Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Sandbox escape in the Responsive Design Mode component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to use-after-free in the Disability Access APIs component

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

Heap-buffer-overflow write in planar bitmap decoder

Samba: remote code execution in samr

Sandbox escape in the Profile Backup component

Other issue in the WebRTC component

Incorrect boundary conditions in the Audio/Video: Playback component

tcp: fix potential race in tcp_v6_syn_recv_sock()

dlm: validate length in dlm_search_rsb_tree

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

usbip: validate number_of_packets in usbip_pack_ret_submit()

Uninitialized memory in the Audio/Video: Web Codecs component

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Mitigation bypass in the Networking: HTTP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the CSS Parsing and Computation component

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack

FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Workers component

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

Gnutls: gnutls: denial of service via dtls zero-length fragment

gRPC-Go has an authorization bypass via missing leading slash in :path

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

Samba: samba: remote code execution in printing subsystem via unescaped job description