CVE 2026 document archive · 209

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 209 / 264

10401. CVE-2026-34268openjdk: Enhance key generation (Oracle CPU 2026-04)→
10402. CVE-2026-34267mysql: Optimizer unspecified vulnerability (CPU Apr 2026)→
10403. CVE-2026-34253vorbis-tools: vorbis-tools ogg123: Arbitrary code execution via buffer underflow in remote control functionality→
10404. CVE-2026-34238ImageMagick: Magick.NET: ImageMagick: Denial of Service via integer overflow in despeckle operation→
10405. CVE-2026-34230rack: Rack: Denial of Service via crafted Accept-Encoding header→
10406. CVE-2026-34197org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: Apache ActiveMQ: RCE via crafted discovery URI in Jolokia JMX-HTTP bridge→
10407. CVE-2026-34191apr-util: Apache Portable Runtime Utility: SQL Injection via apr_dbd_oracle→
10408. CVE-2026-34183openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler→
10409. CVE-2026-34182openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages→
10410. CVE-2026-34181openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys→
10411. CVE-2026-34180openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.→
10412. CVE-2026-34165github.com/go-git/go-git/v5: go-git: Denial of Service via crafted .idx file→
10413. CVE-2026-34085fontconfig: Fontconfig: Security flaw allows arbitrary code execution or system crash→
10414. CVE-2026-34080xdg-dbus-proxy: xdg-dbus-proxy: Information disclosure due to policy parser vulnerability→
10415. CVE-2026-34079flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation→
10416. CVE-2026-34078flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options→
10417. CVE-2026-34077react-router: React Router: Denial of Service via client-side Cross-Site Scripting in RSC redirect handling→
10418. CVE-2026-34073python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation→
10419. CVE-2026-34059httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()→
10420. CVE-2026-34043serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization→
10421. CVE-2026-34032httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check→
10422. CVE-2026-34003xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access→
10423. CVE-2026-34002xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling→
10424. CVE-2026-34001xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption→
10425. CVE-2026-34000xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing.→
10426. CVE-2026-33999xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling→
10427. CVE-2026-33995FreeRDP: FreeRDP: Denial of Service via double-free vulnerability during NLA connection teardown→
10428. CVE-2026-33987FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution→
10429. CVE-2026-33986FreeRDP: FreeRDP: Arbitrary code execution or denial of service via H.264 codec memory allocation vulnerability→
10430. CVE-2026-33985FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read→
10431. CVE-2026-33984FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data→
10432. CVE-2026-33983FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages→
10433. CVE-2026-33982FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read→
10434. CVE-2026-33977FreeRDP: FreeRDP: Denial of Service via malformed IMA ADPCM audio data→
10435. CVE-2026-33952FreeRDP: FreeRDP: Denial of Service via unvalidated authentication length field→
10436. CVE-2026-33948jq: jq: Input validation bypass via embedded NUL bytes allows parser differential attacks→
10437. CVE-2026-33947jq: unbounded Recursion in jv_setpath() / jv_getpath() / delpaths_sorted()→
10438. CVE-2026-33941handlebars.js: Handlebars: Arbitrary code execution via CLI precompiler input sanitization flaw→
10439. CVE-2026-33940handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context→
10440. CVE-2026-33939handlebars.js: Handlebars.js: Denial of Service via malformed decorator syntax in template compilation→
10441. CVE-2026-33938handlebars: Handlebars: Arbitrary code execution via @partial-block overwrite→
10442. CVE-2026-33937handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile()→
10443. CVE-2026-33916handlebars.js: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution→
10444. CVE-2026-33908ImageMagick: Magick.NET: ImageMagick: Denial of Service via deeply nested XML file processing→
10445. CVE-2026-33905ImageMagick: ImageMagick: Denial of service via out-of-bounds read in -sample operation→
10446. CVE-2026-33902ImageMagick: ImageMagick: Denial of Service via deeply nested expression in FX parser→
10447. CVE-2026-33901ImageMagick: Magick.NET: ImageMagick: Denial of Service due to heap buffer overflow in MVG decoder→
10448. CVE-2026-33900ImageMagick: Magick.NET: ImageMagick: Denial of Service via integer truncation in viff encoder→
10449. CVE-2026-33899ImageMagick: Magick.NET: ImageMagick: Denial of Service via out-of-bounds write in XML parsing→
10450. CVE-2026-33896node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance→