CVE 2026 document archive · 205
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
13,154 documents · Identifier year 2026 · 205 / 264
- CVE-2026-40977Spring Boot: Spring Boot: Local file corruption via PID file manipulation
- CVE-2026-40976Spring Boot: Spring Boot: Security bypass due to ineffective default web security
- CVE-2026-40975Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.
- CVE-2026-40974Spring Boot: Cassandra: Spring Boot: Security bypass in Cassandra SSL connections
- CVE-2026-40973Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory
- CVE-2026-40972Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison
- CVE-2026-40971Spring Boot: Spring Boot: Information disclosure and data tampering via missing hostname verification
- CVE-2026-40970Spring Boot: Spring Boot: Missing hostname verification in Elasticsearch auto-configuration allows information disclosure
- CVE-2026-40930libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling
- CVE-2026-40919gimp: GIMP: Denial of Service via specially crafted Seattle Filmworks file
- CVE-2026-40918gimp: GIMP: Denial of Service via crafted PVR image file
- CVE-2026-40917gimp: GIMP: Application crashes or information disclosure via crafted ICNS image files
- CVE-2026-40916gimp: GIMP: Denial of Service due to stack buffer overflow in TIM image loader
- CVE-2026-40915gimp: GIMP: Heap buffer overflow due to integer overflow in FITS image loader
- CVE-2026-40897mathjs: Math.js: Arbitrary code execution via expression parser
- CVE-2026-40895follow-redirects: follow-redirects: Information disclosure via cross-domain redirects
- CVE-2026-40701nginx: ngx_http_ssl_module: data corruption and denial of service
- CVE-2026-40691unbound: Unbound: Denial of Service via crafted DNSCrypt query
- CVE-2026-40622unbound: Unbound: Cache manipulation via 'ghost domain names' attack
- CVE-2026-40612jq: stack overflow via unbounded recursion in jv_contains
- CVE-2026-40553gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service
- CVE-2026-40542httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification
- CVE-2026-40528opensc: OpenSC: Memory corruption via crafted profile configuration file
- CVE-2026-40510opensc: OpenSC: Memory corruption via crafted PIV smart card
- CVE-2026-40469gawk: gawk: Denial of Service due to integer overflow
- CVE-2026-40468gawk: gawk: Memory corruption via integer overflow
- CVE-2026-40467gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c
- CVE-2026-40466org.apache.activemq/activemq-all: org.apache.activemq/activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in HTTP Discovery transport
- CVE-2026-40460nginx: NGINX: Authorization bypass via IP spoofing in HTTP/3 QUIC module
- CVE-2026-40447escargot: Escargot: Denial of Service due to integer overflow or wraparound vulnerability
- CVE-2026-40396varnish: Varnish Cache: Denial of Service via workspace overflow during HTTP/1 pipelining
- CVE-2026-40394Varnish Cache: Varnish Enterprise: Varnish Cache and Varnish Enterprise: Denial of Service via workspace overflow
- CVE-2026-40386libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding
- CVE-2026-40385libexif: libexif: Information disclosure and crashes via integer overflow in Nikon MakerNote handling
- CVE-2026-40372ASP.NET Core: ASP.NET: ASP.NET Core: Privilege escalation via improper cryptographic signature verification
- CVE-2026-40356krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read
- CVE-2026-40355krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism
- CVE-2026-40354flatpak: xdg-desktop-portal: Flatpak xdg-desktop-portal: File deletion via symlink attack
- CVE-2026-40341libgphoto2: libgphoto2: Denial of Service via out-of-bounds read from untrusted USB devices
- CVE-2026-40340libgphoto2: libgphoto2: Information disclosure and denial of service via out-of-bounds read
- CVE-2026-40339libgphoto2: libgphoto2: Information Disclosure via out-of-bounds read
- CVE-2026-40338libgphoto2: libgphoto2: Information disclosure and denial of service via out-of-bounds read
- CVE-2026-40336libgphoto2: libgphoto2: Memory leak in ptp_unpack_Sony_DPD() can lead to denial of service
- CVE-2026-40335libgphoto2: libgphoto2: Information disclosure via out-of-bounds read in ptp_unpack_DPV()
- CVE-2026-40334libgphoto2: libgphoto2: Information disclosure and denial of service via missing null terminator
- CVE-2026-40333libgphoto2: libgphoto2: Information disclosure and denial of service via unbounded reads
- CVE-2026-40312ImageMagick: Magick.NET: ImageMagick and Magick.NET: Denial of Service via malicious MSL file processing
- CVE-2026-40311ImageMagick: Magick.NET: ImageMagick: Denial of Service via heap use-after-free in XMP profile processing
- CVE-2026-40310ImageMagick: Magick.NET: ImageMagick: Denial of service via heap out-of-bounds write in JP2 encoder
- CVE-2026-40254FreeRDP: FreeRDP: Information disclosure and arbitrary file modification via path traversal