Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

Libvirt: swtpm privilege escalation via symlink following

Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

Gimp: gimp: integer overflow in read_rle_channel()

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ipc: limit next_id allocation to the valid ID range

net/sched: fix pedit partial COW leading to page cache corruption

Heap buffer overflow in Calc formula compilation

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

net: gro: don't merge zcopy skbs

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

RDMA/mana: Validate rx_hash_key_len

RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

rxrpc: Fix potential UAF after skb_unshare() failure

gfs2: Fix use-after-free in iomap inline data write path

RDMA/rxe: Fix double free in rxe_srq_from_init

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

netfilter: flowtable: strictly check for maximum number of actions

drm/amd/display: Do not skip unrelated mode changes in DSC validation

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search