Heap Use-After-Free in the PKCS7_verify() Function

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…

net/sched: Enforce that teql can only be used as root qdisc

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Dracut: dracut: root code execution via dhcp options command injection

Excessive NSEC3 iterations cause high CPU load during insecure delegation validation

Rsync: path traversal vulnerability in rsync

Rsync: info leak via uninitialized stack contents

Vim affected by Command injection via newline in glob()

Xorg: xmayland: use-after-free in xpresentnotify structure creation

Xorg: xwayland: use-after-free in xkb client resource removal

Xorg: xmayland: value overflow in xkbsetcompatmap()

smb: client: reject userspace cifs.spnego descriptions

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()