P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Libxml2: memory leak leading to local denial of service in xmllint interactive shell

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

Gimp: gimp: paa integer overflow out-of-bounds read

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters

Sssd: sssd: information disclosure via odata injection in entra id lookups

Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling

Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

Gimp: gimp integer overflow

Grub2: read: integer overflow may lead to out-of-bounds write

Luksmeta: missing slot-range validation permits out-of-gap device i/o

Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()

Kernel: netfilter: xtables out-of-bounds read in u32_match_it()

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

Sssd: sssd: denial of service via missing sid extension in certificate mapping

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing

Libsoup: improper handling of http vary header in libsoup caching

Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm

Libgcrypt: vulnerable to marvin attack

Gnutls: timing side-channel in the rsa-psk authentication

Glibc: potential use-after-free in getaddrinfo()

Glibc: potential use-after-free in gaih_inet()

Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin

Flatpak: flatpak: toctou race condition allows symlink redirection

Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

Libsoup: libsoup: credential leakage via http redirects

Evolution-data-server: local file disclosure via attach file:// uris

Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group

Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

Libopensc: opensc: multiple uses of uninitialized variable

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

Libarchive: integer overflow while reading warc files at archive_read_support_format_warc.c

Rsync: race condition in rsync handling symbolic links

Openjpeg: heap buffer overflow in lib/openjp2/j2k.c

Openjpeg: heap buffer overflow in bin/common/color.c

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon