Containers/image: digest type does not guarantee valid type

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Vim modeline bypass via various options affects Vim < 9.2.0276

Corosync: corosync: denial of service and information disclosure via crafted udp packet

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

NGINX ngx_http_dav_module vulnerability

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension…

Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

Gnutls: vulnerability in gnutls certtool template parsing

Gnutls: vulnerability in gnutls othername san export

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Incorrect boundary conditions in the Web Audio component

Memory safety bug fixed in Thunderbird 152

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags

NGINX ngx_http_rewrite_module vulnerability

Rsync < 3.4.3 Integer Overflow Information Disclosure

NGINX ngx_http_rewrite_module vulnerability

Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2

redis-server Lua use-after-free may allow remote code execution

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

LIBPNG has a heap buffer overflow in png_set_quantize

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

Mitigation bypass in the DOM: Security component

Podman: podman kube play command may overwrite host files

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

MariaDB: wsrep SST unsafe parameter handling on the donor side

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui