CVE 2026 document archive · 239

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 239 / 264

11901. CVE-2026-18739popt-devel: popt-static: Off-by-one in poptStuffArgs→
11902. CVE-2026-18728open-iscsi: open-iscsi: Integer underflow in iscsiuio IPv4 DHCP parsing→
11903. CVE-2026-18727open-iscsi: open-iscsi: Integer underflow in iscsiuio DHCPv6 parsing→
11904. CVE-2026-18726open-iscsi: open-iscsi: Denial of service in iscsiuio Router Advertisement parsing→
11905. CVE-2026-18725open-iscsi: open-iscsi: Out-of-bounds access in iscsiuio ICMPv6 echo handling→
11906. CVE-2026-18724open-iscsi: open-iscsi: Stack buffer overflow in idbm record parsing→
11907. CVE-2026-18663389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical Session Tracking control→
11908. CVE-2026-18662org.eclipse.jetty/jetty-security: Eclipse Jetty: Access control bypass via improper security constraint combination→
11909. CVE-2026-18660org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering→
11910. CVE-2026-18659org.eclipse.jetty/jetty-security: Eclipse Jetty: Security constraint bypass via HTTP method substrings→
11911. CVE-2026-18654aws-cli: AWS CLI: Information disclosure due to disabled SSH host key verification→
11912. CVE-2026-18651389-ds-base: 389-ds-base: SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account→
11913. CVE-2026-18649gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders→
11914. CVE-2026-18540undici: undici: HTTP response splitting via retry interceptor→
11915. CVE-2026-18508tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite→
11916. CVE-2026-18503python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff()→
11917. CVE-2026-18495libtiff: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough→
11918. CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape→
11919. CVE-2026-18453389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search→
11920. CVE-2026-18446fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority→
11921. CVE-2026-18408postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump→
11922. CVE-2026-18401tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser→
11923. CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string→
11924. CVE-2026-18369dogtag-pki: pki-core: redhat-pki: pki: ACME HTTP-01 validation SSRF via IP literal identifiers and unvalidated redirects→
11925. CVE-2026-18358gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service→
11926. CVE-2026-18355389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()→
11927. CVE-2026-18313libpcap: libpcap: Denial of Service via memory leak in rpcapd→
11928. CVE-2026-18309gimp: GIMP: Remote Code Execution via APNG file parsing integer overflow→
11929. CVE-2026-18308gimp: GIMP: Remote Code Execution via TIF File Parsing Integer Overflow→
11930. CVE-2026-18307gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow→
11931. CVE-2026-18306gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow→
11932. CVE-2026-18305gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow→
11933. CVE-2026-18304gimp: GIMP: Arbitrary code execution via crafted TIF file parsing→
11934. CVE-2026-18303gimp: GIMP: Remote code execution via TIF file parsing vulnerability→
11935. CVE-2026-18302gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow→
11936. CVE-2026-18301gimp: GIMP: Remote code execution via PSD file parsing integer overflow→
11937. CVE-2026-18300gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing→
11938. CVE-2026-18299gstreamer-plugins-good: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay→
11939. CVE-2026-18298gstreamer-plugins-good: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing→
11940. CVE-2026-18297gstreamer-plugins-base: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow→
11941. CVE-2026-18296gstreamer-plugins-good: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow→
11942. CVE-2026-18295gstreamer-plugins-good: GStreamer: Remote code execution via MRF file parsing→
11943. CVE-2026-18238libpcap: libpcap: Information disclosure via out-of-bounds read in rpcap client→
11944. CVE-2026-18220binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing→
11945. CVE-2026-18149undici: undici: Denial of Service due to orphaned response body in retry handler→
11946. CVE-2026-18147freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL→
11947. CVE-2026-18140aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON→
11948. CVE-2026-18107criu: criu: container escape via rseq critical section hijack during checkpoint/restore→
11949. CVE-2026-18103dhcp-server: dhcp-server: Persistent denial of service due to buffer overflow via OMAPI→
11950. CVE-2026-18090gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted ICNS RLE block→