PulseLinuxLINUX UPDATE INTELLIGENCE

CVE 2026 document archive · 206

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 206 / 264

  1. CVE-2026-40253openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects
  2. CVE-2026-40250OpenEXR: OpenEXR: Integer overflow leads to memory corruption and denial of service
  3. CVE-2026-40244OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in EXR image processing
  4. CVE-2026-40228systemd: systemd-journald: Unintended output to user terminals via logger command
  5. CVE-2026-40227systemd: systemd: Denial of Service via malicious IPC API call with null element
  6. CVE-2026-40226systemd: systemd nspawn: Escape-to-host action via crafted config file
  7. CVE-2026-40225systemd: udev in systemd: Privilege escalation via malicious hardware devices and unsanitized kernel output
  8. CVE-2026-40224systemd: systemd-machined: Local privilege escalation via varlink
  9. CVE-2026-40223systemd: systemd: Local unprivileged user can cause Denial of Service
  10. CVE-2026-40205dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token
  11. CVE-2026-40204dovecot: dovecot: lda_mailbox_autocreate can bypass acl restrictions
  12. CVE-2026-40203dovecot: Dovecot: Information disclosure via IMAP compression side-channel
  13. CVE-2026-40192Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing
  14. CVE-2026-40183ImageMagick: Magick.NET: ImageMagick: Denial of Service via heap write overflow in JXL encoder
  15. CVE-2026-40181react-router: React Router: Open redirect vulnerability via specially crafted URLs
  16. CVE-2026-40175axios: Axios: Remote Code Execution via Prototype Pollution escalation
  17. CVE-2026-40170ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake
  18. CVE-2026-40169ImageMagick: Magick.NET: ImageMagick: Denial of Service via crafted image leading to out-of-bounds write
  19. CVE-2026-40164jq: jq: Denial of Service via crafted JSON object causing hash collisions
  20. CVE-2026-40033freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface
  21. CVE-2026-40023Apache Log4cxx: Apache Log4cxx: Log processing impairment due to unsanitized XML characters
  22. CVE-2026-40020dovecot: dovecot: Denial of Service via IMAP SETACL command injection
  23. CVE-2026-40019dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve
  24. CVE-2026-40018dovecot: Dovecot: MySQL multi-byte escaping wrong
  25. CVE-2026-40017dovecot: Dovecot: Denial of Service via crafted IMAP message headers
  26. CVE-2026-40016dovecot: Dovecot: Denial of Service due to Sieve script CPU limit bypass
  27. CVE-2026-40015dovecot: Dovecot: Denial of Service via malformed IMAP commands in imap-hibernate service
  28. CVE-2026-40014dovecot: Dovecot: Denial of Service via crafted IMAP THREAD command
  29. CVE-2026-40013dovecot: Dovecot: Denial of Service in ManageSieve service via crafted Sieve script
  30. CVE-2026-39979jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers
  31. CVE-2026-39977flatpak-builder: path traversal leading to arbitrary file read on host when installing licence files
  32. CVE-2026-39956jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure
  33. CVE-2026-39919ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter
  34. CVE-2026-39892cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
  35. CVE-2026-39886OpenEXR: OpenEXR: Signed integer overflow in HTJ2K decompression can lead to denial of service.
  36. CVE-2026-39881vim: Vim: Arbitrary code execution via command injection in NetBeans interface
  37. CVE-2026-39872webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
  38. CVE-2026-39865axios: Axios: Denial of Service via HTTP/2 session cleanup logic state corruption
  39. CVE-2026-39836net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
  40. CVE-2026-39835golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
  41. CVE-2026-39834golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
  42. CVE-2026-39833golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
  43. CVE-2026-39832golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
  44. CVE-2026-39831golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
  45. CVE-2026-39830golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
  46. CVE-2026-39829golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
  47. CVE-2026-39828golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
  48. CVE-2026-39827golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
  49. CVE-2026-39826html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping
  50. CVE-2026-39825net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls
CVE 2026 document archive — Page 206 | PulseLinux