CVE 2026 document archive · 87
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
13,154 documents · Identifier year 2026 · 87 / 264
- CVE-2026-86409curl: curl: stale SigV4 headers sent unintended
- CVE-2026-86350tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up
- CVE-2026-86345389-ds-base: 389-ds-base: StartTLS plaintext-buffer retention allows on-path attacker to forge an LDAP client's authentication result
- CVE-2026-86344389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-PDU connection requeue
- CVE-2026-86320flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
- CVE-2026-86315Escargot: Escargot: Out-of-bounds write leads to Denial of Service
- CVE-2026-86248tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
- CVE-2026-86145pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions
- CVE-2026-86144libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
- CVE-2026-86143libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks
- CVE-2026-86142libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
- CVE-2026-86141libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt
- CVE-2026-86140libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements
- CVE-2026-86139libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution
- CVE-2026-86138libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow
- CVE-2026-86137libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup
- CVE-2026-86047mariadb: mariadb: SQL injection via improper identifier quoting
- CVE-2026-85985mariadb: MariaDB: Unauthorized file access via CONNECT engine functions
- CVE-2026-85977libtirpc: libtirpc: Denial of Service via unbounded memory allocation during portmapper response decoding
- CVE-2026-85769libtpms: libtpms: heap out-of-bounds read in TPM2 state unmarshalling via unchecked block_skip_read() blocksize
- CVE-2026-85748mariadb: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations
- CVE-2026-85746mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
- CVE-2026-85745mariadb: mariadb: out-of-bounds read in ST_Area with crafted MULTIPOLYGON
- CVE-2026-85623goose: Goose: Arbitrary Command Execution via Recipe Extensions
- CVE-2026-85534libsoup: libsoup: HTTP/2 client crash in on_data_source_read_callback when SETTINGS INITIAL_WINDOW_SIZE shrinks during deferred body read
- CVE-2026-85522valkey: Valkey: Remote out-of-bounds read in Slot Migration can lead to denial of service
- CVE-2026-85518openscap: openscap: Arbitrary file write via path traversal in Source DataStream decomposition
- CVE-2026-85509FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow
- CVE-2026-85508freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler
- CVE-2026-85507FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow
- CVE-2026-85506FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem
- CVE-2026-85505FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem
- CVE-2026-85504FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses
- CVE-2026-85501unbound: Unbound: Denial of Service via algorithmic complexity attacks on DNSSEC
- CVE-2026-85498polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
- CVE-2026-85393node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification
- CVE-2026-85234tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine
- CVE-2026-85231libtirpc: libtirpc: Denial of service via unbounded memory allocation during RPCSEC_GSS decoding
- CVE-2026-85218bluez: bluez: AVRCP ListPlayerAttributes double stack overflow in avrcp_list_player_attributes_rsp/avrcp_get_current_player_value
- CVE-2026-85197libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload
- CVE-2026-85152undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation
- CVE-2026-85150gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header
- CVE-2026-85090FreeRDP: FreeRDP: Heap Out-of-Bounds Read in AVC444 Chroma Combine
- CVE-2026-85089FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU
- CVE-2026-85062colord: omgovich/colord: Colord: Denial of Service via oversized malformed color strings
- CVE-2026-85049chromium-browser: skia: chromium-browser: skia: Use after free in Skia
- CVE-2026-85024undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression
- CVE-2026-85014undici: undici: Denial of Service via WebSocketStream unclean close
- CVE-2026-85013environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters
- CVE-2026-85008undici: undici: Integrity failure due to caching of unsafe HTTP method responses