Apple Multiple Products Buffer Overflow Vulnerability

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

Heap-buffer-overflow write in planar bitmap decoder

Samba: remote code execution in samr

Sandbox escape in the Profile Backup component

Other issue in the WebRTC component

Incorrect boundary conditions in the Audio/Video: Playback component

tcp: fix potential race in tcp_v6_syn_recv_sock()

dlm: validate length in dlm_search_rsb_tree

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

usbip: validate number_of_packets in usbip_pack_ret_submit()

Uninitialized memory in the Audio/Video: Web Codecs component

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Workers component

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

Gnutls: gnutls: denial of service via dtls zero-length fragment

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

Samba: samba: remote code execution in printing subsystem via unescaped job description

Gvfs: sftp: heap-based buffer overflow in read_reply()

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Use-after-free in the Networking: HTTP component

Privilege escalation in the Graphics: WebRender component

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

Heap Use-After-Free in the PKCS7_verify() Function

Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

PostgreSQL server undersizes allocations, via integer wraparound

A use-after-free issue was addressed with improved memory management

The issue was addressed with improved memory handling

The issue was addressed with improved memory handling

PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

Privilege escalation in the Graphics: WebRender component

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()