PulseLinuxLINUX UPDATE INTELLIGENCE

CVE 2026 document archive · 85

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

13,154 documents · Identifier year 2026 · 85 / 264

  1. CVE-2026-88858grafana: Math expressions could crash Grafana
  2. CVE-2026-88816perl-DBI: perl-DBI: Denial of Service via numeric FetchHashKeyName attribute
  3. CVE-2026-88815perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting
  4. CVE-2026-88812xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling
  5. CVE-2026-88807libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats
  6. CVE-2026-88806libX11: libX11: Heap-based buffer overflow via malicious X server
  7. CVE-2026-88648gnutls: gnutls: Cross-domain certificate restriction bypass via incomplete X.509 validation
  8. CVE-2026-88647gnutls: gnutls: Information disclosure via hostname verification bypass
  9. CVE-2026-88387LibRaw: LibRaw: Denial of Service via improper numeric conversion
  10. CVE-2026-88386libsndfile: libsndfile: Denial of Service via misaligned memory access during WAV parsing
  11. CVE-2026-88384openexr: openexr: Denial of Service via crafted EXR file
  12. CVE-2026-88383libical: libical: Denial of Service via crafted iCalendar property parsing
  13. CVE-2026-88372libsndfile: libsndfile: Denial of Service via integer overflow in mat4_read_header()
  14. CVE-2026-88341yara: YARA: Denial of Service via crafted compiled rule file
  15. CVE-2026-88340yara: YARA: Memory corruption and denial of service via specially crafted rule files
  16. CVE-2026-88265crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
  17. CVE-2026-88264crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
  18. CVE-2026-88252sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion
  19. CVE-2026-88092dotnet: ASP.NET Core Tampering Vulnerability
  20. CVE-2026-88059Angular: Angular: Information Leak via HttpTransferCache Bypass
  21. CVE-2026-88057@angular/core: @angular/compiler: Angular: Arbitrary code execution via sanitization bypass in host bindings
  22. CVE-2026-88054tesseract: Tesseract: Denial of Service via crafted model with empty stack dereference
  23. CVE-2026-88053tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file
  24. CVE-2026-88052tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution
  25. CVE-2026-88051tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model
  26. CVE-2026-88050tesseract: Tesseract: Out-of-bounds write leads to Denial of Service
  27. CVE-2026-88049tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service
  28. CVE-2026-88048tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data
  29. CVE-2026-88047tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file
  30. CVE-2026-88041tomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup
  31. CVE-2026-88031go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs
  32. CVE-2026-88030rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection
  33. CVE-2026-88029pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection
  34. CVE-2026-87877com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service
  35. CVE-2026-87876cups: OpenPrinting CUPS: Remaining case-insensitive username matching in scheduler side paths (CVE-2026-27447 follow-up)
  36. CVE-2026-87875cups: OpenPrinting CUPS: Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound
  37. CVE-2026-87866curl: curl: wolfSSL public-key pinning bypass
  38. CVE-2026-87865curl: curl: knownhost callback mismatches key as missing
  39. CVE-2026-87864curl: IMAP APPEND plus CRLF conversion command injection
  40. CVE-2026-87863curl: curl: Hsts Response Erases Persisted Entries
  41. CVE-2026-87862curl: curl: HSTS cache import drops longer-lived child
  42. CVE-2026-87861curl: curl: cross-origin reuse of a Negotiate connection
  43. CVE-2026-87859morgan: morgan: Log Injection via unescaped double quote in log fields
  44. CVE-2026-87853sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation
  45. CVE-2026-87825com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability
  46. CVE-2026-87824com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect
  47. CVE-2026-87823com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read
  48. CVE-2026-87795com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service
  49. CVE-2026-87776compression: compression: Denial of Service via memory leak on premature response close
  50. CVE-2026-87766bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
CVE 2026 document archive — Page 85 | PulseLinux