Libssh: libssh: information disclosure via proxycommand %r username expansion

Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response

Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()

Libxml2: unbounded relaxng include recursion leading to stack overflow

Libarchive: libarchive: use-after-free via aliased mac metadata copy

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption

webbrowser.open() allows leading dashes in URLs

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

Libxml2: libxml2: denial of service via crafted xml catalogs

Cups: cups: argument injection in mailto notifier via notify-recipient-uri

Popt-devel: popt-static: short realloc in poptconfigfiletostring

Popt-devel: popt-static: off-by-one in poptstuffargs

Libxml2: stack buffer overflow in xmllint interactive shell command handling

Popt-devel: popt-static: size_t underflow in singleoptionhelp