Docker: `PUT /containers/{id}/archive` executes container binary on the host

Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing

Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag

Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

Redis: redis: out-of-bounds read via crafted cluster bus packets

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

accel/ivpu: Add buffer overflow check in MS get_info_ioctl

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

smb: client: reject userspace cifs.spnego descriptions

selinux: fix overlayfs mmap() and mprotect() access checks

crypto: authencesn - reject short ahash digests during instance creation

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

ptrace: slightly saner 'get_dumpable()' logic

Emacs: emacs: memory corruption vulnerability when processing svg css

Gimp: gimp: application crashes or information disclosure via crafted icns image files

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Kernel: out-of-bounds read vulnerability in smbcalcsize

Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Gvfs: gvfs-admin socket ownership race permits local root

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege…

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Icu: stack buffer overflow in the srbroot::addtag function

Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9

Kernel: use after free bug in btsdio_remove due to race condition

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Sssd: sssd: access control bypass via premature ldap access rule evaluation

Gnome-tweaks: path traversal in theme installer