Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth

Libsoup: libsoup: heap buffer overflow during websocket message reassembly

Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to incorrect boundary conditions in the Telemetry component

Potential code smuggling via doc comments in cmd/cgo

Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response

Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication

Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

Libxml2: double-free/uaf in libxml2 python bindings

Udisks: out-of-bounds read in udisks daemon

Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

net: pull headers in qdisc_pkt_len_segs_init()

No description published yet

Podman: podman missing tls verification

Containers/image: digest type does not guarantee valid type

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Vim modeline bypass via various options affects Vim < 9.2.0276

Corosync: corosync: denial of service and information disclosure via crafted udp packet

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

NGINX ngx_http_dav_module vulnerability

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension…

PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

Keylime: keylime: registrar allows identity takeover via duplicate uuid registration

Gnutls: vulnerability in gnutls othername san export

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)