.NET Spoofing Vulnerability

jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed

Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

P11-kit: null dereference via c_derivekey with specific null parameters

Denial of service in github.com/buger/jsonparser

Memory leak in code preparing DNSSEC proofs of non-existence

Excessive NSEC3 iterations cause high CPU load during insecure delegation validation

NGINX ngx_mail_auth_http_module vulnerability

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

nghttp2 Denial of service: Assertion failure due to the missing state validation

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions

Incorrect enforcement of email constraints in crypto/x509

Malformed Valkey Cluster bus message can lead to Remote DoS

Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

Malformed BRID/HHIT records can cause named to terminate unexpectedly

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`

Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

Libxml: null pointer dereference leads to denial of service (dos)

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

net-imap vulnerable to STARTTLS stripping via invalid response timing

Gnutls: gnutls: security bypass due to incorrect name constraint handling

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Libssh: libssh: stack buffer overflow in sftp server longname construction

Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

libssh2 userauth.c userauth_password integer overflow

Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy

MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag

Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

Redis: redis: out-of-bounds read via crafted cluster bus packets

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Binutils: gnu binutils: information disclosure via specially crafted xcoff object file

Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker