crypto: algif_aead - Revert to operating out-of-place

Samba: remote code execution in samr

Gnutls: gnutls: authentication bypass via nul character in username

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

lodash vulnerable to Code Injection via `_.template` imports key names

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710,…

Gnutls: gnutls: denial of service via dtls zero-length fragment

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

xfrm: esp: avoid in-place decrypt on shared skb frags

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

Containers/image: digest type does not guarantee valid type

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Vim modeline bypass via various options affects Vim < 9.2.0276

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

Podman: podman kube play command may overwrite host files

Libssh: invalid return code for chacha20 poly1305 with openssl backend

Openssh: regresshion - race condition in ssh allows rce/dos

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

net/sched: fix pedit partial COW leading to page cache corruption

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

net: skbuff: preserve shared-frag marker during coalescing

netfilter: flowtable: strictly check for maximum number of actions

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…

Grub2: missing unregister call for gettext command may lead to use-after-free

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Cluster-monitoring-operator: credentials leak

Grub2: net: out-of-bounds write in grub_net_search_config_file()

Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentials

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()