CVE 2026 document archive · 207

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 207 / 264

10301. CVE-2026-39823html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content→
10302. CVE-2026-39822golang: Go os.Root: Symlink following vulnerability allows directory traversal→
10303. CVE-2026-39821golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing→
10304. CVE-2026-39820net/mail: golang: Go net/mail: Denial of Service via crafted email inputs→
10305. CVE-2026-39819cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack→
10306. CVE-2026-39817cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction→
10307. CVE-2026-39373JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens→
10308. CVE-2026-39316cups: CUPS: Denial of Service and potential arbitrary code execution via use-after-free vulnerability when deleting temporary printers.→
10309. CVE-2026-39314cups: CUPS: Denial of Service via integer underflow in IPP attribute handling→
10310. CVE-2026-39304Apache ActiveMQ Client: Apache ActiveMQ Broker: Apache ActiveMQ: Apache ActiveMQ: Denial of Service due to TLSv1.3 KeyUpdate memory exhaustion→
10311. CVE-2026-39244adm-zip: adm-zip: Denial of Service via crafted ZIP file leading to excessive memory allocation→
10312. CVE-2026-38993Cockpit: Cockpit: Arbitrary file write via directory traversal in Buckets component→
10313. CVE-2026-38974dulwich: Dulwich: Missing SSH host key verification allows potential impersonation→
10314. CVE-2026-38076jbig2dec: jbig2dec: Denial of Service via crafted input→
10315. CVE-2026-37555libsndfile: integer overflow in ima_reader_init()→
10316. CVE-2026-37460frr: FRRouting: Denial of Service via crafted BGP UPDATE message→
10317. CVE-2026-37459frr: denial of service via crafted BGP UPDATE message→
10318. CVE-2026-37458frr: denial of service via crafted UPDATE message→
10319. CVE-2026-37457frr: denial of service via crafted FlowSpec component→
10320. CVE-2026-37236github.com/grpc-ecosystem/grpc-gateway: github.com/grpc-ecosystem/grpc-gateway/v2: grpc-gateway: Access control bypass via X-HTTP-Method-Override header→
10321. CVE-2026-36499openvswitch: Open vSwitch: Denial of service via resource exhaustion due to missing upper-bound check→
10322. CVE-2026-35554Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management→
10323. CVE-2026-35549MariaDB Server: MariaDB Server: Denial of Service via large packet with caching_sha2_password authentication plugin→
10324. CVE-2026-35536tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments→
10325. CVE-2026-35535sudo: Sudo: Privilege escalation due to failure in privilege drop calls→
10326. CVE-2026-35433dotnet: .NET: improper input validation allows an attacker to elevate privileges locally→
10327. CVE-2026-35414OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option→
10328. CVE-2026-35406aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset→
10329. CVE-2026-35388OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions→
10330. CVE-2026-35387OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage→
10331. CVE-2026-35386OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username→
10332. CVE-2026-35385OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode→
10333. CVE-2026-35240mysql: Optimizer unspecified vulnerability (CPU Apr 2026)→
10334. CVE-2026-35239mysql: DML unspecified vulnerability (CPU Apr 2026)→
10335. CVE-2026-35238mysql: InnoDB unspecified vulnerability (CPU Apr 2026)→
10336. CVE-2026-35237mysql: InnoDB unspecified vulnerability (CPU Apr 2026)→
10337. CVE-2026-35236mysql: InnoDB unspecified vulnerability (CPU Apr 2026)→
10338. CVE-2026-35235mysql: GIS unspecified vulnerability (CPU Apr 2026)→
10339. CVE-2026-35234mysql: Partition unspecified vulnerability (CPU Apr 2026)→
10340. CVE-2026-35191openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting→
10341. CVE-2026-35189openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing→
10342. CVE-2026-35188openssl: Double-free When Checking OCSP Stapled Response→
10343. CVE-2026-35177vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass→
10344. CVE-2026-35094libinput: libinput: Information disclosure via dangling pointer in Lua plugin handling→
10345. CVE-2026-35093libinput: libinput: Unauthorized code execution and information disclosure through Lua bytecode plugins→
10346. CVE-2026-35092corosync: Corosync: Denial of Service via integer overflow in join message validation→
10347. CVE-2026-35091corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet→
10348. CVE-2026-34990cups: OpenPrinting CUPS: Privilege escalation via arbitrary file overwrite due to coerced authentication→
10349. CVE-2026-34986github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object→
10350. CVE-2026-34982vim: arbitrary command execution via modeline sandbox bypass→