Libssh: libssh: authentication bypass via missing gssapi principal check

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

Heap Use-After-Free in the PKCS7_verify() Function

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

PostgreSQL server undersizes allocations, via integer wraparound

redis-server RESTORE invalid memory access may allow remote code execution

redis-server use-after-free in unblock client flow may allow remote code execution

Apache HTTP Server: http2: double free and possible RCE on early reset

Composer has Command Injection via Malicious Perforce Reference

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

Libxml2: double-free/uaf in libxml2 python bindings

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

Gnutls: vulnerability in gnutls othername san export

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

NGINX Open-Source ngx_http_v3_module vulnerability

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

NGINX ngx_http_rewrite_module vulnerability

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by…

NGINX ngx_http_rewrite_module vulnerability

redis-server Lua use-after-free may allow remote code execution

BusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERS

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

Podman: podman kube play command may overwrite host files

MariaDB: wsrep SST unsafe parameter handling on the donor side

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

Possible QML code injection in VectorImage component

Binutils: binutils: arbitrary code execution via malformed xcoff object file processing

Composer is vulnerable to Command Injection via Malicious Perforce Repository

PowerShell Command Injection in Podman HyperV Machine

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Gcc: libstdc++ integer overflow in `new` operator

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients