Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

Gimp: gimp integer overflow

Grub2: read: integer overflow may lead to out-of-bounds write

Luksmeta: missing slot-range validation permits out-of-gap device i/o

Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()

Kernel: netfilter: xtables out-of-bounds read in u32_match_it()

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

Sssd: sssd: denial of service via missing sid extension in certificate mapping

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing

Libsoup: improper handling of http vary header in libsoup caching

Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm

Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions

Libgcrypt: vulnerable to marvin attack

Gnutls: timing side-channel in the rsa-psk authentication

Glibc: potential use-after-free in getaddrinfo()

Glibc: potential use-after-free in gaih_inet()

Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin

Flatpak: flatpak: toctou race condition allows symlink redirection

Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

Libsoup: libsoup: credential leakage via http redirects

Evolution-data-server: local file disclosure via attach file:// uris

Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group

Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

Libopensc: opensc: multiple uses of uninitialized variable

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

Libarchive: integer overflow while reading warc files at archive_read_support_format_warc.c

Rsync: race condition in rsync handling symbolic links

Openjpeg: heap buffer overflow in lib/openjp2/j2k.c

Openjpeg: heap buffer overflow in bin/common/color.c

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

Parted: parted: denial of service via heap buffer overflow during fat16 resize

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()

Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading

Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry

Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader

Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file