Qemu: virtio: dma reentrancy issue leads to double free vulnerability

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Incorrect boundary conditions in the Web Audio component

Memory safety bug fixed in Thunderbird 152

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags

net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

NGINX ngx_http_rewrite_module vulnerability

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by…

Rsync < 3.4.3 Integer Overflow Information Disclosure

NGINX ngx_http_rewrite_module vulnerability

Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2

redis-server Lua use-after-free may allow remote code execution

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

LIBPNG has a heap buffer overflow in png_set_quantize

Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

Mitigation bypass in the DOM: Security component

Podman: podman kube play command may overwrite host files

Libssh: invalid return code for chacha20 poly1305 with openssl backend

Openssh: regresshion - race condition in ssh allows rce/dos

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

Libndp: buffer overflow in route information length field

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

MariaDB: wsrep SST unsafe parameter handling on the donor side

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

The issue was addressed with improved checks

KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow an escalation of…

Gimp: gimp: use-after-free in xcf loader via prop_selected_path

Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

Dpdk: dpdk: double offset bug in vhost log mapping calculation

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path

Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file

Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm