CVE 2026 document archive · 256

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 256 / 264

12751. CVE-2026-6296chromium-browser: angle: Heap buffer overflow in ANGLE→
12752. CVE-2026-6276curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers→
12753. CVE-2026-6253curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies→
12754. CVE-2026-6245sssd: out-of-bounds read in the sssd→
12755. CVE-2026-6244libpcap: libpcap: Denial of Service via crafted BPF filter program→
12756. CVE-2026-6238glibc: glibc: Application crash or uninitialized memory read via crafted DNS response→
12757. CVE-2026-6210Qt SVG: Qt SVG: Denial of Service via crafted SVG image→
12758. CVE-2026-6192uclouvain/openjpeg: OpenJPEG: Denial of Service via integer overflow in opj_pi_initialise_encode→
12759. CVE-2026-6104php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding→
12760. CVE-2026-6103php: PHP: Archive entry injection via integer overflow in TAR parser→
12761. CVE-2026-6100python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules→
12762. CVE-2026-6068nasm: NASM: Heap use after free vulnerability in response file processing→
12763. CVE-2026-6067nasm: Netwide Assembler (NASM): Arbitrary code execution via malicious assembly file processing→
12764. CVE-2026-6047libreoffice: LibreOffice: Denial of service via heap buffer overflow in OOXML document processing→
12765. CVE-2026-6045libreoffice: LibreOffice: Heap buffer overflow via crafted EMF+ graphics import→
12766. CVE-2026-6040libreoffice: LibreOffice: Heap use-after-free allows arbitrary code execution via malformed ODF number format→
12767. CVE-2026-6039libreoffice: LibreOffice: Denial of Service via specially crafted DXF polyline import→
12768. CVE-2026-6019python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module→
12769. CVE-2026-5958sed: GNU sed TOCTOU race condition→
12770. CVE-2026-5950bind: Unbounded resend loop in BIND 9 resolver→
12771. CVE-2026-5947bind: SIG(0) validation during query flood may lead to undefined behavior→
12772. CVE-2026-5946bind: BIND: Denial of Service via specially crafted DNS messages→
12773. CVE-2026-5928glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings→
12774. CVE-2026-5917libgit2: libgit2: Arbitrary code execution via shell command injection in SSH backend→
12775. CVE-2026-5879chromium-browser: angle: Insufficient validation of untrusted input in ANGLE→
12776. CVE-2026-5870chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia→
12777. CVE-2026-5868chromium-browser: angle: Heap buffer overflow in ANGLE→
12778. CVE-2026-5773curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse→
12779. CVE-2026-5745libarchive: A NULL pointer dereference vulnerability exists in the ACL parser of libarchive→
12780. CVE-2026-5735thunderbird: firefox: Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2→
12781. CVE-2026-5734thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2→
12782. CVE-2026-5733firefox: Incorrect boundary conditions in the Graphics: WebGPU component→
12783. CVE-2026-5732firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component→
12784. CVE-2026-5731thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2→
12785. CVE-2026-5713python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process.→
12786. CVE-2026-5704tar: tar: Hidden file injection via crafted archives→
12787. CVE-2026-5680undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing→
12788. CVE-2026-5674pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading→
12789. CVE-2026-5673libtheora: libtheora: Denial of Service or Information Disclosure via malformed AVI file processing→
12790. CVE-2026-5657Wireshark: Wireshark: Denial of service via iLBC codec crash→
12791. CVE-2026-5656wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark→
12792. CVE-2026-5655wireshark: Wireshark: Denial of Service due to SDP protocol dissector crash→
12793. CVE-2026-5654wireshark: Wireshark: Denial of service vulnerability in AMR-NB codec→
12794. CVE-2026-5653wireshark: Wireshark: Denial of Service via DCP-ETSI protocol dissector crash→
12795. CVE-2026-5598bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons→
12796. CVE-2026-5588bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid→
12797. CVE-2026-5545curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse→
12798. CVE-2026-5450glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width→
12799. CVE-2026-5435glibc: glibc: Out-of-bounds write via TSIG record processing→
12800. CVE-2026-5419gnutls: gnutls: Information disclosure via timing side-channel in PKCS#7 padding removal→