Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check

Flatpak: flatpak: arbitrary write in host context via flatpak build-init

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

Gvfs: afp: heap-based buffer overflow in dsi read path

Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers

Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message

Pcp: pcp: remote denial of service and information leakage

Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()

Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting

Libssh: libssh: denial of service via oversized sftp read length

Libssh: libssh: denial of service via zero advertised channel packet size

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()

Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation

Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string

Pipewire: raop rtsp null deref

Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname…

Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query string

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser

389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

Inefficient candidate hostname parsing in crypto/x509

Samba: missing access check on reparse point operations

Samba: vfs_worm does not block directory modification

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

PostgreSQL discloses MD5-hashed passwords via covert timing channel

Incorrect boundary conditions in the JavaScript Engine: JIT component

A use-after-free issue was addressed with improved memory management

The issue was addressed with improved memory handling

A use-after-free issue was addressed with improved memory management

The issue was addressed with improved memory handling

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

LDAP Injection Vulnerability in LDAPStoreHelper.java