Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask

Sssd: sssd: denial of service via race condition in autofs responder

Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder

Sssd: sssd: denial of service via use-after-free in kcm ticket renewal

Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk

Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal

Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery

Webkitgtk: authorization bypass through webpage::send-request signal handler

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader

Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser

Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption

Spice-vdagent: path traversal in file transfer via unsanitized filename

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser

Coreutils: heap buffer under-read in gnu coreutils sort via key specification

Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled

Grub2: fs/hfs+: refcount can be decremented twice

Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

Gvfs: mtp: out-of-bounds read in do_read()

Gvfs: sftp: uninitialized heap disclosure in read_string()

Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame

Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

Libopensc: incorrect handling length of buffers or files in libopensc

Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get

Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization

Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write

Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

Sssd: sssd: denial of service via malformed pam v1 requests

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null

Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

Libopensc: incorrect handling of the length of buffers or files in pkcs15init

Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init

Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc

Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc

Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init

389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification

Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check

Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601().

Libarchive: libarchive: use-after-free via aliased mac metadata copy

Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files