Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 06:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

149-75% vs 7-day avg of 597

2 critical, 48 high, 64 medium, 30 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Unknown	n/a	CVE-2026-98966	In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog,... LinuxLinux, Linux kernel, Linux bonding driver	NVD		Oct 23 13:17 UTC
CVE-2026-98966In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog,... Executive summary The advisory describes a resource leak in the Linux kernel's bonding driver, where BPF programs attached through XDP were not released when the XDP program was replaced. Over time, leaked programs could accumulate on affected systems. The advisory does not state a severity rating, and the fix is a committed kernel patch that corrects the reference handling. Technical summary This is a reference-counting resource leak in the bonding driver's bond_xdp_set function, where the reference on the old BPF program was not released when the program was replaced or removed. The advisory does not describe an attack vector, privileges required, or any memory corruption or code execution impact. The patch changes the logic so the old program is released whenever one exists, and it adjusts the static branch counter for the transitions from no program to a program and from a program to none. The advisory names Fixes commits 9e2ee5c7e7c3 and 6d5f1ef83868, but it does not state affected or fixed kernel version numbers. Workarounds, exploitation status, CVSS score, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/184b5ddf82d45d6…83719a2e453392512bd2 Score No CVSS score published. Affects Linux Linux Linux kernel Linux bonding driver NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Score

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee