Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group

Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

Libopensc: opensc: multiple uses of uninitialized variable

389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

Libarchive: integer overflow while reading warc files at archive_read_support_format_warc.c

Rsync: race condition in rsync handling symbolic links

Openjpeg: heap buffer overflow in lib/openjp2/j2k.c

Openjpeg: heap buffer overflow in bin/common/color.c

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

Parted: parted: denial of service via heap buffer overflow during fat16 resize

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()

Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading

Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry

Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader

Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file

Sssd: sssd-kcm: local denial of service via excessive memory preallocation

Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion

Sssd: sssd: denial of service via undersized packet parsing in nss responder

Sssd: sssd: denial of service via out-of-bounds read in pam responder

Sssd: sssd: denial of service via unbounded negative cache growth

Sssd: sssd: denial of service via packet length underflow in autofs responder

Sssd: sssd: denial of service via memory exhaustion in kcm responder

Sssd: sssd: denial of service via unprivileged autofs cache invalidation

Sssd: sssd: denial of service via memory exhaustion in autofs responder

Sssd: sssd: denial of service via out-of-bounds read in autofs responder

Sssd: sssd: denial of service via out-of-bounds read during passkey parsing

Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader

Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder

Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

Sssd: sssd: local denial of service due to null pointer dereference in pam responder

Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

Libvirt: information disclosure via world-readable storage volume images during clone/convert

Gimp: gimp: denial of service via signed integer overflow in fli file processing

Rpm: heap buffer overflow in ndb slot table parsing

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

Gimp: gimp: remote code execution via crafted paa file

Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk

Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images

Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users