Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions

Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

Podman: arbitrary file write when importing oci archive

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

Rpm: heap buffer overflow in ndb slot table parsing

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing

pip can extract console_scripts and gui_scripts outside installation directory

Efivar: efivar: denial of service due to stack overflow in device path node parsing

Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files

Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive

Tar: tar: hidden file injection via crafted archives

Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification

Polkit: polkit: denial of service via unbounded input processing through standard input

Libxslt: use-after-free with key data stored cross-rvt

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

Libssh: libssh: denial of service via sftp responses with unknown request ids

Libssh: libssh: information disclosure via short gssapi curve25519 public key

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

MariaDB: FILE privilege was not checked for subqueries in the FROM clause

Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Unbounded name compression in certain cases causes degradation of service

Jostle logic bypass degrades resolution performance

net-imap: Command Injection via unvalidated Symbol inputs

Util-linux: util-linux: access control bypass due to improper hostname canonicalization

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

Gnutls: vulnerability in gnutls sct extension parsing

Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read

Binutils: binutils: denial of service via crafted elf file

Non-CA certificate accepted as intermediate issuer in public_key path validation

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Libssh: libssh: information disclosure via proxycommand %r username expansion