acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Binutils: gnu binutils: information disclosure via specially crafted xcoff object file

Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service

Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

Libssh: libssh: denial of service via oversized sftp read length

Libssh: libssh: denial of service via zero advertised channel packet size

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname…

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Inefficient candidate hostname parsing in crypto/x509

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

PostgreSQL discloses MD5-hashed passwords via covert timing channel

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

Libarchive: libarchive: denial of service via malformed iso file processing

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Libssh: libssh: denial of service via unchecked proxycommand fork() failure

SIG(0) validation during query flood may lead to undefined behavior

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown