CVE 2026 document archive · 14

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,153 documents · Identifier year 2026 · 14 / 264

651. CVE-2026-107565luksmeta: Incomplete gap-boundary and overlap checks in LUKS1 metadata allocator allow data corruption→
652. CVE-2026-107466flatpak-builder: Local File Exfiltration via `file→
653. CVE-2026-107315org.postgresql/postgresql: PostgreSQL JDBC Driver: Information disclosure via residual send buffer padding→
654. CVE-2026-107314org.postgresql/postgresql: PostgreSQL JDBC Driver: Information disclosure via requireAuth restriction bypass→
655. CVE-2026-107210ImageMagick: ImageMagick: Resource exhaustion via crafted MAT image→
656. CVE-2026-107209ImageMagick: ImageMagick: Denial of Service via crafted RSVG image→
657. CVE-2026-107208ImageMagick: ImageMagick: Denial of Service via crafted XMP profile→
658. CVE-2026-107170m17n-lib: NULL dereference in minput_open_im() after failed m17n_init()→
659. CVE-2026-107169m17n-lib: NULL-pointer write in read_mtext_element() on malformed UTF-8→
660. CVE-2026-107168m17n-lib: Parser infinite loop on malformed UTF-8 in count_utf_8_chars()→
661. CVE-2026-107167m17n-lib: Heap use-after-free write in re_init_ic()→
662. CVE-2026-107161cyrus-sasl: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients→
663. CVE-2026-107157qt: Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework→
664. CVE-2026-107080openjpeg2: openjpeg2: Denial of Service via out-of-bounds memory access in opj_dwt_encode_and_deinterleave_v→
665. CVE-2026-106589openssh: OpenSSH: Privilege escalation via retained root privileges in sshd-session→
666. CVE-2026-106585openssh: openssh: Denial of service via oversized decompressed packets→
667. CVE-2026-106583openssh: openssh: Command injection via unvalidated command-line username→
668. CVE-2026-106582openssh: openssh: Information disclosure via shared compression side-channel→
669. CVE-2026-106580ImageMagick: ImageMagick: Information disclosure via missing security policy check in CUT encoder→
670. CVE-2026-106579ImageMagick: ImageMagick: Information disclosure via security policy bypass→
671. CVE-2026-106578ImageMagick: ImageMagick: Denial of Service via invalid memory free in MVG decoder→
672. CVE-2026-106577ImageMagick: ImageMagick: Code injection via unescaped values in PostScript coders→
673. CVE-2026-106576ImageMagick: ImageMagick: Denial of Service via crafted XMP profile→
674. CVE-2026-106575ImageMagick: ImageMagick: Denial of Service via unclosed file pointers in Magick scripts→
675. CVE-2026-106574ImageMagick: ImageMagick: Denial of Service via heap buffer overwrite in distributed pixel cache server→
676. CVE-2026-106573ImageMagick: ImageMagick: Denial of Service via missing limit check in MVG decoder→
677. CVE-2026-106572ImageMagick: ImageMagick: Denial of Service via crafted CALS image→
678. CVE-2026-106571ImageMagick: ImageMagick: Denial of Service via heap buffer overflow in GetVirtualPixels→
679. CVE-2026-106570ImageMagick: ImageMagick: Denial of Service via connection exhaustion in distributed pixel cache→
680. CVE-2026-106569ImageMagick: ImageMagick: Denial of Service via crafted ASE image→
681. CVE-2026-106568ImageMagick: ImageMagick: Denial of Service via crafted XMP profile→
682. CVE-2026-106567ImageMagick: ImageMagick: Denial of Service via crafted PSD file→
683. CVE-2026-106566ImageMagick: ImageMagick: File overwrite via improper delegate symlink cleanup→
684. CVE-2026-106565ImageMagick: ImageMagick: Denial of Service via missing end-of-file check in bzip2 images→
685. CVE-2026-106564ImageMagick: ImageMagick: Denial of Service via crafted EXR image→
686. CVE-2026-106555openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence→
687. CVE-2026-106553openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication→
688. CVE-2026-106552openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy→
689. CVE-2026-106453org.lz4/lz4-java: lz4-java: Denial of Service via untrusted decompressed length header→
690. CVE-2026-106452org.lz4/lz4-java: lz4-java: Denial of Service via excessive memory allocation→
691. CVE-2026-106451org.lz4/lz4-java: lz4-java: Arbitrary code execution via insecure temporary file handling→
692. CVE-2026-106450org.lz4/lz4-java: lz4-java: Denial of Service via excessive memory allocation from crafted compressed streams→
693. CVE-2026-106449org.lz4/lz4-java: lz4-java: Denial of Service via stack exhaustion from empty blocks→
694. CVE-2026-106446handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)→
695. CVE-2026-106445handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass→
696. CVE-2026-106419chromium-browser: angle: Use after free in ANGLE→
697. CVE-2026-106399chromium-browser: skia: Out of bounds read in Skia→
698. CVE-2026-106379chromium-browser: skia: Uninitialized resource in Skia→
699. CVE-2026-106376chromium-browser: angle: Uninitialized resource in ANGLE→
700. CVE-2026-106304chromium-browser: angle: Out of bounds read in ANGLE→