Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Workers component

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710,…

netfilter: nft_inner: Fix IPv6 inner_thoff desync

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

Gnutls: gnutls: denial of service via dtls zero-length fragment

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Undertow: undertow: request smuggling via malformed http request headers

Undertow: undertow: request smuggling via inconsistent header parsing

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

Samba: samba: remote code execution in printing subsystem via unescaped job description

Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

Gvfs: sftp: heap-based buffer overflow in read_reply()

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

Webkitgtk: use-after-free of jscvalue function parameters

Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute

Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Use-after-free in the Networking: HTTP component

Privilege escalation in the Graphics: WebRender component

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name