PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

net-imap vulnerable to STARTTLS stripping via invalid response timing

Gnutls: gnutls: security bypass due to incorrect name constraint handling

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Out of bounds read in IMAP parsing

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the DOM: Networking component

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component

Uninitialized memory in the Audio/Video: Web Codecs component

Vim affected by Command injection via newline in glob()

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Xorg: xmayland: use-after-free in xpresentnotify structure creation

Xorg: xwayland: use-after-free in xkb client resource removal

Xorg: xmayland: value overflow in xkbsetcompatmap()

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow

Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

smb: client: reject userspace cifs.spnego descriptions

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

ptrace: slightly saner 'get_dumpable()' logic

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

Gvfs: gvfs-admin socket ownership race permits local root

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Icu: stack buffer overflow in the srbroot::addtag function