Emacs: emacs: command injection via crafted filenames in tramp

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file

Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation

Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

drm/gem: Try to fix change_handle ioctl, attempt 4

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

dm log: fix out-of-bounds write due to region_count overflow

drm/amdgpu: avoid double drm_exec_fini() in userq validate

ipc: limit next_id allocation to the valid ID range

bpf: Free reuseport cBPF prog after RCU grace period.

Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

Heap buffer overflow in Calc formula compilation

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories

Vim: Arbitrary Code Execution via Python Omni-Completion

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

gfs2: Fix use-after-free in iomap inline data write path

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

procfs: fix possible double mmput() in do_procmap_query()

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling

Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing

Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write