Gvfs: gvfs-admin socket ownership race permits local root

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Icu: stack buffer overflow in the srbroot::addtag function

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Sssd: sssd: access control bypass via premature ldap access rule evaluation

Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.

Librest: weak random number generation in pkce implementation

USB: serial: io_ti: fix heap overflow in get_manuf_info()

Samba: group policy certificate enrollment uses http:// without validation

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

Grub2: grub-core/gettext: integer overflow leads to heap oob write.

Grub2: fs/ufs: oob write in the heap

Grub2: grub-core/gettext: integer overflow leads to heap oob write and read.

Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image

Nautilus: nautilus: arbitrary file deletion via trash symlink

Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto

Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup

Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto

Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check

Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

Flatpak: flatpak: arbitrary write in host context via flatpak build-init

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

Gvfs: afp: heap-based buffer overflow in dsi read path

Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing

Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing

Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives

389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries