CVE 2026 document archive · 208

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 208 / 264

10351. CVE-2026-34980cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network→
10352. CVE-2026-34979cups: OpenPrinting CUPS: Denial of Service via heap-based buffer overflow in job attribute processing→
10353. CVE-2026-34978cups: OpenPrinting CUPS: Denial of Service via path traversal in RSS notifier→
10354. CVE-2026-34956openvswitch: Open vSwitch: Denial of Service via malformed FTP EPASV command→
10355. CVE-2026-34933avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call→
10356. CVE-2026-34835rack: Rack: Host header poisoning due to malformed Host header bypasses validation→
10357. CVE-2026-34831rack: Rack: HTTP response desynchronization via incorrect Content-Length calculation with UTF-8 characters→
10358. CVE-2026-34830rack: Rack: Information disclosure via regular expression injection in X-Accel-Mapping header→
10359. CVE-2026-34829rack: Rack: Denial of Service via unbounded multipart file upload→
10360. CVE-2026-34827rack: Rack: Denial of Service via crafted multipart/form-data requests→
10361. CVE-2026-34826rack: Rack: Denial of Service via malicious HTTP Range header→
10362. CVE-2026-34786rack: Rack: Security header bypass via URL-encoded static path requests→
10363. CVE-2026-34763rack: Rack: Information disclosure via regular expression metacharacters in root path→
10364. CVE-2026-34757libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability→
10365. CVE-2026-34743xz: XZ Utils: Denial of Service via buffer overflow in index decoding→
10366. CVE-2026-34714vim: Vim: Arbitrary code execution via crafted file→
10367. CVE-2026-34589OpenEXR: OpenEXR: Memory corruption leading to arbitrary code execution or denial of service→
10368. CVE-2026-34588OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file→
10369. CVE-2026-34545OpenEXR: OpenEXR: Remote code execution via crafted EXR files→
10370. CVE-2026-34544OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing→
10371. CVE-2026-34543OpenEXR: OpenEXR: Information disclosure via malicious EXR file→
10372. CVE-2026-34502apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client→
10373. CVE-2026-34501apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client→
10374. CVE-2026-34500Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration→
10375. CVE-2026-34487Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files→
10376. CVE-2026-34486Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass→
10377. CVE-2026-34483Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve→
10378. CVE-2026-34481org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output→
10379. CVE-2026-34480org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging→
10380. CVE-2026-34479org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping→
10381. CVE-2026-34478org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames→
10382. CVE-2026-34477org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification→
10383. CVE-2026-34475Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling→
10384. CVE-2026-34380OpenEXR: OpenEXR: Denial of Service due to signed integer overflow in image decoding→
10385. CVE-2026-34379OpenEXR: OpenEXR: Denial of Service due to misaligned memory write during EXR file decoding→
10386. CVE-2026-34378OpenEXR: OpenEXR: Denial of Service via crafted EXR file integer overflow→
10387. CVE-2026-34356httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers→
10388. CVE-2026-34355httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass→
10389. CVE-2026-34353ocaml: OCaml: Information disclosure via integer overflow in Bigarray.reshape→
10390. CVE-2026-34352TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions→
10391. CVE-2026-34308mysql: JSON unspecified vulnerability (CPU Apr 2026)→
10392. CVE-2026-34304mysql: InnoDB unspecified vulnerability (CPU Apr 2026)→
10393. CVE-2026-34303mysql: Optimizer unspecified vulnerability (CPU Apr 2026)→
10394. CVE-2026-34293mysql: DML unspecified vulnerability (CPU Apr 2026)→
10395. CVE-2026-34282openjdk: Enhance TLS connection handling (Oracle CPU 2026-04)→
10396. CVE-2026-34278mysql: Optimizer unspecified vulnerability (CPU Apr 2026)→
10397. CVE-2026-34276mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026)→
10398. CVE-2026-34272mysql: Optimizer unspecified vulnerability (CPU Apr 2026)→
10399. CVE-2026-34271mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026)→
10400. CVE-2026-34270mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026)→