RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

gfs2: Fix use-after-free in iomap inline data write path

RDMA/rxe: Fix double free in rxe_srq_from_init

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

netfilter: flowtable: strictly check for maximum number of actions

xfrm: hold dev ref until after transport_finish NF_HOOK

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling

drm/amd/display: Do not skip unrelated mode changes in DSC validation

Binutils: binutils: arbitrary code execution via malformed xcoff object file processing

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free

Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing

Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader

net: bonding: fix use-after-free in bond_xmit_broadcast()

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

NGINX ngx_http_mp4_module vulnerability

NGINX ngx_http_mp4_module vulnerability

Use After Free in libfuse

GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability

GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability

GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability

GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability

GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability

OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery

net/sched: Enforce that teql can only be used as root qdisc

Arbitrary file write using cgo pkg-config directive in cmd/go

zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()

Grub2: missing unregister call for gettext command may lead to use-after-free

Linux-pam: incomplete fix for cve-2025-6020

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension

Linux-pam: linux-pam directory traversal

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Xfig: xfig: stack-overflow allows possible code execution via local input manipulation

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()