Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Sandbox escape in the Responsive Design Mode component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

Sandbox escape in the Storage: IndexedDB component

Sandbox escape in the Graphics: WebRender component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

Hplip: incomplete fix for cve-2026-8631

IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

ipv6: fix possible UAF in icmpv6_rcv()

netfilter: conntrack: remove sprintf usage

tipc: fix double-free in tipc_buf_append()

libceph: Fix potential out-of-bounds access in crush_decode()

sctp: purge outqueue on stale COOKIE-ECHO handling

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer

Heap-buffer-overflow write in planar bitmap decoder

smb: client: validate dacloffset before building DACL pointers

Samba: remote code execution in samr

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

Sandbox escape in the Profile Backup component

Use-After-Free in SOAP using Apache map

Other issue in the WebRTC component

Incorrect boundary conditions in the Audio/Video: Playback component

Gnutls: gnutls: authentication bypass via nul character in username

tcp: fix potential race in tcp_v6_syn_recv_sock()

dlm: validate length in dlm_search_rsb_tree

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for…

Uninitialized memory in the Audio/Video: Web Codecs component

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

Handlebars.js has JavaScript Injection via AST Type Confusion

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Mitigation bypass in the Networking: HTTP component