Incorrect boundary conditions in the Web Audio component

Memory safety bug fixed in Thunderbird 152

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags

net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

NGINX ngx_http_rewrite_module vulnerability

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by…

Rsync < 3.4.3 Integer Overflow Information Disclosure

NGINX ngx_http_rewrite_module vulnerability

Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2

redis-server Lua use-after-free may allow remote code execution

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

LIBPNG has a heap buffer overflow in png_set_quantize

Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

Mitigation bypass in the DOM: Security component

Podman: podman kube play command may overwrite host files

Libssh: invalid return code for chacha20 poly1305 with openssl backend

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

MariaDB: wsrep SST unsafe parameter handling on the donor side

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow an escalation of…

Gimp: gimp: use-after-free in xcf loader via prop_selected_path

Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

Dpdk: dpdk: double offset bug in vhost log mapping calculation

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path

Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

Librsvg: use-after-free when xml includes have duplicated entities

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

Emacs: emacs: arbitrary code execution in flymake mode

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

Gimp: integer overflow when generating a thumbnail preview for a psd file

Crun: crun: rootful krun with passt executes container payload as host root

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

Emacs: emacs: command injection via crafted filenames in tramp

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow