CVE 2026 document archive · 252

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 252 / 264

12551. CVE-2026-8948firefox: thunderbird: Same-origin policy bypass in the DOM: Networking component→
12552. CVE-2026-8947firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component→
12553. CVE-2026-8946firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component→
12554. CVE-2026-8945firefox: Sandbox escape in Firefox and Firefox Focus for Android→
12555. CVE-2026-8932libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse→
12556. CVE-2026-8927curl: Information disclosure due to uncleared proxy authentication state→
12557. CVE-2026-8926curl: curl: Information disclosure via incorrect .netrc password lookup→
12558. CVE-2026-8925curl: curl: Double-free vulnerability in SASL authentication→
12559. CVE-2026-8924curl: curl: Cookie injection via malicious HTTP server using super cookies→
12560. CVE-2026-8763org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI→
12561. CVE-2026-8723qs: qs: Denial of Service due to improper handling of null/undefined array elements→
12562. CVE-2026-8674glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration→
12563. CVE-2026-8643python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite→
12564. CVE-2026-8632HPLIP: HPLIP: Privilege escalation and arbitrary code execution via operating system command injection→
12565. CVE-2026-8631HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups→
12566. CVE-2026-8609grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route→
12567. CVE-2026-8595grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name→
12568. CVE-2026-8579chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia→
12569. CVE-2026-8567chromium-browser: angle: chromium-browser: Integer overflow in ANGLE→
12570. CVE-2026-8556chromium-browser: angle: chromium-browser: Inappropriate implementation in ANGLE→
12571. CVE-2026-8554chromium-browser: angle: chromium-browser: Type Confusion in ANGLE→
12572. CVE-2026-8525chromium-browser: angle: chromium-browser: Heap buffer overflow in ANGLE→
12573. CVE-2026-8519chromium-browser: angle: chromium-browser: Integer overflow in ANGLE→
12574. CVE-2026-8510chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia→
12575. CVE-2026-8484jansi: org.fusesource.jansi/jansi: Jansi: Heap buffer overflow leads to Denial of Service→
12576. CVE-2026-8458curl: libcurl: Unauthorized connection reuse due to a logical error→
12577. CVE-2026-8450perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file()→
12578. CVE-2026-8401firefox: thunderbird: Sandbox escape in the Profile Backup component→
12579. CVE-2026-8400java-1.8.0-ibm: Arbitrary class loading and instantiation via malicious IIOP server→
12580. CVE-2026-8391firefox: thunderbird: Other issue in the JavaScript Engine component→
12581. CVE-2026-8390firefox: Use-after-free in the JavaScript: WebAssembly component→
12582. CVE-2026-8389firefox: JIT miscompilation in the JavaScript Engine: JIT component→
12583. CVE-2026-8388firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine: JIT component→
12584. CVE-2026-8384jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications→
12585. CVE-2026-8376perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds→
12586. CVE-2026-8368perl-libwww-perl: perl-libwww-perl: Information disclosure via cross-origin redirects→
12587. CVE-2026-8358LibreOffice: LibreOffice Calc: Heap buffer overflow leads to denial of service via crafted spreadsheet document.→
12588. CVE-2026-8357libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation→
12589. CVE-2026-8356libreoffice: LibreOffice: Denial of Service via a specially crafted PPT file→
12590. CVE-2026-8286curl: curl: Insecure connection establishment due to TLS configuration mismatch→
12591. CVE-2026-8177perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names→
12592. CVE-2026-8168qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements→
12593. CVE-2026-8094firefox: thunderbird: Other issue in the WebRTC component→
12594. CVE-2026-8093firefox: Memory safety bugs fixed in Firefox 150.0.2→
12595. CVE-2026-8092firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2→
12596. CVE-2026-8091firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component→
12597. CVE-2026-8090firefox: thunderbird: Use-after-free in the DOM: Networking component→
12598. CVE-2026-7949chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia→
12599. CVE-2026-7943chromium-browser: angle: Insufficient validation of untrusted input in ANGLE→
12600. CVE-2026-7942chromium-browser: angle: Integer overflow in ANGLE→