CVE 2026 document archive · 15

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,153 documents · Identifier year 2026 · 15 / 264

701. CVE-2026-106293chromium-browser: angle: Type confusion in ANGLE→
702. CVE-2026-106258chromium-browser: angle: Uninitialized resource in ANGLE→
703. CVE-2026-106247chromium-browser: angle: Buffer overflow in ANGLE→
704. CVE-2026-106245chromium-browser: angle: Uninitialized resource in ANGLE→
705. CVE-2026-106215chromium-browser: angle: Uninitialized resource in ANGLE→
706. CVE-2026-106202chromium-browser: angle: Uninitialized resource in ANGLE→
707. CVE-2026-106074nodejs: nodejs: predictable random values via snapshot entropy cache reuse→
708. CVE-2026-106073nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()→
709. CVE-2026-106072nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification→
710. CVE-2026-106071nodejs: nodejs: Permission model bypass via wildcard path matching flaw→
711. CVE-2026-106070nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch→
712. CVE-2026-106069nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames→
713. CVE-2026-106067GIMP: GIMP: heap buffer overflow in Hot color filter on oversized image→
714. CVE-2026-106066GIMP: GIMP: heap buffer overflow in raw data export on oversized image dimensions→
715. CVE-2026-106065GIMP: GIMP: heap buffer overflow in PCX export on oversized image dimensions→
716. CVE-2026-106064GIMP: GIMP: heap buffer overflow in GIF export on oversized image dimensions→
717. CVE-2026-106063GIMP: GIMP: heap buffer overflow in DICOM export on oversized image dimensions→
718. CVE-2026-106062gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file→
719. CVE-2026-106061gimp: GIMP: heap buffer over-read in X cursor (XMC) thumbnail loader on crafted file→
720. CVE-2026-106016firefox: Mitigation bypass in the File Handling component→
721. CVE-2026-105959spice-server: spice: Heap buffer overflow via GLZ dictionary max_encoders integer truncation→
722. CVE-2026-105958spice-server: spice: Heap OOB read/write via unchecked migration data offsets→
723. CVE-2026-105924qt: qt: Denial of Service via NULL pointer dereference during QCborValue to JSON conversion→
724. CVE-2026-105842lrzsz: lrzsz: Denial of Service via heap-based buffer overflow from oversized filenames→
725. CVE-2026-105841lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode→
726. CVE-2026-105840lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode→
727. CVE-2026-105827ImageMagick: ImageMagick: Denial of Service via uncontrolled recursion in CALS decoder→
728. CVE-2026-105825ImageMagick: ImageMagick: Denial of Service via crafted XMP profile→
729. CVE-2026-105823ImageMagick: ImageMagick: Security policy bypass via CUT encoder→
730. CVE-2026-105765github.com/hashicorp/consul: Consul: Information disclosure via authorization bypass in leaf certificate API→
731. CVE-2026-105712gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar→
732. CVE-2026-105626github.com/hashicorp/consul: Consul: Denial of Service via memory exhaustion in HTTP API→
733. CVE-2026-105608github.com/hashicorp/consul: Consul: Authorization bypass via service mesh proxy registration→
734. CVE-2026-105483nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames→
735. CVE-2026-105482nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character→
736. CVE-2026-105481nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse→
737. CVE-2026-105460bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()→
738. CVE-2026-105403ImageMagick: ImageMagick: Security policy bypass via crafted image→
739. CVE-2026-105402ImageMagick: ImageMagick: Denial of Service via crafted XMP profile→
740. CVE-2026-105398ImageMagick: ImageMagick: Denial of Service via heap buffer overflow in GetVirtualPixels→
741. CVE-2026-105326cups: cups: argument injection in mailto notifier via notify-recipient-uri→
742. CVE-2026-105111org.apache.bcel/bcel: Apache Commons BCEL: Stored Cross-Site Scripting via untrusted class files in Class2HTML→
743. CVE-2026-105083ImageMagick: ImageMagick: Security policy bypass via alternate XML DOCTYPE declaration→
744. CVE-2026-105081ImageMagick: ImageMagick: Security policy bypass via symbolic link→
745. CVE-2026-104988pki-core: dogtag-pki: redhat-pki: pki: EST fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject→
746. CVE-2026-104895com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser→
747. CVE-2026-104854nx: Nx: Arbitrary code execution via insecure socket permissions→
748. CVE-2026-104853nx: Nx: Arbitrary file write via path traversal in migration planning→
749. CVE-2026-104850@modelcontextprotocol/sdk: @modelcontextprotocol/client: MCP TypeScript SDK: Information disclosure via unbound OAuth credentials→
750. CVE-2026-104721ch.qos.logback/logback-classic: logback-classic: Arbitrary file write via path traversal in MDC discriminator→