Gvfs: gvfs-admin socket ownership race permits local root

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization

Icu: stack buffer overflow in the srbroot::addtag function

Kernel: use after free bug in btsdio_remove due to race condition

Sssd: sssd: access control bypass via premature ldap access rule evaluation

Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.

Samba: group policy certificate enrollment uses http:// without validation

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file

Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image

Nautilus: nautilus: arbitrary file deletion via trash symlink

Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

Gvfs: afp: heap-based buffer overflow in dsi read path

Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers

Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

Samba: ctdb fails to do integrity checking of received packets

389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance

Pcp: pcp: remote denial of service and information leakage

Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()

Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string

Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS)

Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion

389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

Samba: missing access check on reparse point operations

Samba: vfs_worm does not block directory modification

PostgreSQL discloses MD5-hashed passwords via covert timing channel

Incorrect boundary conditions in the JavaScript Engine: JIT component

A use-after-free issue was addressed with improved memory management

The issue was addressed with improved memory handling

A use-after-free issue was addressed with improved memory management