{
  "day": "2026-10-18",
  "boundary": "UTC calendar day",
  "published_count": 552,
  "by_severity": {
    "CRITICAL": 5,
    "HIGH": 21,
    "MEDIUM": 58,
    "LOW": 18
  },
  "kev_count": 0,
  "exploit_reference_count": 2,
  "awaiting_enrichment_count": 450,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-111876",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00624,
      "epss_percentile": 0.48858,
      "kev": false,
      "kev_due_at": null,
      "vendor": "alexpasmantier",
      "product": "television",
      "cwe": "CWE-74",
      "title": "alexpasmantier television entry.rs output command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111876"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-111869",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00543,
      "epss_percentile": 0.4438,
      "kev": false,
      "kev_due_at": null,
      "vendor": "makeplane",
      "product": "plane",
      "cwe": "CWE-20",
      "title": "makeplane API Endpoint reliance on untrusted inputs in a security decision",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111869"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-111874",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00484,
      "epss_percentile": 0.40327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "OpenCATS",
      "cwe": "CWE-307",
      "title": "OpenCATS Career Portal CareersUI.php processLogin excessive authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111874"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-111870",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00429,
      "epss_percentile": 0.35705,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsmeravitejak",
      "product": "Online-Examination-System",
      "cwe": "CWE-287",
      "title": "itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111870"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-111942",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00273,
      "epss_percentile": 0.18365,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hrisikeshpal",
      "product": "Blood_Bank_Management_System",
      "cwe": "CWE-79",
      "title": "hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111942"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-111871",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00263,
      "epss_percentile": 0.16929,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsmeravitejak",
      "product": "Online-Examination-System",
      "cwe": "CWE-74",
      "title": "itsmeravitejak Online-Examination-System subjectsdb.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111871"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-111872",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00263,
      "epss_percentile": 0.16937,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsmeravitejak",
      "product": "Online-Examination-System",
      "cwe": "CWE-74",
      "title": "itsmeravitejak Online-Examination-System database.php getreport sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111872"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-111873",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00263,
      "epss_percentile": 0.16937,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsmeravitejak",
      "product": "Online-Examination-System",
      "cwe": "CWE-74",
      "title": "itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111873"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-111877",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00263,
      "epss_percentile": 0.16969,
      "kev": false,
      "kev_due_at": null,
      "vendor": "dext34-morgan",
      "product": "Books4Cash",
      "cwe": "CWE-79",
      "title": "dext34-morgan Books4Cash search.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111877"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-111997",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00253,
      "epss_percentile": 0.15636,
      "kev": false,
      "kev_due_at": null,
      "vendor": "beaugunderson",
      "product": "ip-address",
      "cwe": "CWE-1333",
      "title": "ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111997"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-111868",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00247,
      "epss_percentile": 0.1484,
      "kev": false,
      "kev_due_at": null,
      "vendor": "datastax",
      "product": "pulsar-jms",
      "cwe": "CWE-20",
      "title": "datastax pulsar-jms PulsarObjectMessage.java decode deserialization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111868"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-111875",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00227,
      "epss_percentile": 0.12488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "David-Crty",
      "product": "Databasement",
      "cwe": "CWE-862",
      "title": "David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111875"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-110981",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00172,
      "epss_percentile": 0.06192,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP Photo Album Plus",
      "cwe": "CWE-79",
      "title": "WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110981"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-96534",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00162,
      "epss_percentile": 0.05044,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Modern Events Calendar Lite",
      "cwe": "CWE-89",
      "title": "Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96534"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-110033",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00152,
      "epss_percentile": 0.03957,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Salon Booking System",
      "cwe": "CWE-79",
      "title": "Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110033"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-110069",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00139,
      "epss_percentile": 0.02954,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Modern Events Calendar Lite",
      "cwe": "CWE-200",
      "title": "Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110069"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-109937",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00136,
      "epss_percentile": 0.02733,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Otter Blocks",
      "cwe": "CWE-601",
      "title": "Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109937"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-87844",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00136,
      "epss_percentile": 0.02733,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "PickPlugins Product Designer for WooCommerce",
      "cwe": "CWE-862",
      "title": "Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87844"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-110031",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00132,
      "epss_percentile": 0.02474,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Salon Booking System",
      "cwe": "CWE-269",
      "title": "Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110031"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-110070",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02498,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Modern Events Calendar Lite",
      "cwe": "CWE-639",
      "title": "Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110070"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-110032",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02475,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Salon Booking System",
      "cwe": "CWE-863",
      "title": "Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110032"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-110026",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02474,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Tasty Recipes Lite",
      "cwe": "CWE-862",
      "title": "Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110026"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-110976",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02474,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "AI Engine",
      "cwe": "CWE-862",
      "title": "AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110976"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-111041",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02474,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "AI Engine",
      "cwe": "CWE-862",
      "title": "AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111041"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-110035",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02475,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Salon Booking System",
      "cwe": "CWE-284",
      "title": "Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110035"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-110372",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Brainstorm Force",
      "product": "OttoKit",
      "cwe": "CWE-266",
      "title": "WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110372"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-110886",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "QuantumCloud",
      "product": "Conversational Forms for ChatBot",
      "cwe": "CWE-502",
      "title": "WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110886"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-109894",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Arraytics",
      "product": "Booktics",
      "cwe": "CWE-89",
      "title": "WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109894"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-111998",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vanus-labs",
      "product": "vanus",
      "cwe": "CWE-1392",
      "title": "Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111998"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-112005",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "clidey",
      "product": "whodb",
      "cwe": "CWE-22",
      "title": "WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112005"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-107436",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WP Chill",
      "product": "Strong Testimonials",
      "cwe": "CWE-502",
      "title": "WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107436"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-111999",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vanus-labs",
      "product": "vanus",
      "cwe": "CWE-306",
      "title": "Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111999"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-112021",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "grunfink",
      "product": "snac2",
      "cwe": "CWE-122",
      "title": "snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112021"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-112001",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ProjectSend",
      "product": "ProjectSend",
      "cwe": "CWE-863",
      "title": "ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112001"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-110895",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "DevItems",
      "product": "Support Genix",
      "cwe": "CWE-89",
      "title": "WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110895"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-112006",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenTelemetry",
      "product": "opentelemetry-exporter-otlp-proto-http",
      "cwe": "CWE-295",
      "title": "OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112006"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-112051",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "xorbitsai",
      "product": "inference",
      "cwe": "CWE-22",
      "title": "Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112051"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-110373",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Hamid Alinia",
      "product": "Login with phone number",
      "cwe": "CWE-266",
      "title": "WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110373"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-112015",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "omnigent-ai",
      "product": "omnigent",
      "cwe": "CWE-22",
      "title": "Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112015"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-112002",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ProjectSend",
      "product": "ProjectSend",
      "cwe": "CWE-620",
      "title": "ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112002"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-110383",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WP E-Signature",
      "product": "Electronic Signature Add-on for Fluent Forms",
      "cwe": "CWE-639",
      "title": "WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110383"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-112018",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jkuhlmann",
      "product": "cgltf",
      "cwe": "CWE-787",
      "title": "cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112018"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-112000",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vanus-labs",
      "product": "vanus",
      "cwe": "CWE-862",
      "title": "Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112000"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-108485",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeGrill",
      "product": "eStore",
      "cwe": "CWE-79",
      "title": "WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108485"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-109895",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Arraytics",
      "product": "Booktics",
      "cwe": "CWE-79",
      "title": "WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109895"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-110382",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NSquared",
      "product": "Simply Schedule Appointments",
      "cwe": "CWE-79",
      "title": "WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110382"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-110897",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IdeaBox Creations",
      "product": "PowerPack Lite for Beaver Builder",
      "cwe": "CWE-79",
      "title": "WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110897"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-112017",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-89",
      "title": "JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112017"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-112007",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "schismtracker",
      "product": "Schism Tracker",
      "cwe": "CWE-787",
      "title": "Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112007"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-112008",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "libmng",
      "product": "libmng",
      "cwe": "CWE-131",
      "title": "libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112008"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-112016",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR256CN",
      "cwe": "CWE-306",
      "title": "Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112016"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-112019",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jkuhlmann",
      "product": "cgltf",
      "cwe": "CWE-125",
      "title": "cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112019"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-112020",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "lvandeve",
      "product": "lodepng",
      "cwe": "CWE-125",
      "title": "LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112020"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-112048",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SpatiaLite",
      "product": "libspatialite",
      "cwe": "CWE-789",
      "title": "libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112048"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-112052",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SpatiaLite",
      "product": "libspatialite",
      "cwe": "CWE-190",
      "title": "libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112052"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-112059",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "libLAS",
      "product": "libLAS",
      "cwe": "CWE-787",
      "title": "libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112059"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-110024",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "@fastify/jwt",
      "product": "@fastify/jwt",
      "cwe": "CWE-613",
      "title": "@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110024"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-112009",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "icculus",
      "product": "smpeg",
      "cwe": "CWE-125",
      "title": "smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112009"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-112010",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "icculus",
      "product": "smpeg",
      "cwe": "CWE-191",
      "title": "smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112010"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-112013",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "True Audio",
      "product": "libtta",
      "cwe": "CWE-369",
      "title": "libtta through 2.3 Divide by Zero via tta_decoder_init_get_info",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112013"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-112014",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "netease-youdao",
      "product": "LobsterAI",
      "cwe": "CWE-321",
      "title": "LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112014"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-112046",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OW2",
      "product": "ASM",
      "cwe": "CWE-835",
      "title": "OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112046"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-112053",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Schroedinger",
      "product": "schroedinger",
      "cwe": "CWE-125",
      "title": "Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112053"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-112054",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Schroedinger",
      "product": "schroedinger",
      "cwe": "CWE-369",
      "title": "Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112054"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-112055",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wvWare",
      "product": "wv",
      "cwe": "CWE-125",
      "title": "wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112055"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-112056",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wvWare",
      "product": "wv",
      "cwe": "CWE-125",
      "title": "wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112056"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-112057",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VideoLAN",
      "product": "libdvdnav",
      "cwe": "CWE-125",
      "title": "libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112057"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-112058",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VideoLAN",
      "product": "libdvdnav",
      "cwe": "CWE-125",
      "title": "libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112058"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-112049",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Vita3K",
      "product": "Vita3K",
      "cwe": "CWE-22",
      "title": "Vita3K before build 4187 Path Traversal via VPK Package Installation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112049"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-110365",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPExperts",
      "product": "Advanced File Manager",
      "cwe": "CWE-862",
      "title": "WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110365"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-110880",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Kit",
      "product": "Kit (formerly ConvertKit)",
      "cwe": "CWE-862",
      "title": "WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110880"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-110883",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VideoWhisper.com",
      "product": "2Way VideoCalls and Random Chat",
      "cwe": "CWE-305",
      "title": "WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110883"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-110885",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "HivePress",
      "product": "HivePress",
      "cwe": "CWE-94",
      "title": "WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110885"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-112060",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RTMPDump",
      "product": "librtmp",
      "cwe": "CWE-787",
      "title": "librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112060"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-112003",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ProjectSend",
      "product": "ProjectSend",
      "cwe": "CWE-180",
      "title": "ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112003"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-112062",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "lwIP",
      "product": "lwIP",
      "cwe": "CWE-121",
      "title": "lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112062"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-112063",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "strophe",
      "product": "libstrophe",
      "cwe": "CWE-121",
      "title": "libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112063"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-112011",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "True Audio",
      "product": "libtta",
      "cwe": "CWE-190",
      "title": "libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112011"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-111990",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kishan0725",
      "product": "Hospital Management System",
      "cwe": "CWE-74",
      "title": "kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111990"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-112025",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "light0011",
      "product": "cms",
      "cwe": "CWE-266",
      "title": "light0011 cms Captcha Validation UserController.class.php access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112025"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-112027",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "light0011",
      "product": "cms",
      "cwe": "CWE-200",
      "title": "light0011 cms Uploadify check-exists.php file_exists file information disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112027"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-112028",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "light0011",
      "product": "cms",
      "cwe": "CWE-840",
      "title": "light0011 cms Vote VoteController.class.php logic error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112028"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-111988",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "dyad-sh",
      "product": "dyad",
      "cwe": "CWE-352",
      "title": "dyad-sh dyad OAuth Callback cross-site request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111988"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-112030",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "diem-project",
      "product": "diem",
      "cwe": "CWE-1393",
      "title": "diem-project diem dmDataLoad.php default password",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112030"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-112047",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OneUptime",
      "product": "oneuptime",
      "cwe": "CWE-863",
      "title": "OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112047"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-112061",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RTMPDump",
      "product": "librtmp",
      "cwe": "CWE-125",
      "title": "librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112061"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-112031",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Chamilo",
      "product": "LMS",
      "cwe": "CWE-79",
      "title": "Chamilo LMS Ticket TicketManager.php addProject cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112031"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-112032",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "aircheng-org",
      "product": "iWebShop-5",
      "cwe": "CWE-89",
      "title": "aircheng-org iWebShop-5 util.php search sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112032"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-112111",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bootstrap Shortcodes project",
      "product": "Bootstrap Shortcodes",
      "cwe": "CWE-79",
      "title": "The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112111"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-112012",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "True Audio",
      "product": "libtta",
      "cwe": "CWE-787",
      "title": "libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112012"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-112026",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "light0011",
      "product": "cms",
      "cwe": "CWE-326",
      "title": "light0011 cms UserModel.class.php sha1 weak password hash",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112026"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-112004",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "teableio",
      "product": "teable",
      "cwe": "CWE-639",
      "title": "Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112004"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-112050",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gitify-app",
      "product": "gitify",
      "cwe": "CWE-352",
      "title": "Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112050"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-112112",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nic",
      "product": "BIRD",
      "cwe": "CWE-1284",
      "title": "An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112112"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-111984",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AUTOMATIC1111",
      "product": "stable-diffusion-webui",
      "cwe": "CWE-79",
      "title": "AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111984"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-111985",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AUTOMATIC1111",
      "product": "stable-diffusion-webui",
      "cwe": "CWE-400",
      "title": "AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111985"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-111986",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AUTOMATIC1111",
      "product": "stable-diffusion-webui",
      "cwe": "CWE-74",
      "title": "AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111986"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-111987",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AUTOMATIC1111",
      "product": "stable-diffusion-webui",
      "cwe": "CWE-79",
      "title": "AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111987"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-111991",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WongKinYiu",
      "product": "yolov9",
      "cwe": "CWE-74",
      "title": "WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111991"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-111992",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsmeravitejak",
      "product": "Online-Examination-System",
      "cwe": "CWE-74",
      "title": "itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111992"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-111993",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Soarkey",
      "product": "StudentManagement",
      "cwe": "CWE-310",
      "title": "Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111993"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-112029",
      "cvss_base": 1.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "diem-project",
      "product": "diem",
      "cwe": "CWE-326",
      "title": "diem-project diem SHA1 PluginDmUser.class.php weak password hash",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112029"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2024-4457",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WSO2",
      "product": "WSO2 Enterprise Integrator",
      "cwe": "CWE-78",
      "title": "Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4457"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-78497",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": null,
      "product": "JQ-Lite",
      "cwe": "CWE-95",
      "title": "JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78497"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-97204",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-863",
      "title": "Gitea label deletion across repository and organization IDs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97204"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-97859",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-862",
      "title": "Gitea API disclosure of private user social graph, keys and stars",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97859"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-98433",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98433"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-98434",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sysctl: Check range in proc_dointvec_ms_jiffies_minmax",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98434"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-98435",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "EDAC/altera: Use parent device for devres in altr_portb_setup()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98435"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-98436",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/amdxdna: Disable device buffer exporting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98436"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-98437",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "media: qcom: iris: fix runtime PM reference leaks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98437"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-98438",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mptcp: options: fix uninit-value in mptcp_write_data_fin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98438"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-98439",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb/server: cancel async requests when closing connection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98439"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-98440",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98440"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-98441",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: act_ct: avoid modifying shared unconfirmed ct entry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98441"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-98442",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: act_ct: fix helper UAF due to extensions realloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98442"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-98443",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfs: fix cursor and pointer handling when recovering iunlink buckets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98443"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-98444",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfs: drop dquot flush lock when we can't find a buffer to flush",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98444"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-98445",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfs: don't let memory failures leak blocks and kill repairs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98445"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-98446",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfs: don't let hidden_space go negative in xfs_metafile_resv_init",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98446"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-98447",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98447"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-98448",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xfs: release orphanage dir inode if chown fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98448"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-98449",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: delete compound mids on send failure before unlock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98449"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-98450",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: close completed creates on compound wait errors",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98450"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-98451",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: use finish_no_open() for non-regular inodes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98451"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-98452",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: clean up failed cached directory opens",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98452"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-98453",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: close handle after create-context parsing failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98453"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-98454",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: fix create context out-of-bounds reads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98454"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-98455",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98455"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-98456",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: mgmt: fix race in read_unconf_index_list()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98456"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-98457",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: L2CAP: validate frame length before control and FCS access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98457"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-98458",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: release unused CIS holds after channel attach",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98458"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-98459",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: ISO: balance the parent hold in hci_bind_bis()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98459"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-98460",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sock: reject out-of-range OCF values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98460"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-98461",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sock: validate event length before filtering",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98461"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-98462",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_conn: fix CIS hold ownership on reuse",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98462"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-98463",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98463"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-98464",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RISC-V: KVM: Synchronize hrtimer callback during teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98464"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-98465",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RISC-V: KVM: Serialize IMSIC attributes with vCPU migration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98465"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-98466",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: Transfer the hyp stack pages out of the host stage-2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98466"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-98467",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98467"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-98468",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: Fix spurious warning for benign stage 2 teardown race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98468"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-98469",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: Fix AArch32 DBGBXVR<n> handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98469"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-98470",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98470"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-98471",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Do cache maintenance on the source VM during intra-host migration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98471"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-98472",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98472"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-98473",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98473"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-98474",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/pci: Fix missing device lock in zpci_report_status()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98474"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-98475",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/cmf: Fix virtual vs physical address confusion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98475"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-98476",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98476"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2026-98477",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98477"
    },
    {
      "rank": 152,
      "cve_id": "CVE-2026-98478",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: ufs: core: Keep internal commands dispatchable during error handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98478"
    },
    {
      "rank": 153,
      "cve_id": "CVE-2026-98479",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: libiscsi_tcp: Check the data direction of a Data-In PDU",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98479"
    },
    {
      "rank": 154,
      "cve_id": "CVE-2026-98480",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: trf7970a: power down on startup RX gain failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98480"
    },
    {
      "rank": 155,
      "cve_id": "CVE-2026-98481",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: port100: reject frames whose declared length exceeds the received data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98481"
    },
    {
      "rank": 156,
      "cve_id": "CVE-2026-98482",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98482"
    },
    {
      "rank": 157,
      "cve_id": "CVE-2026-98483",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: fix use-after-free in nfc_get_local_general_bytes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98483"
    },
    {
      "rank": 158,
      "cve_id": "CVE-2026-98484",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nf_tables: skip expired catchall elements on insert and delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98484"
    },
    {
      "rank": 159,
      "cve_id": "CVE-2026-98485",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98485"
    },
    {
      "rank": 160,
      "cve_id": "CVE-2026-98486",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ena: fix MMIO read buffer leak on probe failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98486"
    },
    {
      "rank": 161,
      "cve_id": "CVE-2026-98487",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: bridge: mdb: restart port group walk after deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98487"
    },
    {
      "rank": 162,
      "cve_id": "CVE-2026-98488",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98488"
    },
    {
      "rank": 163,
      "cve_id": "CVE-2026-98489",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: atl1c: fix soft lockup on out-of-range tpd_cons read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98489"
    },
    {
      "rank": 164,
      "cve_id": "CVE-2026-98490",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: openvswitch: conntrack: fix helper UAF due to extensions realloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98490"
    },
    {
      "rank": 165,
      "cve_id": "CVE-2026-98491",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98491"
    },
    {
      "rank": 166,
      "cve_id": "CVE-2026-98492",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98492"
    },
    {
      "rank": 167,
      "cve_id": "CVE-2026-98493",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ipconfig: bound DHCP option construction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98493"
    },
    {
      "rank": 168,
      "cve_id": "CVE-2026-98494",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98494"
    },
    {
      "rank": 169,
      "cve_id": "CVE-2026-98495",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: arp: terminate device name before lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98495"
    },
    {
      "rank": 170,
      "cve_id": "CVE-2026-98496",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: airoha: npu: cancel wdt_work after releasing the WDT IRQ",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98496"
    },
    {
      "rank": 171,
      "cve_id": "CVE-2026-98497",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5e: fix swapped IPv6 IPsec policy masks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98497"
    },
    {
      "rank": 172,
      "cve_id": "CVE-2026-98498",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98498"
    },
    {
      "rank": 173,
      "cve_id": "CVE-2026-98499",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98499"
    },
    {
      "rank": 174,
      "cve_id": "CVE-2026-98500",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: hid-oxp: use cancel_delayed_work_sync() in remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98500"
    },
    {
      "rank": 175,
      "cve_id": "CVE-2026-98501",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: alps: fix use-after-free on input2 registration failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98501"
    },
    {
      "rank": 176,
      "cve_id": "CVE-2026-98502",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: alps: unregister DualPoint Stick input device on remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98502"
    },
    {
      "rank": 177,
      "cve_id": "CVE-2026-98503",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "packet: use ubuf_info completion for TX_RING packets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98503"
    },
    {
      "rank": 178,
      "cve_id": "CVE-2026-98504",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "PCI: of_property: Omit bus properties without a subordinate bus",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98504"
    },
    {
      "rank": 179,
      "cve_id": "CVE-2026-98505",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98505"
    },
    {
      "rank": 180,
      "cve_id": "CVE-2026-98506",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/hugetlb: do not dissolve gigantic pages without runtime support",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98506"
    },
    {
      "rank": 181,
      "cve_id": "CVE-2026-98507",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98507"
    },
    {
      "rank": 182,
      "cve_id": "CVE-2026-98508",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/virtio: fix NULL pointer dereference on fence allocation failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98508"
    },
    {
      "rank": 183,
      "cve_id": "CVE-2026-98509",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/virtio: fix memory leak of fence event on execbuffer failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98509"
    },
    {
      "rank": 184,
      "cve_id": "CVE-2026-98510",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/xe/vm: nuke PTs only after unlinking contested VMAs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98510"
    },
    {
      "rank": 185,
      "cve_id": "CVE-2026-98511",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98511"
    },
    {
      "rank": 186,
      "cve_id": "CVE-2026-98512",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau: RCU-free the scheduler-containing nouveau_sched",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98512"
    },
    {
      "rank": 187,
      "cve_id": "CVE-2026-98513",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98513"
    },
    {
      "rank": 188,
      "cve_id": "CVE-2026-98514",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau: Fix gem reference leak in validate_init()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98514"
    },
    {
      "rank": 189,
      "cve_id": "CVE-2026-98515",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau: fix double-free in nvif_vmm_dtor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98515"
    },
    {
      "rank": 190,
      "cve_id": "CVE-2026-98516",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau: Fix bridge reference leak in nv1a_ram_new()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98516"
    },
    {
      "rank": 191,
      "cve_id": "CVE-2026-98517",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98517"
    },
    {
      "rank": 192,
      "cve_id": "CVE-2026-98518",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau/dmem: pin VRAM for the whole registered range",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98518"
    },
    {
      "rank": 193,
      "cve_id": "CVE-2026-98519",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98519"
    },
    {
      "rank": 194,
      "cve_id": "CVE-2026-98520",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98520"
    },
    {
      "rank": 195,
      "cve_id": "CVE-2026-98521",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/i915: fix incorrect RCU teardown order",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98521"
    },
    {
      "rank": 196,
      "cve_id": "CVE-2026-98522",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98522"
    },
    {
      "rank": 197,
      "cve_id": "CVE-2026-98523",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/client: fix restore of partially initialized client",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98523"
    },
    {
      "rank": 198,
      "cve_id": "CVE-2026-98524",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rds: ib: Clear the sg list when mapping an MR fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98524"
    },
    {
      "rank": 199,
      "cve_id": "CVE-2026-98525",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98525"
    },
    {
      "rank": 200,
      "cve_id": "CVE-2026-98526",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "llc: reserve device headroom for allocated frames",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98526"
    },
    {
      "rank": 201,
      "cve_id": "CVE-2026-98527",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: zynq: fix runtime PM leak on request error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98527"
    },
    {
      "rank": 202,
      "cve_id": "CVE-2026-98528",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: cdev: fix kernel stack leak to user-space in error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98528"
    },
    {
      "rank": 203,
      "cve_id": "CVE-2026-98529",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98529"
    },
    {
      "rank": 204,
      "cve_id": "CVE-2026-98530",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "kprobes: Fix permanent hang when flushing the kprobe optimizer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98530"
    },
    {
      "rank": 205,
      "cve_id": "CVE-2026-98531",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98531"
    },
    {
      "rank": 206,
      "cve_id": "CVE-2026-98532",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: do not let ipv6_find_hdr() return an offset past the packet end",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98532"
    },
    {
      "rank": 207,
      "cve_id": "CVE-2026-98533",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipe: protect the dm-verity root hash with RCU",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98533"
    },
    {
      "rank": 208,
      "cve_id": "CVE-2026-98534",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipe: fix use-after-free when auditing a newly loaded policy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98534"
    },
    {
      "rank": 209,
      "cve_id": "CVE-2026-98535",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fsl/fman: Fix clk reference leak in read_dts_node()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98535"
    },
    {
      "rank": 210,
      "cve_id": "CVE-2026-98536",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "writeback: report a Tasks-RCU quiescent state per cgwb drain pass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98536"
    },
    {
      "rank": 211,
      "cve_id": "CVE-2026-98537",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "workqueue: Fix NULL current_pwq deref in flush dependency check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98537"
    },
    {
      "rank": 212,
      "cve_id": "CVE-2026-98538",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98538"
    },
    {
      "rank": 213,
      "cve_id": "CVE-2026-98539",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98539"
    },
    {
      "rank": 214,
      "cve_id": "CVE-2026-98540",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fprobe: Terminate the fgraph_data list when the reservation is not filled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98540"
    },
    {
      "rank": 215,
      "cve_id": "CVE-2026-98541",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98541"
    },
    {
      "rank": 216,
      "cve_id": "CVE-2026-98542",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98542"
    },
    {
      "rank": 217,
      "cve_id": "CVE-2026-98543",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98543"
    },
    {
      "rank": 218,
      "cve_id": "CVE-2026-98544",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bna: prevent IOC timer rearm during teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98544"
    },
    {
      "rank": 219,
      "cve_id": "CVE-2026-98545",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ata: libata-scsi: bound the ATA passthru sense descriptor writes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98545"
    },
    {
      "rank": 220,
      "cve_id": "CVE-2026-98546",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "arm64/boot: Disable trapping of PMZR_EL0 writes to EL2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98546"
    },
    {
      "rank": 221,
      "cve_id": "CVE-2026-98547",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "af_packet: fix integer overflow in prb_calc_retire_blk_tmo()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98547"
    },
    {
      "rank": 222,
      "cve_id": "CVE-2026-98548",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: discard the rest of the packet on a stale-cookie error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98548"
    },
    {
      "rank": 223,
      "cve_id": "CVE-2026-98549",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tcp: prevent collapsing skbs across boundary in rtx queue",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98549"
    },
    {
      "rank": 224,
      "cve_id": "CVE-2026-98550",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98550"
    },
    {
      "rank": 225,
      "cve_id": "CVE-2026-98551",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "perf/core: Fill branch entries with a single assignment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98551"
    },
    {
      "rank": 226,
      "cve_id": "CVE-2026-98552",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "perf/core: Fix a refcount leak in attach_perf_ctx_data()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98552"
    },
    {
      "rank": 227,
      "cve_id": "CVE-2026-98553",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "autofs: fix sbi->pipe file reference leak in autofs_kill_sb()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98553"
    },
    {
      "rank": 228,
      "cve_id": "CVE-2026-98554",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vlan: ensure sufficient headroom in vlan_dev_hard_header()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98554"
    },
    {
      "rank": 229,
      "cve_id": "CVE-2026-98555",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "llc: fix skb UAF and leaks on llc_mac_hdr_init() failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98555"
    },
    {
      "rank": 230,
      "cve_id": "CVE-2026-98556",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gve: DQO: reject TSO packets with an out of range MSS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98556"
    },
    {
      "rank": 231,
      "cve_id": "CVE-2026-98557",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98557"
    },
    {
      "rank": 232,
      "cve_id": "CVE-2026-98558",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: flush skb_defer_nodes in dev_cpu_dead()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98558"
    },
    {
      "rank": 233,
      "cve_id": "CVE-2026-98559",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/smc: fix UAF on lgr list traversal in smcr_port_err()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98559"
    },
    {
      "rank": 234,
      "cve_id": "CVE-2026-98560",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/rds: size a connection's path set by the transport it ends up with",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98560"
    },
    {
      "rank": 235,
      "cve_id": "CVE-2026-98561",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfp: hold IPsec RX state under the XArray lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98561"
    },
    {
      "rank": 236,
      "cve_id": "CVE-2026-98562",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: libwx: fix races in Tx timestamp handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98562"
    },
    {
      "rank": 237,
      "cve_id": "CVE-2026-98563",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: phylink: record the PHY only once bringup cannot fail",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98563"
    },
    {
      "rank": 238,
      "cve_id": "CVE-2026-98564",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98564"
    },
    {
      "rank": 239,
      "cve_id": "CVE-2026-98565",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98565"
    },
    {
      "rank": 240,
      "cve_id": "CVE-2026-98566",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/imagination: clamp freelist reconstruction requests",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98566"
    },
    {
      "rank": 241,
      "cve_id": "CVE-2026-98567",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: xps: reject an out of range traffic class",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98567"
    },
    {
      "rank": 242,
      "cve_id": "CVE-2026-98568",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vxlan: use one headroom snapshot for neighbour replies",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98568"
    },
    {
      "rank": 243,
      "cve_id": "CVE-2026-98569",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ip_gre: Reject enabling collect metadata through changelink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98569"
    },
    {
      "rank": 244,
      "cve_id": "CVE-2026-98570",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ipv6: keep room for the mac header in dst_dev_overhead()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98570"
    },
    {
      "rank": 245,
      "cve_id": "CVE-2026-98571",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: stmmac: clear stale buf->page after recycling on skb build failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98571"
    },
    {
      "rank": 246,
      "cve_id": "CVE-2026-98572",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix immediate JMP JEQ/JNE on MIPS32",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98572"
    },
    {
      "rank": 247,
      "cve_id": "CVE-2026-98573",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98573"
    },
    {
      "rank": 248,
      "cve_id": "CVE-2026-98574",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: bcmgenet: stop Tx NAPI before disabling the queues",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98574"
    },
    {
      "rank": 249,
      "cve_id": "CVE-2026-98575",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98575"
    },
    {
      "rank": 250,
      "cve_id": "CVE-2026-98576",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: llcp: fix slab-out-of-bounds reads when logging service names",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98576"
    },
    {
      "rank": 251,
      "cve_id": "CVE-2026-98577",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98577"
    },
    {
      "rank": 252,
      "cve_id": "CVE-2026-98578",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: st21nfca: validate ISO15693 inventory length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98578"
    },
    {
      "rank": 253,
      "cve_id": "CVE-2026-98579",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98579"
    },
    {
      "rank": 254,
      "cve_id": "CVE-2026-98580",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: llcp: Fix race condition in accept_queue lifecycle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98580"
    },
    {
      "rank": 255,
      "cve_id": "CVE-2026-98581",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98581"
    },
    {
      "rank": 256,
      "cve_id": "CVE-2026-98582",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: st21nfca: validate received frame size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98582"
    },
    {
      "rank": 257,
      "cve_id": "CVE-2026-98583",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nfc: nfcmrvl: validate helper command length before pull",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98583"
    },
    {
      "rank": 258,
      "cve_id": "CVE-2026-98584",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: fix potential stack infoleak in em_text_dump()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98584"
    },
    {
      "rank": 259,
      "cve_id": "CVE-2026-98585",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "eth: fbnic: Avoid rounding zero ring sizes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98585"
    },
    {
      "rank": 260,
      "cve_id": "CVE-2026-98586",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: hold asoc or transport before mod_timer() in timer handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98586"
    },
    {
      "rank": 261,
      "cve_id": "CVE-2026-98587",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "firewire: cdev: fix back-transition for iso_resource_auto client resource",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98587"
    },
    {
      "rank": 262,
      "cve_id": "CVE-2026-98588",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98588"
    },
    {
      "rank": 263,
      "cve_id": "CVE-2026-98589",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Reject pkt arguments in mutating subprogs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98589"
    },
    {
      "rank": 264,
      "cve_id": "CVE-2026-98590",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix bpf_sock context code generation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98590"
    },
    {
      "rank": 265,
      "cve_id": "CVE-2026-98591",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix bounds check for skb-backed dynptrs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98591"
    },
    {
      "rank": 266,
      "cve_id": "CVE-2026-98592",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: spacemit: clear TX descriptor on fragment mapping failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98592"
    },
    {
      "rank": 267,
      "cve_id": "CVE-2026-98593",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/debug: Fix NULL pointer dereference in debug_info_copy()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98593"
    },
    {
      "rank": 268,
      "cve_id": "CVE-2026-98594",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tg3: clean up PHYLIB resources on probe failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98594"
    },
    {
      "rank": 269,
      "cve_id": "CVE-2026-98595",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "udp: remove a disconnected socket from the 4-tuple hash table",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98595"
    },
    {
      "rank": 270,
      "cve_id": "CVE-2026-98596",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: Fix dst leak for uncached routes.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98596"
    },
    {
      "rank": 271,
      "cve_id": "CVE-2026-98597",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: usb: sr9700: include receive overhead in the length check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98597"
    },
    {
      "rank": 272,
      "cve_id": "CVE-2026-98598",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: Prevent rt6_insert_exception() for dying fib6_info.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98598"
    },
    {
      "rank": 273,
      "cve_id": "CVE-2026-98599",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Reject non-negative offsets in stack_slot_obj_get_spi()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98599"
    },
    {
      "rank": 274,
      "cve_id": "CVE-2026-98600",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98600"
    },
    {
      "rank": 275,
      "cve_id": "CVE-2026-98601",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btintel_pcie: validate device-supplied DMA indices",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98601"
    },
    {
      "rank": 276,
      "cve_id": "CVE-2026-98602",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98602"
    },
    {
      "rank": 277,
      "cve_id": "CVE-2026-98603",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ovpn: replace bind when clearing stale local source",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98603"
    },
    {
      "rank": 278,
      "cve_id": "CVE-2026-98604",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ovpn: replace bind when learning local endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98604"
    },
    {
      "rank": 279,
      "cve_id": "CVE-2026-98605",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98605"
    },
    {
      "rank": 280,
      "cve_id": "CVE-2026-98606",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/virtio: release the GEM object on virtio_gpu_vram_create() errors",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98606"
    },
    {
      "rank": 281,
      "cve_id": "CVE-2026-98607",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98607"
    },
    {
      "rank": 282,
      "cve_id": "CVE-2026-98608",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98608"
    },
    {
      "rank": 283,
      "cve_id": "CVE-2026-98609",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/virtio: fix object leak when drm_gem_handle_create() fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98609"
    },
    {
      "rank": 284,
      "cve_id": "CVE-2026-98610",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98610"
    },
    {
      "rank": 285,
      "cve_id": "CVE-2026-98611",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Check params size before reading reserved fields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98611"
    },
    {
      "rank": 286,
      "cve_id": "CVE-2026-98612",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: usb: catc: bound the RX packet length in catc_rx_done()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98612"
    },
    {
      "rank": 287,
      "cve_id": "CVE-2026-98613",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Bound ownership depth through local kptrs and graph roots",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98613"
    },
    {
      "rank": 288,
      "cve_id": "CVE-2026-98614",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: avoid livelock while updating retransmit path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98614"
    },
    {
      "rank": 289,
      "cve_id": "CVE-2026-98615",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98615"
    },
    {
      "rank": 290,
      "cve_id": "CVE-2026-98616",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "eth: fbnic: reset num_napi when the napi vectors are freed",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98616"
    },
    {
      "rank": 291,
      "cve_id": "CVE-2026-98617",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "eth: fbnic: use the Rx queue napi pointer to find the napi vector",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98617"
    },
    {
      "rank": 292,
      "cve_id": "CVE-2026-98618",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "eth: fbnic: Handle maximum standalone channels",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98618"
    },
    {
      "rank": 293,
      "cve_id": "CVE-2026-98619",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ethtool: keep rtnl_lock for the ioctl self test",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98619"
    },
    {
      "rank": 294,
      "cve_id": "CVE-2026-98620",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98620"
    },
    {
      "rank": 295,
      "cve_id": "CVE-2026-98621",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: gue: reject invalid REMCSUM offsets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98621"
    },
    {
      "rank": 296,
      "cve_id": "CVE-2026-98622",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98622"
    },
    {
      "rank": 297,
      "cve_id": "CVE-2026-98623",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98623"
    },
    {
      "rank": 298,
      "cve_id": "CVE-2026-98624",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nfnetlink_queue: hold nfnl mutex in event notifier",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98624"
    },
    {
      "rank": 299,
      "cve_id": "CVE-2026-98625",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: flowtable: publish HW_DEAD after worker is done",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98625"
    },
    {
      "rank": 300,
      "cve_id": "CVE-2026-98626",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Restrict CO-RE poisoning to relocatable instructions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98626"
    },
    {
      "rank": 301,
      "cve_id": "CVE-2026-98627",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Preserve packet pointer class displacement in regsafe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98627"
    },
    {
      "rank": 302,
      "cve_id": "CVE-2026-98628",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Make post-verification instruction rewrites killable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98628"
    },
    {
      "rank": 303,
      "cve_id": "CVE-2026-98629",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: cls_u32: fix manual hash table handle IDR aliasing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98629"
    },
    {
      "rank": 304,
      "cve_id": "CVE-2026-98630",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "eth: fbnic: Fix payload page pool error cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98630"
    },
    {
      "rank": 305,
      "cve_id": "CVE-2026-98631",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xsk: Use a 32-bit compare in xsk_map_gen_lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98631"
    },
    {
      "rank": 306,
      "cve_id": "CVE-2026-98632",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98632"
    },
    {
      "rank": 307,
      "cve_id": "CVE-2026-98633",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98633"
    },
    {
      "rank": 308,
      "cve_id": "CVE-2026-98634",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: sd_zbc: Reject disks with too many zones",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98634"
    },
    {
      "rank": 309,
      "cve_id": "CVE-2026-98635",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "scsi: block: Fix zones_cond out-of-bounds write on zone report",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98635"
    },
    {
      "rank": 310,
      "cve_id": "CVE-2026-98636",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "squashfs: Add dictionary size range check to prevent shift-out-of-bounds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98636"
    },
    {
      "rank": 311,
      "cve_id": "CVE-2026-98637",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98637"
    },
    {
      "rank": 312,
      "cve_id": "CVE-2026-98638",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98638"
    },
    {
      "rank": 313,
      "cve_id": "CVE-2026-98639",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: riscv: Fix NACL hfence entry update order",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98639"
    },
    {
      "rank": 314,
      "cve_id": "CVE-2026-98640",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: amd_sfh: Validate PCI BAR size before mapping",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98640"
    },
    {
      "rank": 315,
      "cve_id": "CVE-2026-98641",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf, arm64: set up the frame pointer for the exception callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98641"
    },
    {
      "rank": 316,
      "cve_id": "CVE-2026-98642",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98642"
    },
    {
      "rank": 317,
      "cve_id": "CVE-2026-98643",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix out-of-bounds read of rtt_min in sock_ops",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98643"
    },
    {
      "rank": 318,
      "cve_id": "CVE-2026-98644",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98644"
    },
    {
      "rank": 319,
      "cve_id": "CVE-2026-98645",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: winwing: fix use-after-free in force feedback teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98645"
    },
    {
      "rank": 320,
      "cve_id": "CVE-2026-98646",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98646"
    },
    {
      "rank": 321,
      "cve_id": "CVE-2026-98647",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix divide-by-zero in btf_struct_walk()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98647"
    },
    {
      "rank": 322,
      "cve_id": "CVE-2026-98648",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "s390/uv: Prevent potential out-of-bounds read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98648"
    },
    {
      "rank": 323,
      "cve_id": "CVE-2026-98649",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: Fix race in _destroy_pages_crste()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98649"
    },
    {
      "rank": 324,
      "cve_id": "CVE-2026-98650",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: Fix potential races in dat skey functions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98650"
    },
    {
      "rank": 325,
      "cve_id": "CVE-2026-98651",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98651"
    },
    {
      "rank": 326,
      "cve_id": "CVE-2026-98652",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: Add missing srcu in kvm_s390_set_irq_state()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98652"
    },
    {
      "rank": 327,
      "cve_id": "CVE-2026-98653",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: s390: Fix _gaccess_shadow_fault()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98653"
    },
    {
      "rank": 328,
      "cve_id": "CVE-2026-98654",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amd/display: Atomize IRQ register read/modify/write ops",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98654"
    },
    {
      "rank": 329,
      "cve_id": "CVE-2026-98655",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "perf: Require kernel access for text poke events",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98655"
    },
    {
      "rank": 330,
      "cve_id": "CVE-2026-98656",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: trigger: cancel reenable_work before freeing trigger",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98656"
    },
    {
      "rank": 331,
      "cve_id": "CVE-2026-98657",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98657"
    },
    {
      "rank": 332,
      "cve_id": "CVE-2026-98658",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: proximity: aw96103: validate firmware data length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98658"
    },
    {
      "rank": 333,
      "cve_id": "CVE-2026-98659",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: pressure: rohm-bm1390: Return error when read fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98659"
    },
    {
      "rank": 334,
      "cve_id": "CVE-2026-98660",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98660"
    },
    {
      "rank": 335,
      "cve_id": "CVE-2026-98661",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: light: rohm-bu27034: Fix infinite delay on error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98661"
    },
    {
      "rank": 336,
      "cve_id": "CVE-2026-98662",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: light: gp2ap020a00f: drain irq_work after free_irq",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98662"
    },
    {
      "rank": 337,
      "cve_id": "CVE-2026-98663",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: imu: adis16480: fix unprotected debugfs reads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98663"
    },
    {
      "rank": 338,
      "cve_id": "CVE-2026-98664",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: imu: adis16400: fix unprotected debugfs reads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98664"
    },
    {
      "rank": 339,
      "cve_id": "CVE-2026-98665",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: health: max30102: fix NULL dereference in interrupt handler",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98665"
    },
    {
      "rank": 340,
      "cve_id": "CVE-2026-98666",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: gyro: adis16136: fix unprotected debugfs reads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98666"
    },
    {
      "rank": 341,
      "cve_id": "CVE-2026-98667",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98667"
    },
    {
      "rank": 342,
      "cve_id": "CVE-2026-98668",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98668"
    },
    {
      "rank": 343,
      "cve_id": "CVE-2026-98669",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: buffer: serialize buffer teardown with mode claims",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98669"
    },
    {
      "rank": 344,
      "cve_id": "CVE-2026-98670",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98670"
    },
    {
      "rank": 345,
      "cve_id": "CVE-2026-98671",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98671"
    },
    {
      "rank": 346,
      "cve_id": "CVE-2026-98672",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: stm32-adc: fix possible division by zero in processed channel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98672"
    },
    {
      "rank": 347,
      "cve_id": "CVE-2026-98673",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: pac1934: check ACPI label duplication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98673"
    },
    {
      "rank": 348,
      "cve_id": "CVE-2026-98674",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: adi-axi-adc: Initialize state mutex",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98674"
    },
    {
      "rank": 349,
      "cve_id": "CVE-2026-98675",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: ade9000: handle Phase C dip events in IRQ1 handler",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98675"
    },
    {
      "rank": 350,
      "cve_id": "CVE-2026-98676",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: ade9000: fix NULL pointer dereference in clkout registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98676"
    },
    {
      "rank": 351,
      "cve_id": "CVE-2026-98677",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: ad_sigma_delta: fix use-after-free on unbind",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98677"
    },
    {
      "rank": 352,
      "cve_id": "CVE-2026-98678",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: adc: ad4030: fix invalid oversampling_ratio validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98678"
    },
    {
      "rank": 353,
      "cve_id": "CVE-2026-98679",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: accel: kxcjk-1013: reject duplicate event disable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98679"
    },
    {
      "rank": 354,
      "cve_id": "CVE-2026-98680",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: accel: kionix-kx022a: Prevent memory leak and fix state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98680"
    },
    {
      "rank": 355,
      "cve_id": "CVE-2026-98681",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98681"
    },
    {
      "rank": 356,
      "cve_id": "CVE-2026-98682",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: drain and invalidate before server-side copy/clone",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98682"
    },
    {
      "rank": 357,
      "cve_id": "CVE-2026-98683",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: flush dirty data before zeroing a range",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98683"
    },
    {
      "rank": 358,
      "cve_id": "CVE-2026-98684",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: flush and commit data before querying allocated ranges",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98684"
    },
    {
      "rank": 359,
      "cve_id": "CVE-2026-98685",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: discard post-EOF pagecache when extending a file via clone range",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98685"
    },
    {
      "rank": 360,
      "cve_id": "CVE-2026-98686",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "smb: client: discard post-EOF pagecache when extending a file via zero range",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98686"
    },
    {
      "rank": 361,
      "cve_id": "CVE-2026-98687",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Reject oversized XDomain properties responses",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98687"
    },
    {
      "rank": 362,
      "cve_id": "CVE-2026-98688",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Fix NULL dereference in tb_remove_work()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98688"
    },
    {
      "rank": 363,
      "cve_id": "CVE-2026-98689",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Don't access a DP tunnel after its DPRX read was canceled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98689"
    },
    {
      "rank": 364,
      "cve_id": "CVE-2026-98690",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Fix domain reference leak when DPRX read is canceled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98690"
    },
    {
      "rank": 365,
      "cve_id": "CVE-2026-98691",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Tear down inactive DP tunnels when the domain is stopped",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98691"
    },
    {
      "rank": 366,
      "cve_id": "CVE-2026-98692",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Make the DP tunnel activation callback mandatory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98692"
    },
    {
      "rank": 367,
      "cve_id": "CVE-2026-98693",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Hold a router reference for each allocated HopID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98693"
    },
    {
      "rank": 368,
      "cve_id": "CVE-2026-98694",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Fix KASAN reported use-after-free when request is canceled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98694"
    },
    {
      "rank": 369,
      "cve_id": "CVE-2026-98695",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: fix ioctl hangup race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98695"
    },
    {
      "rank": 370,
      "cve_id": "CVE-2026-98696",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: fix driver deregistration order",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98696"
    },
    {
      "rank": 371,
      "cve_id": "CVE-2026-98697",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: fix dynamic id driver deregistration race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98697"
    },
    {
      "rank": 372,
      "cve_id": "CVE-2026-98698",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: handle empty FILS association request payload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98698"
    },
    {
      "rank": 373,
      "cve_id": "CVE-2026-98699",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: fix mesh fast xmit path deletion UAF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98699"
    },
    {
      "rank": 374,
      "cve_id": "CVE-2026-98700",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: set info->band for 802.3 encap offload frames",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98700"
    },
    {
      "rank": 375,
      "cve_id": "CVE-2026-98701",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: release mesh path quota on failed additions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98701"
    },
    {
      "rank": 376,
      "cve_id": "CVE-2026-98702",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: reject invalid 320 MHz CSA bandwidth",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98702"
    },
    {
      "rank": 377,
      "cve_id": "CVE-2026-98703",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: minstrel_ht: validate fixed rate index",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98703"
    },
    {
      "rank": 378,
      "cve_id": "CVE-2026-98704",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: keep fallback association elements alive",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98704"
    },
    {
      "rank": 379,
      "cve_id": "CVE-2026-98705",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: account proxy paths against the mesh path limit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98705"
    },
    {
      "rank": 380,
      "cve_id": "CVE-2026-98706",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: drain PS delivery work during station teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98706"
    },
    {
      "rank": 381,
      "cve_id": "CVE-2026-98707",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: shut down RX BA session timer on teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98707"
    },
    {
      "rank": 382,
      "cve_id": "CVE-2026-98708",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: keep paired old chanctx alive",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98708"
    },
    {
      "rank": 383,
      "cve_id": "CVE-2026-98709",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: count only matching reservations in reserved switch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98709"
    },
    {
      "rank": 384,
      "cve_id": "CVE-2026-98710",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: iwlegacy: 3945: free EEPROM data on remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98710"
    },
    {
      "rank": 385,
      "cve_id": "CVE-2026-98711",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: cw1200: fix TX padding OOB read leaking heap data to device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98711"
    },
    {
      "rank": 386,
      "cve_id": "CVE-2026-98712",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98712"
    },
    {
      "rank": 387,
      "cve_id": "CVE-2026-98713",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98713"
    },
    {
      "rank": 388,
      "cve_id": "CVE-2026-98714",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98714"
    },
    {
      "rank": 389,
      "cve_id": "CVE-2026-98715",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98715"
    },
    {
      "rank": 390,
      "cve_id": "CVE-2026-98716",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98716"
    },
    {
      "rank": 391,
      "cve_id": "CVE-2026-98717",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98717"
    },
    {
      "rank": 392,
      "cve_id": "CVE-2026-98718",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98718"
    },
    {
      "rank": 393,
      "cve_id": "CVE-2026-98719",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: SEV: Nullify \"have run CPUs\" mask pointer when freeing it",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98719"
    },
    {
      "rank": 394,
      "cve_id": "CVE-2026-98720",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98720"
    },
    {
      "rank": 395,
      "cve_id": "CVE-2026-98721",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98721"
    },
    {
      "rank": 396,
      "cve_id": "CVE-2026-98722",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: block2mtd: Fix divide error when erase_size is zero",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98722"
    },
    {
      "rank": 397,
      "cve_id": "CVE-2026-98723",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvmet: copy the hostid into the ctrl before creating PR pc_refs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98723"
    },
    {
      "rank": 398,
      "cve_id": "CVE-2026-98724",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvmet: pci-epf: reject too-short SGL segments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98724"
    },
    {
      "rank": 399,
      "cve_id": "CVE-2026-98725",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98725"
    },
    {
      "rank": 400,
      "cve_id": "CVE-2026-98726",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme-multipath: fix underflow in ANA log bounds checks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98726"
    },
    {
      "rank": 401,
      "cve_id": "CVE-2026-98727",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98727"
    },
    {
      "rank": 402,
      "cve_id": "CVE-2026-98728",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tpm: fix off-by-four bounds check in tpm2_get_random()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98728"
    },
    {
      "rank": 403,
      "cve_id": "CVE-2026-98729",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98729"
    },
    {
      "rank": 404,
      "cve_id": "CVE-2026-98730",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98730"
    },
    {
      "rank": 405,
      "cve_id": "CVE-2026-98731",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98731"
    },
    {
      "rank": 406,
      "cve_id": "CVE-2026-98732",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btintel: fix buffer over-read in btintel_hw_error()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98732"
    },
    {
      "rank": 407,
      "cve_id": "CVE-2026-98733",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_core: Serialize fragmented ISO packet queueing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98733"
    },
    {
      "rank": 408,
      "cve_id": "CVE-2026-98734",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98734"
    },
    {
      "rank": 409,
      "cve_id": "CVE-2026-98735",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_core: Serialize ACL scheduling with channel deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98735"
    },
    {
      "rank": 410,
      "cve_id": "CVE-2026-98736",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_conn: Lock parent access during enhanced SCO setup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98736"
    },
    {
      "rank": 411,
      "cve_id": "CVE-2026-98737",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sync: Fix inquiry cache use-after-free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98737"
    },
    {
      "rank": 412,
      "cve_id": "CVE-2026-98738",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: Serialize SMP remote OOB data access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98738"
    },
    {
      "rank": 413,
      "cve_id": "CVE-2026-98739",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: RFCOMM: Fix initial port reference race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98739"
    },
    {
      "rank": 414,
      "cve_id": "CVE-2026-98740",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "EDAC/altera: Drop __init from ECC setup paths for re-probe safety",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98740"
    },
    {
      "rank": 415,
      "cve_id": "CVE-2026-98741",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: ua101: reject mismatched capture/playback packet sizes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98741"
    },
    {
      "rank": 416,
      "cve_id": "CVE-2026-98742",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: Serialize compat port-info ioctls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98742"
    },
    {
      "rank": 417,
      "cve_id": "CVE-2026-98743",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98743"
    },
    {
      "rank": 418,
      "cve_id": "CVE-2026-98744",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: codecs: max98363: fix uninitialized stream_config->type",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98744"
    },
    {
      "rank": 419,
      "cve_id": "CVE-2026-98745",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98745"
    },
    {
      "rank": 420,
      "cve_id": "CVE-2026-98746",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98746"
    },
    {
      "rank": 421,
      "cve_id": "CVE-2026-98747",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "serial: core: fix NULL pointer dereference in serial_core_unregister_port()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98747"
    },
    {
      "rank": 422,
      "cve_id": "CVE-2026-98748",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98748"
    },
    {
      "rank": 423,
      "cve_id": "CVE-2026-98749",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tty: serial: max3100: shut down timer before freeing port",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98749"
    },
    {
      "rank": 424,
      "cve_id": "CVE-2026-98750",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tty: fix saved termios reset race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98750"
    },
    {
      "rank": 425,
      "cve_id": "CVE-2026-98751",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tty: abort break signalling on hangup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98751"
    },
    {
      "rank": 426,
      "cve_id": "CVE-2026-98752",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tty: port: fix tty_port_tty_vhangup() race",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98752"
    },
    {
      "rank": 427,
      "cve_id": "CVE-2026-98753",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tty: tty_port: restore TTY_IO_ERROR on activation failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98753"
    },
    {
      "rank": 428,
      "cve_id": "CVE-2026-98754",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98754"
    },
    {
      "rank": 429,
      "cve_id": "CVE-2026-98755",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tty: vcc: zero-initialize control packet in vcc_send_ctl()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98755"
    },
    {
      "rank": 430,
      "cve_id": "CVE-2026-98756",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98756"
    },
    {
      "rank": 431,
      "cve_id": "CVE-2026-98757",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: cdns3: fix use-after-free in cdns3_gadget_exit()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98757"
    },
    {
      "rank": 432,
      "cve_id": "CVE-2026-98758",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: ucsi: glink: fix use-after-free of ucsi on remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98758"
    },
    {
      "rank": 433,
      "cve_id": "CVE-2026-98759",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98759"
    },
    {
      "rank": 434,
      "cve_id": "CVE-2026-98760",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98760"
    },
    {
      "rank": 435,
      "cve_id": "CVE-2026-98761",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: tcpm: recover after failure to start the frs ams",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98761"
    },
    {
      "rank": 436,
      "cve_id": "CVE-2026-98762",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: dwc2: shut down wakeup timer before freeing HCD state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98762"
    },
    {
      "rank": 437,
      "cve_id": "CVE-2026-98763",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: core: clear both ep_in and ep_out for non-ep0 control endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98763"
    },
    {
      "rank": 438,
      "cve_id": "CVE-2026-98764",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98764"
    },
    {
      "rank": 439,
      "cve_id": "CVE-2026-98765",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: gadget: dummy-hcd: Fix wait for outstanding request completions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98765"
    },
    {
      "rank": 440,
      "cve_id": "CVE-2026-98766",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: gadget: aspeed-vhub: cancel wake work on device removal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98766"
    },
    {
      "rank": 441,
      "cve_id": "CVE-2026-98767",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: dwc3: gadget: fix IRQ storm on invalid event buffer count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98767"
    },
    {
      "rank": 442,
      "cve_id": "CVE-2026-98768",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: typec: anx7411 - stop the IRQ before destroying the workqueue",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98768"
    },
    {
      "rank": 443,
      "cve_id": "CVE-2026-98769",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98769"
    },
    {
      "rank": 444,
      "cve_id": "CVE-2026-98770",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: gadget: midi2: Fix the jack descriptor array sizes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98770"
    },
    {
      "rank": 445,
      "cve_id": "CVE-2026-98771",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "usb: storage: sierra_ms: reject short SWoC info transfers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98771"
    },
    {
      "rank": 446,
      "cve_id": "CVE-2026-98772",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: serial: fix port tear down use-after-free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98772"
    },
    {
      "rank": 447,
      "cve_id": "CVE-2026-98773",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "USB: cdc-acm: skip URB restart in port_shutdown if disconnected",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98773"
    },
    {
      "rank": 448,
      "cve_id": "CVE-2026-98774",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rust_binder: cancel deferred work items in thread exit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98774"
    },
    {
      "rank": 449,
      "cve_id": "CVE-2026-98775",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nitro_enclaves: fix use-after-free on SLOT_ALLOC failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98775"
    },
    {
      "rank": 450,
      "cve_id": "CVE-2026-98776",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binderfs: fix UAF write in binder_add_device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98776"
    },
    {
      "rank": 451,
      "cve_id": "CVE-2026-98777",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binder: fix leaked fd fixups on TF_UPDATE_TXN supersede",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98777"
    },
    {
      "rank": 452,
      "cve_id": "CVE-2026-98778",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "binder: fix is_failure flag for superseded transaction cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98778"
    },
    {
      "rank": 453,
      "cve_id": "CVE-2026-98779",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu: fix ACP MFD device leak on init failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98779"
    },
    {
      "rank": 454,
      "cve_id": "CVE-2026-98780",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu: fix IP instance memory leak on kobject add failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98780"
    },
    {
      "rank": 455,
      "cve_id": "CVE-2026-98781",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/mediatek: Fix pdev reference leak in mtk_drm_bind()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98781"
    },
    {
      "rank": 456,
      "cve_id": "CVE-2026-98782",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/mediatek: Fix ovl adaptor platform device leak",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98782"
    },
    {
      "rank": 457,
      "cve_id": "CVE-2026-98783",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98783"
    },
    {
      "rank": 458,
      "cve_id": "CVE-2026-98784",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amdgpu/gfx6: fix firmware leak on teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98784"
    },
    {
      "rank": 459,
      "cve_id": "CVE-2026-98785",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98785"
    },
    {
      "rank": 460,
      "cve_id": "CVE-2026-98786",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/amd/display: guard dc_sink dereferences in MST mode validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98786"
    },
    {
      "rank": 461,
      "cve_id": "CVE-2026-98787",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98787"
    },
    {
      "rank": 462,
      "cve_id": "CVE-2026-98788",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "futex: Fix private hash use-after-free on resize",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98788"
    },
    {
      "rank": 463,
      "cve_id": "CVE-2026-98789",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix objects stuck in free_by_rcu_ttrace",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98789"
    },
    {
      "rank": 464,
      "cve_id": "CVE-2026-98790",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "perf: Fix race between perf_event_exit_task() and perf_pending_task()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98790"
    },
    {
      "rank": 465,
      "cve_id": "CVE-2026-98791",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98791"
    },
    {
      "rank": 466,
      "cve_id": "CVE-2026-98792",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: flowtable: generalize pending status bit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98792"
    },
    {
      "rank": 467,
      "cve_id": "CVE-2026-98793",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: bpf: reject invalid NAT manipulation types",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98793"
    },
    {
      "rank": 468,
      "cve_id": "CVE-2026-98794",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipvs: filter some flags received in the backup server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98794"
    },
    {
      "rank": 469,
      "cve_id": "CVE-2026-98795",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: sparx5: skip ptp deinit if init was skipped",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98795"
    },
    {
      "rank": 470,
      "cve_id": "CVE-2026-98796",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: ethernet: mtk_eth_soc: allocate dummy netdev sooner",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98796"
    },
    {
      "rank": 471,
      "cve_id": "CVE-2026-98797",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: cap skb->queue_mapping when the tx queue is picked",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98797"
    },
    {
      "rank": 472,
      "cve_id": "CVE-2026-98798",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: bcmgenet: fix NULL dereference in set_coalesce before first open",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98798"
    },
    {
      "rank": 473,
      "cve_id": "CVE-2026-98799",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Skip detached progs in trampoline images that are still in use",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98799"
    },
    {
      "rank": 474,
      "cve_id": "CVE-2026-98800",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Wait for an RCU tasks grace period before freeing trampoline progs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98800"
    },
    {
      "rank": 475,
      "cve_id": "CVE-2026-98801",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: restrict SO_RESERVE_MEM to TCP sockets and cap max value",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98801"
    },
    {
      "rank": 476,
      "cve_id": "CVE-2026-98802",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "seg6: ensure packet data is writable before modifying SRH and IPv6 DA",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98802"
    },
    {
      "rank": 477,
      "cve_id": "CVE-2026-98803",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: stmmac: fix rx Scatter-Gather support",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98803"
    },
    {
      "rank": 478,
      "cve_id": "CVE-2026-98804",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98804"
    },
    {
      "rank": 479,
      "cve_id": "CVE-2026-98805",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tipc: prevent GCM nonce reuse on peer key changes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98805"
    },
    {
      "rank": 480,
      "cve_id": "CVE-2026-98806",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98806"
    },
    {
      "rank": 481,
      "cve_id": "CVE-2026-98807",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mlx5: Fix slab-out-of-bounds when handling team device events",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98807"
    },
    {
      "rank": 482,
      "cve_id": "CVE-2026-98808",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: systemport: Fix buffer overflow in bcm_sysport_get_stats()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98808"
    },
    {
      "rank": 483,
      "cve_id": "CVE-2026-98809",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98809"
    },
    {
      "rank": 484,
      "cve_id": "CVE-2026-98810",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98810"
    },
    {
      "rank": 485,
      "cve_id": "CVE-2026-98811",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: cls_api: reclaim an empty proto on the error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98811"
    },
    {
      "rank": 486,
      "cve_id": "CVE-2026-98812",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/mctp: publish the mctp_dev only after it is initialised",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98812"
    },
    {
      "rank": 487,
      "cve_id": "CVE-2026-98813",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Hold map BTF for the memory allocator destructor record",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98813"
    },
    {
      "rank": 488,
      "cve_id": "CVE-2026-98814",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme: fix command effects log lifetime for multipath heads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98814"
    },
    {
      "rank": 489,
      "cve_id": "CVE-2026-98815",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "nvme: fix cdev lifetime",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98815"
    },
    {
      "rank": 490,
      "cve_id": "CVE-2026-98816",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix overflow of jump offset in constant blinding",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98816"
    },
    {
      "rank": 491,
      "cve_id": "CVE-2026-98817",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ASoC: SDCA: Add better pm_runtime error handling in func probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98817"
    },
    {
      "rank": 492,
      "cve_id": "CVE-2026-98818",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98818"
    },
    {
      "rank": 493,
      "cve_id": "CVE-2026-98819",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: btintel: validate DDC record lengths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98819"
    },
    {
      "rank": 494,
      "cve_id": "CVE-2026-98820",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "blk-mq: set RQF_USE_SCHED when the operation is known",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98820"
    },
    {
      "rank": 495,
      "cve_id": "CVE-2026-98821",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "block: reject polled dio with user integrity metadata",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98821"
    },
    {
      "rank": 496,
      "cve_id": "CVE-2026-98822",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: prevent AP VLAN tx from other interfaces",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98822"
    },
    {
      "rank": 497,
      "cve_id": "CVE-2026-98823",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: cfg80211: preserve hidden-group beacon IE ownership",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98823"
    },
    {
      "rank": 498,
      "cve_id": "CVE-2026-98824",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: validate TX status rate metadata",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98824"
    },
    {
      "rank": 499,
      "cve_id": "CVE-2026-98825",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98825"
    },
    {
      "rank": 500,
      "cve_id": "CVE-2026-98826",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rtc: ac100: Fix clock provider use-after-free on probe failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98826"
    },
    {
      "rank": 501,
      "cve_id": "CVE-2026-98827",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98827"
    },
    {
      "rank": 502,
      "cve_id": "CVE-2026-98828",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: ath9k: reject short WMI command responses",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98828"
    },
    {
      "rank": 503,
      "cve_id": "CVE-2026-98829",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: mac80211: drop oversized fragments to avoid extra_len overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98829"
    },
    {
      "rank": 504,
      "cve_id": "CVE-2026-98830",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: wfx: validate MIB read length before copying to caller",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98830"
    },
    {
      "rank": 505,
      "cve_id": "CVE-2026-98831",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "of/overlay: don't leak fragment references when changeset init fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98831"
    },
    {
      "rank": 506,
      "cve_id": "CVE-2026-98832",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "blk-cgroup: save IRQ state in blkg_tryget_closest()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98832"
    },
    {
      "rank": 507,
      "cve_id": "CVE-2026-98833",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: core: call _get_device() with the master MTD",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98833"
    },
    {
      "rank": 508,
      "cve_id": "CVE-2026-98834",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mtd: core: avoid double-free of OTP NVMEM device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98834"
    },
    {
      "rank": 509,
      "cve_id": "CVE-2026-98835",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iio: accel: kionix-kx022a: Fix array boundary check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98835"
    },
    {
      "rank": 510,
      "cve_id": "CVE-2026-98836",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: line6: reject oversized playback packets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98836"
    },
    {
      "rank": 511,
      "cve_id": "CVE-2026-98837",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: caiaq: unregister the input device when probe fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98837"
    },
    {
      "rank": 512,
      "cve_id": "CVE-2026-98838",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vt: skip screen update for DEC alignment test on backgroup consoles",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98838"
    },
    {
      "rank": 513,
      "cve_id": "CVE-2026-98839",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98839"
    },
    {
      "rank": 514,
      "cve_id": "CVE-2026-98840",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98840"
    },
    {
      "rank": 515,
      "cve_id": "CVE-2026-98841",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "virt: vmgenid: set driver_data before registering notification handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98841"
    },
    {
      "rank": 516,
      "cve_id": "CVE-2026-98842",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "module: fix lost error code from codetag_load_module()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98842"
    },
    {
      "rank": 517,
      "cve_id": "CVE-2026-98843",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: zero gaps in read-gaps folio to avoid writing back stale data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98843"
    },
    {
      "rank": 518,
      "cve_id": "CVE-2026-98844",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfs: clear post-EOF pagecache when extending a file via write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98844"
    },
    {
      "rank": 519,
      "cve_id": "CVE-2026-98845",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tpm: Disable TPM on null key name mismatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98845"
    },
    {
      "rank": 520,
      "cve_id": "CVE-2026-98846",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sctp: check RCV_SHUTDOWN after the sendmsg connect wait",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98846"
    },
    {
      "rank": 521,
      "cve_id": "CVE-2026-98847",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rtc: spear: initialize IRQ state before requesting alarm IRQ",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98847"
    },
    {
      "rank": 522,
      "cve_id": "CVE-2026-98848",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rtc: ac100: Assign .num before accessing .hws",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98848"
    },
    {
      "rank": 523,
      "cve_id": "CVE-2026-98849",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "pfcp: fix socket lifetime on netdevice registration failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98849"
    },
    {
      "rank": 524,
      "cve_id": "CVE-2026-98850",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/packet: prevent TX_RING byte count overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98850"
    },
    {
      "rank": 525,
      "cve_id": "CVE-2026-98851",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: nft_flow_offload: drop flowtable reference on init error path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98851"
    },
    {
      "rank": 526,
      "cve_id": "CVE-2026-98852",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: extend IPv6 exthdr detection of tunneled packets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98852"
    },
    {
      "rank": 527,
      "cve_id": "CVE-2026-98853",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: gso: limit recursive IP-in-IP segmentation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98853"
    },
    {
      "rank": 528,
      "cve_id": "CVE-2026-98854",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "of/overlay: only treat a positive changeset id as registered",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98854"
    },
    {
      "rank": 529,
      "cve_id": "CVE-2026-98855",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "of/overlay: put property on deadprops only after changeset add succeeds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98855"
    },
    {
      "rank": 530,
      "cve_id": "CVE-2026-98856",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "kprobes: Skip disarmed probes when checking optkprobe overlap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98856"
    },
    {
      "rank": 531,
      "cve_id": "CVE-2026-98857",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipvs: bound LBLCR and LBLC cache growth",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98857"
    },
    {
      "rank": 532,
      "cve_id": "CVE-2026-98858",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "io_uring: fix task_work add use-after-free with SQPOLL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98858"
    },
    {
      "rank": 533,
      "cve_id": "CVE-2026-98859",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: multitouch: stop the release timer from being rearmed on remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98859"
    },
    {
      "rank": 534,
      "cve_id": "CVE-2026-98860",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98860"
    },
    {
      "rank": 535,
      "cve_id": "CVE-2026-98861",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98861"
    },
    {
      "rank": 536,
      "cve_id": "CVE-2026-98862",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "audit: fix exe mark UAF in kill_rules()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98862"
    },
    {
      "rank": 537,
      "cve_id": "CVE-2026-98863",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98863"
    },
    {
      "rank": 538,
      "cve_id": "CVE-2026-98864",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98864"
    },
    {
      "rank": 539,
      "cve_id": "CVE-2026-98865",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sched_ext: Don't run ops.dequeue() with a DSQ lock held",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98865"
    },
    {
      "rank": 540,
      "cve_id": "CVE-2026-98866",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sched/cache: Introduce task_struct->sched_cache_grp to fix UAF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98866"
    },
    {
      "rank": 541,
      "cve_id": "CVE-2026-98867",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-pcache: bound the logical key offset from persistent memory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98867"
    },
    {
      "rank": 542,
      "cve_id": "CVE-2026-98868",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm-pcache: reject a kset that overruns its segment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98868"
    },
    {
      "rank": 543,
      "cve_id": "CVE-2026-104627",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-287",
      "title": "Gitea OpenID account linking without session binding",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104627"
    },
    {
      "rank": 544,
      "cve_id": "CVE-2026-105661",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-248",
      "title": "Gitea panic on the repositories route of individual users",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105661"
    },
    {
      "rank": 545,
      "cve_id": "CVE-2026-105964",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-770",
      "title": "Gitea Actions artifact v4 API unbounded request body",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105964"
    },
    {
      "rank": 546,
      "cve_id": "CVE-2026-107618",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": null,
      "title": "Gitea cross-site request forgery on repository topics",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107618"
    },
    {
      "rank": 547,
      "cve_id": "CVE-2026-107686",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": null,
      "title": "Gitea reactions accepted on locked issues and comments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107686"
    },
    {
      "rank": 548,
      "cve_id": "CVE-2026-109553",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": null,
      "title": "Gitea SSH certificate principal impersonation of other users",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109553"
    },
    {
      "rank": 549,
      "cve_id": "CVE-2026-109844",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-862",
      "title": "Gitea watched repositories API disclosure after access revocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109844"
    },
    {
      "rank": 550,
      "cve_id": "CVE-2026-110311",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-200",
      "title": "Gitea draft release creation disclosing attachment metadata",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110311"
    },
    {
      "rank": 551,
      "cve_id": "CVE-2026-110324",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-200",
      "title": "Gitea private profile information disclosure through POST request",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110324"
    },
    {
      "rank": 552,
      "cve_id": "CVE-2026-110494",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gitea",
      "product": "Gitea",
      "cwe": "CWE-639",
      "title": "Gitea release attachment re-linking of issue attachments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110494"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-53690",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-53690 (Sitecore Experience Manager (XM)). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-103376",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-103376 (Unknown PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104122",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104122 (Unknown Ukr-To-Lat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104246",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104246 (Unknown Contact Form 7 Signature Addon). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-106470",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-106470 (Unknown WP Data Access). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108165",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108165 (immich-app immich). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108607",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108607 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108612",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108612 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108617",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108617 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108622",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108622 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108627",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108627 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108632",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108632 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108637",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108637 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108642",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108642 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108647",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108647 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108652",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108652 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108657",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108657 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108662",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108662 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108667",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108667 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108672",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108672 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108677",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108677 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108689",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108689 (WuKongOpenSource Wukong AICRM). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108702",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108702 (1Panel-dev CordysCRM). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108707",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108707 (WuKongOpenSource Wukong_HRM). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108869",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108869 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108874",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108874 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108879",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108879 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108884",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108884 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108891",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108891 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108950",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108950 (opensource-socialnetwork). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-109181",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-109181 (jishenghua jshERP). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-109186",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-109186 (jishenghua jshERP). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-110527",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-110527 (Unknown WP User Manager). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-33555",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-33555 (HAProxy). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-81343",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-81343 (Unknown ACF Frontend Admin by DynamiApps). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-81344",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-81344 (Unknown ACF Frontend Admin by DynamiApps). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-91074",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-91074 (Unknown BSK PDF Manager). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-92431",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-92431 (Unknown Patreon WordPress). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-92432",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-92432 (Unknown Patreon WordPress). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-92433",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-92433 (Unknown Patreon WordPress). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-97314",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-97314 (Unknown ThirstyAffiliates). Public exploit reference added."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-0322",
      "detail": "DUE DATE PASSED — CVE-2026-0322 (Palo Alto Networks Cloud NGFW). CISA remediation deadline was October 17, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-105133",
      "detail": "DUE DATE PASSED — CVE-2026-105133 (AhsayCBS). CISA remediation deadline was October 17, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-105134",
      "detail": "DUE DATE PASSED — CVE-2026-105134 (AhsayCBS). CISA remediation deadline was October 17, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-76519",
      "detail": "DUE DATE PASSED — CVE-2026-76519 (Cisco Secure Email). CISA remediation deadline was October 17, 2026; still in catalog."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-22862",
      "detail": "RESCORED — CVE-2025-22862 (Fortinet FortiProxy). CVSS 6.3 → 6.7 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-25253",
      "detail": "RESCORED — CVE-2025-25253 (Fortinet FortiProxy). CVSS 6.8 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-31366",
      "detail": "RESCORED — CVE-2025-31366 (Fortinet FortiSASE). CVSS 4.5 → 6.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-31514",
      "detail": "RESCORED — CVE-2025-31514 (Fortinet FortiOS). CVSS 2.6 → 4.3 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-41115",
      "detail": "RESCORED — CVE-2025-41115 (Grafana Enterprise). CVSS 10 → 9.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-46373",
      "detail": "RESCORED — CVE-2025-46373 (Fortinet FortiClientWindows). CVSS 7.1 → 7.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-47890",
      "detail": "RESCORED — CVE-2025-47890 (Fortinet FortiOS). CVSS 2.5 → 6.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-53843",
      "detail": "RESCORED — CVE-2025-53843 (Fortinet FortiOS). CVSS 6.9 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-57740",
      "detail": "RESCORED — CVE-2025-57740 (Fortinet FortiPAM). CVSS 6.7 → 8.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-58034",
      "detail": "RESCORED — CVE-2025-58034 (Fortinet FortiWeb). CVSS 6.7 → 7.2 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-58360",
      "detail": "RESCORED — CVE-2025-58360 (geoserver). CVSS 8.2 → 9.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-58413",
      "detail": "RESCORED — CVE-2025-58413 (Fortinet FortiOS). CVSS 6.9 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-64446",
      "detail": "RESCORED — CVE-2025-64446 (Fortinet FortiWeb). CVSS 9.4 → 9.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-33555",
      "detail": "RESCORED — CVE-2026-33555 (HAProxy). CVSS 4 → 5.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-96658",
      "detail": "RESCORED — CVE-2026-96658 (Red Hat Satellite 6.16 for RHEL 8). CVSS 9.9 → 8.8 (NVD)."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-15143",
      "detail": "PATCH SHIPPED — CVE-2026-15143 (guardrails-detectors). Fixed in Red Hat OpenShift AI 3.4 1791537794."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-57727",
      "detail": "PATCH SHIPPED — CVE-2026-57727 (Themeum Kirki). Fixed in Kirki 6.2.1."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-91202",
      "detail": "PATCH SHIPPED — CVE-2026-91202 (Red Hat Enterprise Linux 9). Fixed in Red Hat Enterprise Linux 9 0:36.1-1.el9_8."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-91205",
      "detail": "PATCH SHIPPED — CVE-2026-91205 (Red Hat Enterprise Linux 9). Fixed in Red Hat Enterprise Linux 9 0:36.1-1.el9_8."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-96442",
      "detail": "PATCH SHIPPED — CVE-2026-96442 (GNU Emacs). Fixed in Red Hat Enterprise Linux 10 1:29.4-14.el10_2.3."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}