Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 4 of 1013.
- SUSE-SU-2026:2030-1 Security update for buildah
- SUSE-SU-2026:20203-1 Security update for ucode-amd
- SUSE-SU-2026:20173-1 Security update for ucode-amd
- SUSE-SU-2026:20099-1 Security update for rust1.91, rust1.92
- SUSE-SU-2026:1931-1 Security update for podman
- SUSE-SU-2026:1540-1 Security update for podman
- SUSE-SU-2026:1508-1 Security update for podman
- SUSE-SU-2026:1495-1 Security update for containerd
- SUSE-SU-2026:1494-1 Security update for rootlesskit
- SUSE-SU-2026:1493-1 Security update for rootlesskit
- SUSE-SU-2026:1492-1 Security update for docker
- SUSE-SU-2026:1491-1 Security update for buildah
- SUSE-SU-2026:1490-1 Security update for kubernetes
- SUSE-SU-2026:1489-1 Security update for kubernetes-old
- SUSE-SU-2026:1488-1 Security update for rekor
- SUSE-SU-2026:1487-1 Security update for runc
- SUSE-SU-2026:1486-1 Security update for cosign
- SUSE-SU-2026:1484-1 Security update for container-suseconnect
- SUSE-SU-2026:1480-1 Security update for buildah
- SUSE-SU-2026:1423-1 Security update for podman
- SUSE-SU-2026:1422-1 Security update for smc-tools
- SUSE-SU-2026:1105-1 Security update for containerd
- SUSE-SU-2026:1098-1 Security update for cosign
- SUSE-SU-2026:0950-1 Security update for docker
- SUSE-SU-2026:0949-1 Security update for runc
- SUSE-SU-2026:0948-1 Security update for helm
- SUSE-SU-2026:0917-1 Security update for kubernetes
- SUSE-SU-2026:0909-1 Security update for container-suseconnect
- SUSE-SU-2026:0765-1 Security update for smc-tools
- SUSE-SU-2026:0694-1 Security update for gpg2
- SUSE-SU-2026:0667-1 Security update for redis7
- SUSE-SU-2026:0650-1 Security update for redis
- SUSE-SU-2026:0573-1 Security update for kubernetes-old
- SUSE-SU-2026:0572-1 Security update for kubernetes
- SUSE-SU-2026:0571-1 This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi
- SUSE-SU-2026:0480-1 Security update for helm
- SUSE-SU-2026:0459-1 Security update for nvidia-modprobe.cuda, nvidia-open-driver-G06-signed, nvidia-persistenced.cuda
- SUSE-SU-2026:0456-1 Security update for nvidia-modprobe.cuda, nvidia-open-driver-G06-signed, nvidia-persistenced.cuda
- SUSE-SU-2026:0423-1 Security update for python-brotlipy
- SUSE-SU-2026:0399-1 Security update for kubernetes-old
- SUSE-SU-2026:0326-1 Security update for helm
- SUSE-SU-2026:0325-1 Security update for kubernetes
- SUSE-SU-2026:0319-1 Security update for container-suseconnect
- SUSE-SU-2026:0305-1 Recommended update for kernel-firmware
- SUSE-SU-2026:0267-1 Recommended update for kernel-firmware
- SUSE-SU-2026:0216-1 Security update for kernel-firmware
- RUSTSEC-2026-0419 Unbounded memory use on large request bodies
- RUSTSEC-2026-0418 libz-sys build script leaks environment variables in the build directory
- RUSTSEC-2026-0417 Excessive CPU and memory use on crafted GraphQL documents
- RUSTSEC-2026-0416 Stack overflow on deeply nested GraphQL documents
- RUSTSEC-2026-0415 Unbounded memory use on large request bodies
- RUSTSEC-2026-0414 Exponential event growth with `ENABLE_WIKILINKS`
- RUSTSEC-2026-0413 Use-after-free of caller-owned server name in client connection constructors
- RUSTSEC-2026-0412 Arbitrary code execution when rerunning tests from a portable recording
- RUSTSEC-2026-0411 Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`
- RUSTSEC-2026-0410 WebAssembly allocator shim corrupts memory on allocation failure
- RUSTSEC-2026-0409 Use-after-free from a comparator that answers inconsistently
- RUSTSEC-2026-0408 Aliasing violations in splice, mutable iteration and cursors
- RUSTSEC-2026-0407 SSRF and local file disclosure via unvalidated URLs
- RUSTSEC-2026-0406 Use-after-free when changing a multithreaded context with an unfinished frame
- RUSTSEC-2026-0405 Out-of-bounds read with an out-of-range `InBuffer::pos`
- RUSTSEC-2026-0404 Double free in `DCtx::try_clone`
- RUSTSEC-2026-0403 Uninitialized memory exposed when streaming decompression of a legacy frame fails
- RUSTSEC-2026-0402 Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
- RUSTSEC-2026-0401 Out-of-bounds read in `train_from_buffer` when sample sizes overflow
- RUSTSEC-2026-0400 Use-after-free of a dictionary after a one-shot call on a context with an open stream
- RUSTSEC-2026-0399 Use-after-free through `init_using_cdict` and `init_using_ddict`
- RUSTSEC-2026-0398 `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
- RUSTSEC-2026-0397 `OutBuffer::around_pos` exposes uninitialized memory
- RUSTSEC-2026-0396 `Seekable` reads a NULL or out-of-bounds seek table
- RUSTSEC-2026-0395 Use-after-free with `CParameter::StableInBuffer`
- RUSTSEC-2026-0394 Build environment compiled into the library and readable at runtime
- RUSTSEC-2026-0393 Out-of-bounds read when training a dictionary from inconsistent sample sizes
- RUSTSEC-2026-0392 Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame
- RUSTSEC-2026-0391 Data from an abandoned stream leaks into the next stream on a reused context
- RUSTSEC-2026-0387 Multiple timing variability issues in operations intended to be constant-time
- RUSTSEC-2026-0386 `AsyncFd::new` and related constructors violate I/O safety
- RUSTSEC-2026-0377 `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook
- RUSTSEC-2026-0376 `wasi-http`: Guests can add conflicting content lengths to messages
- RUSTSEC-2026-0375 `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
- RUSTSEC-2026-0374 `basic-toml` is unmaintained
- RUSTSEC-2026-0373 Missing case-insensitive matching for CSS url function
- RUSTSEC-2026-0372 `zvariant_derive` is unmaintained
- RUSTSEC-2026-0371 `zbus_names` is unmaintained
- RUSTSEC-2026-0370 `zvariant` is unmaintained
- RUSTSEC-2026-0369 `ZipStreamReader::extract()` applies Unix permissions through extracted symlinks without validating the symlink target stays within the dest
- RUSTSEC-2026-0368 In `zip` 9.0.0-pre2, `ZipArchive::extract` creates a symbolic link from an archive entry after validating only the output entry path.
- RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
- RUSTSEC-2026-0366 Stack overflow when parsing deeply nested input in pest_grammars
- RUSTSEC-2026-0365 Remote DoS through unchecked `IdList` allocation in negentropy
- RUSTSEC-2026-0345 Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences
- RUSTSEC-2026-0344 Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
- RUSTSEC-2026-0343 Outgoing datagram buffer accounting can panic the sender in quinn-proto
- RUSTSEC-2026-0342 Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
- RUSTSEC-2026-0340 Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
- RUSTSEC-2026-0339 Unbounded growth of pending connection ID retirements in quinn-proto
- RUSTSEC-2026-0338 Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
- RUSTSEC-2026-0337 Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
- RUSTSEC-2026-0336 MIKEY message MAC is never verified on receive, so forged messages are accepted
- RUSTSEC-2026-0335 Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key