CVE 2026 document archive · 241

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 241 / 264

12001. CVE-2026-17072gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing FLAC codec data in Matroska containers→
12002. CVE-2026-17039pki-core: dogtag-pki: redhat-pki: pki-core: CA renewal request processing omits realm authorization check performed by enrollment path→
12003. CVE-2026-17033grafana: Grafana: Cross-Site Scripting (XSS) via unsanitized Alertmanager generatorURL→
12004. CVE-2026-17025graphene: graphene: Stored Cross-Site Scripting via profile fields→
12005. CVE-2026-16768gdk-pixbuf: out-of-bounds read in ICO parser→
12006. CVE-2026-16743accountsservice: accountsservice: arbitrary file read via SetIconFile for systemd-homed users→
12007. CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification→
12008. CVE-2026-16730dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup→
12009. CVE-2026-16599wget: wget: Denial of Service via crafted FTP OPIE/S-KEY authentication challenge→
12010. CVE-2026-16566community.general: community.general: jenkins_credential module returns generated API token in plaintext output→
12011. CVE-2026-16560389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued RDN→
12012. CVE-2026-16554cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON→
12013. CVE-2026-16552systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a CHASE_SAFE root-to-unprivileged ownership transition bypass→
12014. CVE-2026-16531PCP: PCP: Arbitrary file creation via path traversal in pmproxy logger servlet→
12015. CVE-2026-16530PCP: PCP: Remote denial of service and information leakage→
12016. CVE-2026-16529PCP: PCP: Denial of Service due to signed integer overflow→
12017. CVE-2026-16527PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules→
12018. CVE-2026-16526PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability→
12019. CVE-2026-16524PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection→
12020. CVE-2026-16517libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header→
12021. CVE-2026-16493ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)→
12022. CVE-2026-16487bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content under default containers policy→
12023. CVE-2026-16473sbc: sbc: heap out-of-bounds read via crafted SBC audio frame→
12024. CVE-2026-16461rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting→
12025. CVE-2026-16460bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization→
12026. CVE-2026-16445dracut: dracut: Root code execution via DHCP options command injection in NetworkManager initrd module→
12027. CVE-2026-16441Eclipse Foundation OpenJ9: Eclipse OpenJ9: Incorrect method delegation can lead to integrity issues→
12028. CVE-2026-16440openj9: Eclipse OpenJ9: Denial of Service via crafted .class file→
12029. CVE-2026-16439Eclipse Foundation OpenJ9: Eclipse OpenJ9: Buffer underflow via tracing method arguments→
12030. CVE-2026-16419chromium-browser: angle: Google Chrome's ANGLE component: Sandbox escape via out-of-bounds memory access→
12031. CVE-2026-16417chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized use in Skia→
12032. CVE-2026-16413chromium-browser: angle: Chromium: Sandbox escape via out-of-bounds write in ANGLE→
12033. CVE-2026-16412firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153→
12034. CVE-2026-16411firefox: thunderbird: Memory safety bugs fixed in Firefox 153→
12035. CVE-2026-16410firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component→
12036. CVE-2026-16409firefox: thunderbird: Invalid pointer in the Security: PSM component→
12037. CVE-2026-16408firefox: thunderbird: Integer overflow in the Audio/Video: Playback component→
12038. CVE-2026-16407firefox: thunderbird: Mitigation bypass in the DOM: Service Workers component→
12039. CVE-2026-16406firefox: thunderbird: Mitigation bypass in the Networking component→
12040. CVE-2026-16405firefox: thunderbird: Information disclosure in the Networking: WebSockets component→
12041. CVE-2026-16404firefox: Spoofing issue in Firefox for Android→
12042. CVE-2026-16403firefox: thunderbird: Spoofing issue in the Address Bar component→
12043. CVE-2026-16402firefox: thunderbird: Integer overflow in the Graphics: ImageLib component→
12044. CVE-2026-16401firefox: thunderbird: Privilege escalation in the Data Loss Prevention component→
12045. CVE-2026-16400firefox: thunderbird: Information disclosure in the DOM: Security component→
12046. CVE-2026-16399firefox: thunderbird: Site isolation issue in the DOM: Navigation component→
12047. CVE-2026-16398firefox: thunderbird: Site isolation issue in the Graphics component→
12048. CVE-2026-16397firefox: Clickjacking issue in the WebExtensions component in Firefox for Android→
12049. CVE-2026-16396firefox: thunderbird: Privilege escalation in WebExtensions→
12050. CVE-2026-16395firefox: thunderbird: Integer overflow in the Audio/Video component→