Apple Multiple Products Buffer Overflow Vulnerability

crypto: algif_aead - Revert to operating out-of-place

Glibc: buffer overflow in ld.so leading to privilege escalation

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

Hplip: incomplete fix for cve-2026-8631

IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

ipv6: fix possible UAF in icmpv6_rcv()

netfilter: conntrack: remove sprintf usage

tipc: fix double-free in tipc_buf_append()

libceph: Fix potential out-of-bounds access in crush_decode()

sctp: purge outqueue on stale COOKIE-ECHO handling

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer

Heap-buffer-overflow write in planar bitmap decoder

smb: client: validate dacloffset before building DACL pointers

Samba: remote code execution in samr

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

Sandbox escape in the Profile Backup component

Use-After-Free in SOAP using Apache map

Other issue in the WebRTC component

Incorrect boundary conditions in the Audio/Video: Playback component

Gnutls: gnutls: authentication bypass via nul character in username

tcp: fix potential race in tcp_v6_syn_recv_sock()

dlm: validate length in dlm_search_rsb_tree

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for…

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Workers component

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710,…

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling