      "rank": 883,
      "cve_id": "CVE-2026-74512",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02632,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "audit: fix potential use-after-free in audit_del_rule()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74512"
    },
    {
      "rank": 884,
      "cve_id": "CVE-2026-74518",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02632,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/hugetlb: fix list corruption in allocate_file_region_entries()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74518"
    },
    {
      "rank": 885,
      "cve_id": "CVE-2026-74548",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.02626,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "forcedeth: fix UAF of txrx_stats in nv_remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74548"
    },
    {
      "rank": 886,
      "cve_id": "CVE-2026-74485",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.0264,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binfmt_misc: reject a flag character as the field delimiter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74485"
    },
    {
      "rank": 887,
      "cve_id": "CVE-2026-72496",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00124,
      "epss_percentile": 0.02565,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/bnxt_re: Proper rollback if the ioremap fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72496"
    },
    {
      "rank": 888,
      "cve_id": "CVE-2026-74257",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00124,
      "epss_percentile": 0.02523,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sockmap: Fix use-after-free in udp_bpf_recvmsg()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74257"
    },
    {
      "rank": 889,
      "cve_id": "CVE-2026-74388",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00124,
      "epss_percentile": 0.02522,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74388"
    },
    {
      "rank": 890,
      "cve_id": "CVE-2026-74479",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00124,
      "epss_percentile": 0.02531,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: pktgen: fix proc entry use-after-free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74479"
    },
    {
      "rank": 891,
      "cve_id": "CVE-2026-74506",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00124,
      "epss_percentile": 0.0253,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "afs: Fix UAF when sending a message",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74506"
    },
    {
      "rank": 892,
      "cve_id": "CVE-2026-74513",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00124,
      "epss_percentile": 0.02532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74513"
    },
    {
      "rank": 893,
      "cve_id": "CVE-2026-19891",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00124,
      "epss_percentile": 0.02544,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-WLC100",
      "cwe": "CWE-311",
      "title": "TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19891"
    },
    {
      "rank": 894,
      "cve_id": "CVE-2026-74568",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00122,
      "epss_percentile": 0.02389,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: vgic: Fix race between LPI release and re-registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74568"
    },
    {
      "rank": 895,
      "cve_id": "CVE-2026-74574",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00122,
      "epss_percentile": 0.02399,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74574"
    },
    {
      "rank": 896,
      "cve_id": "CVE-2026-74403",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00121,
      "epss_percentile": 0.02263,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "crypto: ccp - Check for page allocation failure correctly in TIO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74403"
    },
    {
      "rank": 897,
      "cve_id": "CVE-2026-74544",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00121,
      "epss_percentile": 0.02272,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74544"
    },
    {
      "rank": 898,
      "cve_id": "CVE-2026-72497",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02185,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/bnxt_re: Add a max slot check for SQ",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72497"
    },
    {
      "rank": 899,
      "cve_id": "CVE-2026-72499",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/bnxt_re: Free CQ toggle page after firmware teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72499"
    },
    {
      "rank": 900,
      "cve_id": "CVE-2026-74285",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: Stop leased rxq before uninstalling its memory provider",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74285"
    },
    {
      "rank": 901,
      "cve_id": "CVE-2026-74328",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02185,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommufd: Destroy the pages content after detaching from dmabuf",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74328"
    },
    {
      "rank": 902,
      "cve_id": "CVE-2026-74527",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02205,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-af: Block VFs from clobbering special CGX PKIND state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74527"
    },
    {
      "rank": 903,
      "cve_id": "CVE-2026-68462",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Reject negative const offsets for buffer pointers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68462"
    },
    {
      "rank": 904,
      "cve_id": "CVE-2026-74289",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.0219,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74289"
    },
    {
      "rank": 905,
      "cve_id": "CVE-2026-74317",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02186,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ixgbe: do not configure xps for XDP queues",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74317"
    },
    {
      "rank": 906,
      "cve_id": "CVE-2026-74334",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02188,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/nldev: Fix locking when accessing mr->pd",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74334"
    },
    {
      "rank": 907,
      "cve_id": "CVE-2026-74343",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "kernfs: fix xattr race condition with multiple superblocks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74343"
    },
    {
      "rank": 908,
      "cve_id": "CVE-2026-74347",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74347"
    },
    {
      "rank": 909,
      "cve_id": "CVE-2026-74354",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02185,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Take mmap_lock in zap_pages()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74354"
    },
    {
      "rank": 910,
      "cve_id": "CVE-2026-74357",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02186,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74357"
    },
    {
      "rank": 911,
      "cve_id": "CVE-2026-74367",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath12k: fix inconsistent arvif state in vdev_create error paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74367"
    },
    {
      "rank": 912,
      "cve_id": "CVE-2026-74417",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02136,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/radeon: fix integer overflow in radeon_align_pitch()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74417"
    },
    {
      "rank": 913,
      "cve_id": "CVE-2026-74449",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02208,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74449"
    },
    {
      "rank": 914,
      "cve_id": "CVE-2026-74450",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02206,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amd/pm: fix pptable use-after-free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74450"
    },
    {
      "rank": 915,
      "cve_id": "CVE-2026-74496",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02208,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fou: Fix use-after-free in fou_create()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74496"
    },
    {
      "rank": 916,
      "cve_id": "CVE-2026-74529",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02209,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74529"
    },
    {
      "rank": 917,
      "cve_id": "CVE-2026-74563",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00117,
      "epss_percentile": 0.01941,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74563"
    },
    {
      "rank": 918,
      "cve_id": "CVE-2026-74564",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00117,
      "epss_percentile": 0.01972,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74564"
    },
    {
      "rank": 919,
      "cve_id": "CVE-2026-74567",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00117,
      "epss_percentile": 0.01922,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "keys: fix out-of-bounds read in keyring_get_key_chunk()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74567"
    },
    {
      "rank": 920,
      "cve_id": "CVE-2026-74565",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00116,
      "epss_percentile": 0.0191,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_tables: make nft_object rhltable per table",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74565"
    },
    {
      "rank": 921,
      "cve_id": "CVE-2026-74294",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00114,
      "epss_percentile": 0.01769,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: meson: aiu: Validate written enum values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74294"
    },
    {
      "rank": 922,
      "cve_id": "CVE-2026-74562",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00113,
      "epss_percentile": 0.01626,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nexthop: take nh->lock for f6i_list walks in replace check and notify",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74562"
    },
    {
      "rank": 923,
      "cve_id": "CVE-2026-74561",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00112,
      "epss_percentile": 0.01594,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74561"
    },
    {
      "rank": 924,
      "cve_id": "CVE-2026-74419",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.0011,
      "epss_percentile": 0.01468,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Adjust size for copy_to_user()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74419"
    },
    {
      "rank": 925,
      "cve_id": "CVE-2026-18165",
      "cvss_base": 4.2,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00099,
      "epss_percentile": 0.00932,
      "kev": false,
      "kev_due_at": null,
      "vendor": "@fastify/oauth2",
      "product": "@fastify/oauth2",
      "cwe": "CWE-352",
      "title": "@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18165"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2020-0618",
      "detail": "EXPLOIT PUBLISHED — CVE-2020-0618 (Microsoft SQL Server). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2021-4034",
      "detail": "EXPLOIT PUBLISHED — CVE-2021-4034 (polkit). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-13712",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-13712 (Unknown Divi). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-15384",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-15384 (Unknown Manual Image Crop). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-17533",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-17533 (Unknown All-in-One WP Migration and Backup). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-18653",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-18653 (Unknown WP Directory Kit). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19613",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19613 (Unknown ECS). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19711",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19711 (Unknown Premium Packages). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19712",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19712 (Unknown Masteriyo LMS). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19714",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19714 (Unknown Simple JWT Login). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19717",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19717 (Unknown CatFolders Document Gallery & PDF Library). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19725",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19725 (Unknown WPvivid — Backup, Migration & Staging). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19726",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19726 (Unknown Visualizer). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19728",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19728 (Unknown Extra Product Options Builder for WooCommerce). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19922",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19922 (code-projects Online Shopping System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19925",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19925 (SourceCodester Stock Management System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19927",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19927 (OpenBoxes). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19930",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19930 (Dolibarr). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19933",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19933 (DefaultFuction Customer-Relationship-Management-In-C-Project). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19958",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19958 (iatsiuk pptr-mcp). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19961",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19961 (Edimax EW-7478APC). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19962",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19962 (Edimax EW-7478APC). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19963",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19963 (Edimax EW-7478APC). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-19964",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-19964 (Jij-Inc Jij-MCP-Server). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-69414",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-69414 (Microsoft Malware Protection Engine). Public exploit reference added."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-20349",
      "detail": "DUE DATE PASSED — CVE-2026-20349 (Cisco Secure Firewall Adaptive Security Appliance (ASA) Software). CISA remediation deadline was August 14, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-72898",
      "detail": "DUE DATE PASSED — CVE-2026-72898 (Metabase). CISA remediation deadline was August 14, 2026; still in catalog."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2020-0618",
      "detail": "RESCORED — CVE-2020-0618 (Microsoft SQL Server). CVSS 9.8 → 8.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2022-21882",
      "detail": "RESCORED — CVE-2022-21882 (Microsoft Windows 10 Version 1809). CVSS 7 → 7.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2022-49363",
      "detail": "RESCORED — CVE-2022-49363 (Linux). CVSS 7.8 → 5.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2022-49519",
      "detail": "RESCORED — CVE-2022-49519 (Linux). CVSS 8.8 → 7.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2022-49770",
      "detail": "RESCORED — CVE-2022-49770 (Linux). CVSS 9.8 → 7.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2022-49974",
      "detail": "RESCORED — CVE-2022-49974 (Linux). CVSS 8.8 → 5.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2022-50393",
      "detail": "RESCORED — CVE-2022-50393 (Linux). CVSS 7.8 → 5.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2022-50442",
      "detail": "RESCORED — CVE-2022-50442 (Linux). CVSS 8.4 → 7.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2023-32249",
      "detail": "RESCORED — CVE-2023-32249 (Linux). CVSS 9.1 → 5.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2023-3865",
      "detail": "RESCORED — CVE-2023-3865 (Linux). CVSS 8.1 → 7.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2023-3867",
      "detail": "RESCORED — CVE-2023-3867 (Linux). CVSS 9.1 → 7.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2023-4130",
      "detail": "RESCORED — CVE-2023-4130 (Linux). CVSS 8.1 → 5.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2023-52440",
      "detail": "RESCORED — CVE-2023-52440 (Linux). CVSS 9.8 → 7.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2023-52441",
      "detail": "RESCORED — CVE-2023-52441 (Linux). CVSS 9.1 → 7.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2023-52480",
      "detail": "RESCORED — CVE-2023-52480 (Linux). CVSS 9.8 → 7 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-32590",
      "detail": "RESCORED — CVE-2026-32590 (Red Hat mirror registry for Red Hat OpenShift 2.0). CVSS 7.1 → 8.8 (NVD)."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49360",
      "detail": "ENRICHED — CVE-2022-49360 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49361",
      "detail": "ENRICHED — CVE-2022-49361 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49364",
      "detail": "ENRICHED — CVE-2022-49364 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49380",
      "detail": "ENRICHED — CVE-2022-49380 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49518",
      "detail": "ENRICHED — CVE-2022-49518 (Linux). Received CVSS 7.1 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49520",
      "detail": "ENRICHED — CVE-2022-49520 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49528",
      "detail": "ENRICHED — CVE-2022-49528 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49543",
      "detail": "ENRICHED — CVE-2022-49543 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49833",
      "detail": "ENRICHED — CVE-2022-49833 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49966",
      "detail": "ENRICHED — CVE-2022-49966 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49969",
      "detail": "ENRICHED — CVE-2022-49969 (Linux). Received CVSS 7.8 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-49983",
      "detail": "ENRICHED — CVE-2022-49983 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50009",
      "detail": "ENRICHED — CVE-2022-50009 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50013",
      "detail": "ENRICHED — CVE-2022-50013 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50015",
      "detail": "ENRICHED — CVE-2022-50015 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50016",
      "detail": "ENRICHED — CVE-2022-50016 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50026",
      "detail": "ENRICHED — CVE-2022-50026 (Linux). Received CVSS 7.1 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50034",
      "detail": "ENRICHED — CVE-2022-50034 (Linux). Received CVSS 7.8 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50151",
      "detail": "ENRICHED — CVE-2022-50151 (Linux). Received CVSS 7.8 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50206",
      "detail": "ENRICHED — CVE-2022-50206 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50223",
      "detail": "ENRICHED — CVE-2022-50223 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50256",
      "detail": "ENRICHED — CVE-2022-50256 (Linux). Received CVSS 7.8 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50262",
      "detail": "ENRICHED — CVE-2022-50262 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50273",
      "detail": "ENRICHED — CVE-2022-50273 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50316",
      "detail": "ENRICHED — CVE-2022-50316 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50336",
      "detail": "ENRICHED — CVE-2022-50336 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50451",
      "detail": "ENRICHED — CVE-2022-50451 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50479",
      "detail": "ENRICHED — CVE-2022-50479 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50527",
      "detail": "ENRICHED — CVE-2022-50527 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2022-50535",
      "detail": "ENRICHED — CVE-2022-50535 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2023-32246",
      "detail": "ENRICHED — CVE-2023-32246 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2023-52485",
      "detail": "ENRICHED — CVE-2023-52485 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2023-52506",
      "detail": "ENRICHED — CVE-2023-52506 (Linux). Received CVSS 5.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2023-52583",
      "detail": "ENRICHED — CVE-2023-52583 (Linux). Received CVSS 5.5 and CPE data from NVD."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}