Sssd: sssd: access control bypass via improper ldap shadow expiration check

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

JIT miscompilation in the DOM: Core & HTML component

Memory safety bug fixed in Thunderbird 152

Glib: glib: memory corruption via integer overflow in unicode case conversion

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

Sssd: sssd: information disclosure via query injection in entra id lookups

Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts

Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses

Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion

Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

Samba: dns signing dos via tkey name cache exhaustion

Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

Gdk-pixbuf: out-of-bounds read in ico parser

389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn

389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

Memory safety bug fixed in Thunderbird ESR 140.12

Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing

Unbounded name compression in certain cases causes degradation of service

Jostle logic bypass degrades resolution performance

Other issue in the JavaScript Engine component

No description published yet

Libsoup: libsoup: http request smuggling via duplicate content-length headers

Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

Libsoup: soupserver: denial of service via http request smuggling

Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header

Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured

Gnutls: vulnerability in gnutls sct extension parsing

Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos