CVE 2026 document archive · 204

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 204 / 264

10151. CVE-2026-41990Libgcrypt: Libgcrypt: Denial of Service or data integrity issues from missing bounds check during Dilithium signing.→
10152. CVE-2026-41989Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext→
10153. CVE-2026-41988uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versions→
10154. CVE-2026-41907uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality→
10155. CVE-2026-41889github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions→
10156. CVE-2026-41853Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux→
10157. CVE-2026-41852spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation→
10158. CVE-2026-41843spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal→
10159. CVE-2026-41841Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution→
10160. CVE-2026-41680marked: Marked: Denial of Service via specific input sequence→
10161. CVE-2026-41675xmldom: xmldom: Arbitrary XML node injection via crafted processing instructions→
10162. CVE-2026-41673@xmldom/xmldom: xmldom: xmldom: Denial of Service via deeply nested XML documents→
10163. CVE-2026-41672xmldom: @xmldom/xmldom: xmldom: Arbitrary XML Node Injection→
10164. CVE-2026-41651PackageKit: race condition vulnerability leads to arbitrary package installation as root→
10165. CVE-2026-41637unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries→
10166. CVE-2026-41635Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass→
10167. CVE-2026-41579runc: runc: Host filesystem integrity compromised by malicious container images→
10168. CVE-2026-41568github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup→
10169. CVE-2026-41567docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload→
10170. CVE-2026-41506golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects→
10171. CVE-2026-41411vim: Command injection allows arbitrary code execution via malicious tag files→
10172. CVE-2026-41409Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix→
10173. CVE-2026-41401libyang: libyang: Potential code execution via crafted YANG XML documents→
10174. CVE-2026-41324basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings→
10175. CVE-2026-41316erb: ERB: Arbitrary code execution via deserialization bypass→
10176. CVE-2026-41305postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags→
10177. CVE-2026-41293tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated→
10178. CVE-2026-41292unbound: Unbound: Denial of Service via excessive EDNS options→
10179. CVE-2026-41284tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation→
10180. CVE-2026-41257jq: signed-int overflow in stack_reallocate→
10181. CVE-2026-41256jq: embedded NUL truncates top-level jq programs loaded with -f→
10182. CVE-2026-41254Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize→
10183. CVE-2026-41242protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields→
10184. CVE-2026-41240DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization→
10185. CVE-2026-41239DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions→
10186. CVE-2026-41238DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution→
10187. CVE-2026-41205mako: Mako: Information disclosure via path traversal vulnerability→
10188. CVE-2026-41178github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers→
10189. CVE-2026-41163bubblewrap: bubblewrap: Privilege escalation via ptrace when installed in setuid mode→
10190. CVE-2026-41142OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing→
10191. CVE-2026-41139mathjs: math.js: Arbitrary code execution via expression parser→
10192. CVE-2026-41080libexpat: expat: libexpat: Denial of Service via hash flooding with crafted XML→
10193. CVE-2026-41079cups: CUPS: Information disclosure via crafted SNMP response→
10194. CVE-2026-41066lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read→
10195. CVE-2026-41044org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: Apache ActiveMQ: Arbitrary code execution via improper input validation in admin console→
10196. CVE-2026-41035rsync: Rsync: Use-after-free vulnerability in extended attribute handling→
10197. CVE-2026-41004Spring Cloud Config Server: Spring Cloud Config: Spring Cloud Config Server: Information disclosure via trace logging→
10198. CVE-2026-41001spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path→
10199. CVE-2026-40982Spring Cloud Config: spring-cloud-config-server: Spring Cloud Config: Directory traversal allows arbitrary file access→
10200. CVE-2026-40981Spring Cloud Config: Spring Cloud Config: Information disclosure of secrets from unintended GCP projects→