Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Binutils: gnu binutils: information disclosure via specially crafted xcoff object file

Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization