PulseLinuxLINUX UPDATE INTELLIGENCE

CVE 2026 document archive · 203

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 203 / 264

  1. CVE-2026-42309Pillow: Pillow: Denial of Service via specially crafted coordinate input
  2. CVE-2026-42308Pillow: Pillow: Denial of Service via integer overflow in font processing
  3. CVE-2026-42307Vim: Vim: Arbitrary code execution via OS command injection in netrw plugin
  4. CVE-2026-42306github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
  5. CVE-2026-42305dulwich: Dulwich: Remote Code Execution via Malicious Git Repository
  6. CVE-2026-42284GitPython: GitPython: Arbitrary code execution via improper validation of clone options
  7. CVE-2026-42268mod_security: ModSecurity: Denial of Service via unsigned integer underflow in rule verification functions
  8. CVE-2026-42264axios: Axios: Prototype pollution allows information disclosure and request manipulation
  9. CVE-2026-42258ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments
  10. CVE-2026-42257net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input
  11. CVE-2026-42256ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication
  12. CVE-2026-42250bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file
  13. CVE-2026-42246net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS
  14. CVE-2026-42245ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses
  15. CVE-2026-42217OpenEXR: OpenEXR: Information disclosure via malformed EXR image file processing
  16. CVE-2026-42216OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files
  17. CVE-2026-42215GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks
  18. CVE-2026-42211react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode
  19. CVE-2026-42198jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication
  20. CVE-2026-42170gimp: GIMP DDS plug-in heap-based buffer overflow via BPP mismatch in load_layer() (ddsread.c)
  21. CVE-2026-42169gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
  22. CVE-2026-42154github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint
  23. CVE-2026-42151github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
  24. CVE-2026-42127grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads
  25. CVE-2026-42055nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers
  26. CVE-2026-42050ImageMagick: ImageMagick: Denial of Service due to an overflow vulnerability in MIFF file processing
  27. CVE-2026-42044axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget
  28. CVE-2026-42043axios: Axios: NO_PROXY bypass via crafted URL
  29. CVE-2026-42042axios: Axios: XSRF token bypass leading to information disclosure
  30. CVE-2026-42041axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling
  31. CVE-2026-42040axios: Axios: Incorrect null byte handling can lead to data integrity issues
  32. CVE-2026-42039axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data
  33. CVE-2026-42038axios: Axios: Information disclosure due to `no_proxy` bypass
  34. CVE-2026-42037axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header
  35. CVE-2026-42036axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used
  36. CVE-2026-42035axios: Axios: Arbitrary HTTP header injection via prototype pollution
  37. CVE-2026-42034axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits
  38. CVE-2026-42033axios: Axios: HTTP Transport Hijacking via Prototype Pollution
  39. CVE-2026-42015gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling
  40. CVE-2026-42014gnutls: gnutls: Use-after-free in gnutls_pkcs11_token_set_pin
  41. CVE-2026-42013gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name
  42. CVE-2026-42012gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs
  43. CVE-2026-42011gnutls: gnutls: Security bypass due to incorrect name constraint handling
  44. CVE-2026-42010gnutls: gnutls: Authentication Bypass via NUL Character in Username
  45. CVE-2026-42009gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability
  46. CVE-2026-42008dovecot: Dovecot: Authentication bypass via trusted proxy forwarding
  47. CVE-2026-42007dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free
  48. CVE-2026-42006dovecot: Dovecot: Denial of Service via excessive IMAP bracing
  49. CVE-2026-41992gzip: gzip: Information disclosure via global buffer overflow in LZH decompression
  50. CVE-2026-41991gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility
CVE 2026 document archive — Page 203 | PulseLinux