Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

Sssd: sssd: local denial of service due to null pointer dereference in pam responder

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

Libvirt: information disclosure via world-readable storage volume images during clone/convert

Gimp: gimp: denial of service via signed integer overflow in fli file processing

Rpm: heap buffer overflow in ndb slot table parsing

Gimp: gimp: remote code execution via crafted paa file

Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk

Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images

Gimp: gimp: denial of service via integer overflow in playstation tim loader

Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing

Abrt: unsanitized systemd journal content written to dump directory files enables content injection

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes

Nano: nano: format string vulnerability leads to denial of service

Gimp: gimp: denial of service via specially crafted seattle filmworks file

Gimp: gimp: denial of service via crafted pvr image file

Gimp: gimp: denial of service due to stack buffer overflow in tim image loader

Sssd: out-of-bounds read in the sssd

Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive

Tar: tar: hidden file injection via crafted archives

Gimp: gimp: denial of service via crafted psp image file

Polkit: polkit: denial of service via unbounded input processing through standard input

Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames

Libxslt: use-after-free with key data stored cross-rvt

Sqlite: use-after-free bug in jsonparseaddnodearray

Kernel: rsvp: out-of-bounds read in rsvp_classify()

G_variant_byteswap() can take a long time with some non-normal inputs

Gvariant deserialisation does not match spec for non-normal data

Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership

Sssd: sssd: access control bypass via improper ldap shadow expiration check

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

JIT miscompilation in the DOM: Core & HTML component

Memory safety bug fixed in Thunderbird 152

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

Sssd: sssd: information disclosure via query injection in entra id lookups

Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts

Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses

Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

Samba: dns signing dos via tkey name cache exhaustion

Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet