PulseLinuxLINUX UPDATE INTELLIGENCE

CVE 2026 document archive · 210

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 210 / 264

  1. CVE-2026-33895node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
  2. CVE-2026-33894node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification
  3. CVE-2026-33891node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse()
  4. CVE-2026-33857httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions
  5. CVE-2026-33846gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly
  6. CVE-2026-33845gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
  7. CVE-2026-33818encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
  8. CVE-2026-33814net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
  9. CVE-2026-33813golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing
  10. CVE-2026-33812golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files
  11. CVE-2026-33811net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
  12. CVE-2026-33810crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
  13. CVE-2026-33809golang: golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via maliciously crafted TIFF file
  14. CVE-2026-33762github.com/go-git/go-git/v5: go-git: Denial of Service via crafted Git index file
  15. CVE-2026-33750brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
  16. CVE-2026-33672picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions
  17. CVE-2026-33671picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns
  18. CVE-2026-33636libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion
  19. CVE-2026-33630c-ares: c-ares: Use-after-free / double-free in query-completion handling
  20. CVE-2026-33607dovecot: Dovecot: Denial of Service via IMAP LIST command
  21. CVE-2026-33606dovecot: Dovecot: Unauthorized mailbox modification via dsync command injection
  22. CVE-2026-33605dovecot: Dovecot: Denial of Service in ManageSieve login process
  23. CVE-2026-33604dovecot: Dovecot: SMTP smuggling vulnerability allows spoofed email injection
  24. CVE-2026-33603dovecot: Dovecot: Information disclosure via SCRAM TLS channel binding bypass
  25. CVE-2026-33557kafka: Apache Kafka: Authentication bypass via improper JWT validation
  26. CVE-2026-33555haproxy: HAProxy: Request smuggling via HTTP/3 parser desynchronization
  27. CVE-2026-33554freeipmi: buffer overflows on response messages via ipmi-oem
  28. CVE-2026-33536ImageMagick: ImageMagick: Denial of Service via out-of-bounds write
  29. CVE-2026-33535ImageMagick: ImageMagick: Denial of Service via out-of-bounds write in X11 display interaction path
  30. CVE-2026-33532yaml: yaml: Denial of Service via deeply nested YAML document parsing
  31. CVE-2026-33526squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling
  32. CVE-2026-33523httpd: HTTP response splitting forwarding malicious status line
  33. CVE-2026-33515Squid: Squid: Information disclosure via improper input validation in ICP traffic
  34. CVE-2026-33487github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue
  35. CVE-2026-33416libpng: libpng: Arbitrary code execution due to use-after-free vulnerability
  36. CVE-2026-33414podman: github.com/containers/podman: Podman: Arbitrary code execution via command injection in HyperV backend
  37. CVE-2026-33412vim: Vim: Arbitrary code execution via command injection in glob() function
  38. CVE-2026-33382grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads
  39. CVE-2026-33381grafana: Grafana: Temporary access control bypass for service account token minting
  40. CVE-2026-33380grafana: Grafana: Information disclosure via SQL Expressions vulnerability
  41. CVE-2026-33377grafana: Grafana: Privilege escalation via dashboard overwrite
  42. CVE-2026-33376grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default
  43. CVE-2026-33375Grafana MSSQL Data Source Plugin: Grafana MSSQL Data Source Plugin: Denial of Service via Out-Of-Memory exhaustion
  44. CVE-2026-33374grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API
  45. CVE-2026-33278unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution
  46. CVE-2026-33263dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion
  47. CVE-2026-33245react-router: React Router: Cross-Site Scripting vulnerability via untrusted React Server Component redirects
  48. CVE-2026-33244react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization
  49. CVE-2026-33228flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON.
  50. CVE-2026-33227org.apache.activemq/activemq-client: org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/activemq-web: improper limitation of a pathname to a restricted classpath directory
CVE 2026 document archive — Page 210 | PulseLinux