CVE 2026 document archive · 237

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 237 / 264

11801. CVE-2026-21724Grafana OSS: Grafana OSS: Authorization bypass allows modification of protected webhook URLs→
11802. CVE-2026-21723grafana: Grafana: Denial of Service via uncontrolled memory usage in alertmanager templates→
11803. CVE-2026-21722grafana: Public Dashboards time range restriction on annotations can be bypassed→
11804. CVE-2026-21721grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation→
11805. CVE-2026-21720grafana: Grafana: Denial of Service via resource exhaustion from avatar requests→
11806. CVE-2026-21717nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions→
11807. CVE-2026-21716nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.→
11808. CVE-2026-21715Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions→
11809. CVE-2026-21714Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames→
11810. CVE-2026-21713Node.js: Node.js: Information disclosure via timing oracle in HMAC verification→
11811. CVE-2026-21712Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing→
11812. CVE-2026-21711Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks→
11813. CVE-2026-21710Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header→
11814. CVE-2026-21637nodejs: Nodejs denial of service→
11815. CVE-2026-21636nodejs: Nodejs network segmentation bypass→
11816. CVE-2026-21444limtpms: libtpms: Remote data confidentiality compromise via incorrect Initialization Vector (IV) handling→
11817. CVE-2026-21441urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)→
11818. CVE-2026-21413LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading→
11819. CVE-2026-21226azure-core: Azure Core shared client library for Python Remote Code Execution Vulnerability→
11820. CVE-2026-20911LibRaw: LibRaw: Arbitrary Code Execution via specially crafted file→
11821. CVE-2026-20889LibRaw: LibRaw: Arbitrary code execution via specially crafted image file→
11822. CVE-2026-20884LibRaw: LibRaw: Arbitrary code execution via integer overflow in deflate_dng_load_raw→
11823. CVE-2026-20709microcode_ctl: Intel Processors: Escalation of privilege due to default cryptographic key→
11824. CVE-2026-20691webkitgtk: A maliciously crafted webpage may be able to fingerprint the user→
11825. CVE-2026-20676webkitgtk: A website may be able to track users through Safari web extensions→
11826. CVE-2026-20665webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced→
11827. CVE-2026-20664webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash→
11828. CVE-2026-20652webkitgtk: A remote attacker may be able to cause a denial-of-service→
11829. CVE-2026-20644webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash→
11830. CVE-2026-20643webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy→
11831. CVE-2026-20636webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash→
11832. CVE-2026-20635webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash→
11833. CVE-2026-20608webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash→
11834. CVE-2026-19999assimp: Assimp: Remote buffer overflow allows information disclosure or denial of service→
11835. CVE-2026-19970assimp: Assimp: Remote heap-based buffer overflow vulnerability→
11836. CVE-2026-19969assimp: Assimp: Buffer overflow in 3DGS MDL7 model processing→
11837. CVE-2026-19968assimp: Assimp: Denial of service via heap-based buffer overflow in 3DGS MDL7 Model Parser→
11838. CVE-2026-19967assimp: Assimp: Heap-based buffer overflow in file decompression→
11839. CVE-2026-19953URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization→
11840. CVE-2026-19941bind9: bind: BIND 9: DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records→
11841. CVE-2026-19931curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication→
11842. CVE-2026-19880ch.qos.logback/logback-classic: Logback-classic: Path traversal allows arbitrary log file creation→
11843. CVE-2026-19879io.undertow/undertow: Undertow: HTTP response header integrity issue due to character truncation→
11844. CVE-2026-19864org.eclipse.jetty/jetty-security: Eclipse Jetty: Plaintext password disclosure via session persistence→
11845. CVE-2026-19843389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor→
11846. CVE-2026-19816packagekit: PackageKit: PackageKit dnf5 ignores SIMULATE on RepoRemove→
11847. CVE-2026-19774bluez: BlueZ: Arbitrary Code Execution via A2DP Stack-based Buffer Overflow→
11848. CVE-2026-19730podman: podman: Quadlet install --replace non-truncating write retains removed host-access directives→
11849. CVE-2026-19696wireshark: Out-of-bounds Write in Wireshark→
11850. CVE-2026-19695wireshark: Stack-based Buffer Overflow in Wireshark→