PulseLinuxLINUX UPDATE INTELLIGENCE

CVE 2026 document archive · 222

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 222 / 264

  1. CVE-2026-27978next.js: Next.js: null origin can bypass Server Actions CSRF checks
  2. CVE-2026-27977next.js: Next.js: null origin can bypass dev HMR websocket CSRF checks
  3. CVE-2026-27970@angular/core: Angular: Cross-site scripting via compromised translation files
  4. CVE-2026-27951freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
  5. CVE-2026-27950freerdp: FreeRDP: Denial of service due to incomplete fix for heap-use-after-free vulnerability
  6. CVE-2026-27904minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
  7. CVE-2026-27903minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
  8. CVE-2026-27880Grafana: Grafana: Denial of Service via unbounded memory read in feature toggle evaluation
  9. CVE-2026-27879Grafana: Grafana: Denial of Service via resample query
  10. CVE-2026-27877grafana: Grafana: Information disclosure of data-source passwords via public dashboards
  11. CVE-2026-27876grafana: grafana-enterprise-plugin: Grafana: Remote arbitrary code execution via chained SQL Expressions and Enterprise plugin attack
  12. CVE-2026-27860dovecot: Dovecot: Authentication bypass and information disclosure via LDAP filter injection
  13. CVE-2026-27859dovecot: Dovecot: Denial of Service via excessive RFC 2231 MIME parameters
  14. CVE-2026-27858dovecot: denial of service via crafted message before authentication
  15. CVE-2026-27857dovecot: denial of service via specially crafted NOOP command
  16. CVE-2026-27856dovecot: Doveadm: Full access via timing oracle attack in credential verification
  17. CVE-2026-27855dovecot: Dovecot: Replay attack allows unauthorized login via observed One-Time Password (OTP) exchange
  18. CVE-2026-27852dovecot: Dovecot: Denial of service via crafted email headers
  19. CVE-2026-27851dovecot: Dovecot: SQL/LDAP injection via incorrect safe filter interpretation with variable expansion
  20. CVE-2026-27837dottie.js: dottie.js: Unauthorized object modification via prototype pollution bypass
  21. CVE-2026-27820zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader
  22. CVE-2026-27799ImageMagick: ImageMagick: Denial of Service and data corruption due to crafted DJVU image processing
  23. CVE-2026-27798ImageMagick: ImageMagick: Information disclosure via heap buffer over-read when processing images
  24. CVE-2026-27784NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file
  25. CVE-2026-27654NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
  26. CVE-2026-27651NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  27. CVE-2026-27631Exiv2: Exiv2: Denial of Service via integer overflow in preview component
  28. CVE-2026-27623Valkey: Valkey: Denial of Service via specially crafted network requests
  29. CVE-2026-27622openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing
  30. CVE-2026-27606rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability
  31. CVE-2026-27601Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions
  32. CVE-2026-27596exiv2: Exiv2: Denial of Service via out-of-bounds read in preview component
  33. CVE-2026-27459pyOpenSSL: DTLS cookie callback buffer overflow
  34. CVE-2026-27456util-linux: TOCTOU in the mount program when setting up loop devices
  35. CVE-2026-27448pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
  36. CVE-2026-27447cups: OpenPrinting CUPS: Authorization bypass via case-insensitive username comparison
  37. CVE-2026-27171zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions
  38. CVE-2026-27148storybook: Storybook: Remote Code Execution via WebSocket Hijacking
  39. CVE-2026-27145crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
  40. CVE-2026-27144golang: cmd/compile: no-op interface conversion bypasses overlap checking
  41. CVE-2026-27143golang: cmd/compile: possible memory corruption after bound check elimination
  42. CVE-2026-27142html/template: URLs in meta content attribute actions are not escaped in html/template
  43. CVE-2026-27141golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames
  44. CVE-2026-27140cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names
  45. CVE-2026-27139os: FileInfo can escape from a Root in golang os module
  46. CVE-2026-27138crypto/x509: Panic in name constraint checking for malformed certificates in crypto/x509
  47. CVE-2026-27137crypto/x509: Incorrect enforcement of email constraints in crypto/x509
  48. CVE-2026-27136golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
  49. CVE-2026-27135nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination
  50. CVE-2026-27015freerdp: FreeRDP: Denial of Service via missing bounds check in smartcard redirection
CVE 2026 document archive — Page 222 | PulseLinux