CVE 2026 document archive · 202
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
13,154 documents · Identifier year 2026 · 202 / 264
- CVE-2026-42960unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance
- CVE-2026-42959unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages
- CVE-2026-42955unbound: Unbound: DNS cache integrity issue
- CVE-2026-42946nginx: ngx_http_scgi_module: ngx_http_uwsgi_module: information disclosure and denial of service
- CVE-2026-42945nginx: NGINX: Arbitrary Code Execution Vulnerability
- CVE-2026-42944unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options
- CVE-2026-42934nginx: ngx_http_charset_module: information disclosure and denial of service
- CVE-2026-42926nginx: NGINX Open Source: Data injection via HTTP/2 proxy configuration
- CVE-2026-42923unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cache Code Path Leading to DoS
- CVE-2026-42899dotnet: .NET: infinite loop allows an attacker to cause a denial of service
- CVE-2026-42784sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion
- CVE-2026-42779Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass
- CVE-2026-42778Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)
- CVE-2026-42772openssl: openssl: Denial of Service via inefficient QUIC stream reassembly
- CVE-2026-42771openssl: Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()
- CVE-2026-42770openssl: FFC-DH Peer Validation Uses Attacker-Supplied q
- CVE-2026-42769openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate
- CVE-2026-42768openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
- CVE-2026-42767openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption
- CVE-2026-42766openssl: Possible NULL Dereference in Password-Based CMS Decryption
- CVE-2026-42765openssl: NULL Dereference in Certificate Verification with OCSP Checking
- CVE-2026-42764openssl: NULL pointer dereference in QUIC server initial packet handling
- CVE-2026-42563dulwich: Dulwich: Arbitrary code execution via malicious Git file paths during merge
- CVE-2026-42536httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc
- CVE-2026-42535httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue
- CVE-2026-42534unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic
- CVE-2026-42533nginx: NGINX: Arbitrary code execution via crafted HTTP requests
- CVE-2026-42530nginx: ngx_http_v3_module: use-after-free issue leads to denial of service
- CVE-2026-42528httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error
- CVE-2026-42508golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
- CVE-2026-42507net/textproto: golang: Golang net/textproto: Misleading error messages via input injection
- CVE-2026-42506golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
- CVE-2026-42505crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello
- CVE-2026-42504mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
- CVE-2026-42502golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
- CVE-2026-42501cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy
- CVE-2026-42499net/mail: golang: net/mail: Denial of Service via pathological email address parsing
- CVE-2026-42498tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.
- CVE-2026-42497perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction
- CVE-2026-42496perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access
- CVE-2026-42395dovecot: Dovecot: Denial of Service via NUL byte in forwarding information
- CVE-2026-42393dovecot: Dovecot: Information disclosure via timing attack on `doveadm` password/API key comparison
- CVE-2026-42392dovecot: Dovecot: Information disclosure via invalid IMAP URLFETCH command
- CVE-2026-42391dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters
- CVE-2026-42371uriparser: uriparser: Denial of Service via numeric truncation with oversized URIs
- CVE-2026-42356httpd: httpd: arbitrary code execution via incorrect handler assignment during internal CGI redirects
- CVE-2026-42342react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint
- CVE-2026-42338ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
- CVE-2026-42326ImageMagick: ImageMagick: Information disclosure via malicious IPTC input file
- CVE-2026-42311Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing