crypto: algif_aead - Revert to operating out-of-place

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

Gvfs: sftp: heap-based buffer overflow in read_reply()

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

Webkitgtk: use-after-free of jscvalue function parameters

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Use-after-free in the Networking: HTTP component

Privilege escalation in the Graphics: WebRender component

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

Heap Use-After-Free in the PKCS7_verify() Function

wifi: mac80211: use safe list iteration in radar detect work

wifi: mac80211: drop stray 'static' from fast-RX rx_result

wifi: mac80211: remove station if connection prep fails

net: skbuff: propagate shared-frag marker through frag-transfer helpers

Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

PostgreSQL server undersizes allocations, via integer wraparound

A use-after-free issue was addressed with improved memory management

The issue was addressed with improved memory handling

The issue was addressed with improved memory handling

xfrm: esp: avoid in-place decrypt on shared skb frags

OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

redis-server RESTORE invalid memory access may allow remote code execution

redis-server use-after-free in unblock client flow may allow remote code execution

smb: client: validate the whole DACL before rewriting it in cifsacl

PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

Privilege escalation in the Graphics: WebRender component

Code execution vulnerability in SWIG code generation in cmd/go

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression

Libxml2: double-free/uaf in libxml2 python bindings

No description published yet

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Vim modeline bypass via various options affects Vim < 9.2.0276

Corosync: corosync: denial of service and information disclosure via crafted udp packet