Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Sandbox escape in the Responsive Design Mode component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

Sandbox escape in the Storage: IndexedDB component

Sandbox escape in the Graphics: WebRender component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

ipv6: fix possible UAF in icmpv6_rcv()

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Heap-buffer-overflow write in planar bitmap decoder

Samba: remote code execution in samr

RDMA/iwcm: Fix workqueue list corruption by removing work_list

ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

Sandbox escape in the Profile Backup component

Other issue in the WebRTC component

Incorrect boundary conditions in the Audio/Video: Playback component

Gnutls: gnutls: authentication bypass via nul character in username

tcp: fix potential race in tcp_v6_syn_recv_sock()

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

usbip: validate number_of_packets in usbip_pack_ret_submit()

Uninitialized memory in the Audio/Video: Web Codecs component

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

lodash vulnerable to Code Injection via `_.template` imports key names

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Mitigation bypass in the Networking: HTTP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the CSS Parsing and Computation component

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack

FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions

Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Privilege escalation in the Messaging System component

Mitigation bypass in the DOM: HTML Parser component

Integer overflow in the Audio/Video component

Incorrect boundary conditions in the Web Audio component

Use-after-free in the Audio/Video: Playback component

Undefined behavior in the DOM: Core & HTML component