Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()

389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

Emacs: emacs: memory corruption vulnerability when processing svg css

Gimp: gimp: application crashes or information disclosure via crafted icns image files

OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)

Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

Binutils: gnu binutils: information disclosure via specially crafted xcoff object file

Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker

Kernel: out-of-bounds read vulnerability in smbcalcsize

Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Gvfs: gvfs-admin socket ownership race permits local root

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization

Icu: stack buffer overflow in the srbroot::addtag function

Kernel: use after free bug in btsdio_remove due to race condition