CVE 2026 document archive · 190
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
13,154 documents · Identifier year 2026 · 190 / 264
- CVE-2026-44608unbound: Unbound: Denial of Service due to locking inconsistency during RPZ XFR reload
- CVE-2026-44605rpm: heap buffer overflow in NDB slot table parsing
- CVE-2026-44604rpm: Command injection in rpmuncompress doUntar() via unescaped archive top-level directory name in popen() shell command
- CVE-2026-44582Next.js: Next.js: Cache poisoning allows incorrect response delivery
- CVE-2026-44581next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses
- CVE-2026-44580next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content
- CVE-2026-44579next.js: Next.js: Denial of Service via crafted POST requests to server actions
- CVE-2026-44578Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests
- CVE-2026-44577Next.js: Next.js: Denial of Service via Image Optimization API
- CVE-2026-44576Next.js: Next.js: Cache poisoning vulnerability in React Server Components
- CVE-2026-44575next.js: Next.js: Unauthorized access to protected content via middleware bypass
- CVE-2026-44574Next.js: Next.js: Authorization bypass via crafted query parameters
- CVE-2026-44573next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n
- CVE-2026-44572next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects
- CVE-2026-44517github.com/containers/buildah: Buildah: Build breakout via malicious Git repository or tar archive
- CVE-2026-44496axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name
- CVE-2026-44495axios: Axios: Information disclosure due to prototype pollution vulnerability
- CVE-2026-44494axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution
- CVE-2026-44492axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization
- CVE-2026-44490axios: Axios: Information disclosure and denial of service due to prototype pollution
- CVE-2026-44489axios: Axios: Information disclosure via Prototype Pollution
- CVE-2026-44488axios: Axios: Denial of Service due to unenforced request and response size limits
- CVE-2026-44487axios: Axios: Information disclosure of proxy credentials via redirect flows
- CVE-2026-44486axios: Axios: Information disclosure of proxy credentials via HTTP redirects
- CVE-2026-44432urllib3: urllib3: Denial of Service due to excessive HTTP response decompression
- CVE-2026-44431urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
- CVE-2026-44422freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser
- CVE-2026-44421freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs
- CVE-2026-44420freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow
- CVE-2026-44405paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use
- CVE-2026-44390unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets
- CVE-2026-44307mako: Mako: Information disclosure via directory traversal
- CVE-2026-44294protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names
- CVE-2026-44293protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors
- CVE-2026-44292protobufjs: protobufjs: Data integrity impact due to prototype pollution
- CVE-2026-44291protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution
- CVE-2026-44290protobufjs: protobufjs: Denial of Service via crafted schema
- CVE-2026-44289protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding
- CVE-2026-44288protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
- CVE-2026-44244GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration
- CVE-2026-44240basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses
- CVE-2026-44236rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service
- CVE-2026-44235rabbitmq-c: github.com/alanxz/rabbitmq-c: rabbitmq-c: Denial of Service via AMQP frame length underflow
- CVE-2026-44186httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server
- CVE-2026-44185httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server
- CVE-2026-44173mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries
- CVE-2026-44172mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
- CVE-2026-44171mariadb: mbstream: Unauthorized file creation via path traversal
- CVE-2026-44170mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
- CVE-2026-44169mariadb: MariaDB server: Information disclosure of stored routine definitions due to insufficient privilege check