net: skbuff: preserve shared-frag marker during coalescing

crypto: algif_aead - Revert to operating out-of-place

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

Gvfs: sftp: heap-based buffer overflow in read_reply()

Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute

Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

Libssh: libssh: authentication bypass via missing gssapi principal check

Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

vfio/pci: Clean up DMABUFs before disabling function

iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Use-after-free in the Networking: HTTP component

Privilege escalation in the Graphics: WebRender component

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

Heap Use-After-Free in the PKCS7_verify() Function

FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS

FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion

FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass

wifi: mac80211: use safe list iteration in radar detect work

wifi: mac80211: drop stray 'static' from fast-RX rx_result

wifi: mac80211: remove station if connection prep fails

FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass

net: skbuff: propagate shared-frag marker through frag-transfer helpers

Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

PostgreSQL server undersizes allocations, via integer wraparound

protobufjs: Code injection through bytes field defaults in generated toObject code

xfrm: esp: avoid in-place decrypt on shared skb frags

OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

redis-server RESTORE invalid memory access may allow remote code execution

redis-server use-after-free in unblock client flow may allow remote code execution

smb: client: validate the whole DACL before rewriting it in cifsacl

PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

Privilege escalation in the Graphics: WebRender component

Code execution vulnerability in SWIG code generation in cmd/go