Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read

Binutils: binutils: denial of service via crafted elf file

Non-CA certificate accepted as intermediate issuer in public_key path validation

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Libssh: libssh: information disclosure via proxycommand %r username expansion

Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response

Libarchive: libarchive: use-after-free via aliased mac metadata copy

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption

webbrowser.open() allows leading dashes in URLs

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

Cups: cups: argument injection in mailto notifier via notify-recipient-uri

Popt-devel: popt-static: short realloc in poptconfigfiletostring

Popt-devel: popt-static: off-by-one in poptstuffargs

Libxml2: stack buffer overflow in xmllint interactive shell command handling

Popt-devel: popt-static: size_t underflow in singleoptionhelp