PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

net-imap vulnerable to STARTTLS stripping via invalid response timing

Gnutls: gnutls: security bypass due to incorrect name constraint handling

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Out of bounds read in IMAP parsing

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

Gimp: gimp: heap buffer overflow in read_channel_data()

Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the DOM: Networking component

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component

Uninitialized memory in the Audio/Video: Web Codecs component

Vim affected by Command injection via newline in glob()

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

Redis: redis: out-of-bounds read via crafted cluster bus packets

Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

smb: client: reject userspace cifs.spnego descriptions

selinux: fix overlayfs mmap() and mprotect() access checks

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

ptrace: slightly saner 'get_dumpable()' logic

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

Gvfs: gvfs-admin socket ownership race permits local root

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege…

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()