netfilter: nft_inner: Fix IPv6 inner_thoff desync

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

Gnutls: gnutls: denial of service via dtls zero-length fragment

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Undertow: undertow: request smuggling via malformed http request headers

Undertow: undertow: request smuggling via inconsistent header parsing

Ruby JSON has a format string injection vulnerability

gRPC-Go has an authorization bypass via missing leading slash in :path

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths

FreeRDP has a heap-buffer-overflow in urb_select_configuration

FreeRDP has a global-buffer-overflow in crypto_base64_decode

FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

Samba: samba: remote code execution in printing subsystem via unescaped job description