Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

Libsoup: libsoup: http request smuggling via malformed chunk headers

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()

Golang-fips: golang fips zeroed buffer

Sssd: use-after-free crash in sssd' 'sssd_pam' process

Grub2: ufs: integer overflow may lead to heap based out-of-bounds write when handling symlinks

Grub2: command/gpg: use-after-free due to hooks not being removed on module unload

Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

Gimp: gimp: heap buffer overflow in hot color filter on oversized image

Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions

Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions

Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions

Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing

Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling

Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8

M17n-lib: heap use-after-free write in re_init_ic()

M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()

Sssd: sssd: denial of service via incomplete identity provider authentication requests

Sssd: sssd: denial of service via crafted passkey kerberos authentication request

Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

Device-mapper-multipath: local denial of service via blocking ipc send operations

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Libxml2: memory leak leading to local denial of service in xmllint interactive shell

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

Gimp: gimp: paa integer overflow out-of-bounds read

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters

Sssd: sssd: information disclosure via odata injection in entra id lookups

Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling

Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Grub2: read: integer overflow may lead to out-of-bounds write

Luksmeta: missing slot-range validation permits out-of-gap device i/o

Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()

Kernel: netfilter: xtables out-of-bounds read in u32_match_it()

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

Sssd: sssd: denial of service via missing sid extension in certificate mapping

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash