crypto: algif_aead - Revert to operating out-of-place

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

net: skbuff: propagate shared-frag marker through frag-transfer helpers

xfrm: esp: avoid in-place decrypt on shared skb frags

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

Code execution vulnerability in SWIG code generation in cmd/go

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Potential code smuggling via doc comments in cmd/cgo

Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

Podman: podman missing tls verification

Containers/image: digest type does not guarantee valid type

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Vim modeline bypass via various options affects Vim < 9.2.0276

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

LIBPNG has a heap buffer overflow in png_set_quantize

Podman: podman kube play command may overwrite host files

Libssh: invalid return code for chacha20 poly1305 with openssl backend

Openssh: regresshion - race condition in ssh allows rce/dos

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

net/sched: fix pedit partial COW leading to page cache corruption

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

net: skbuff: preserve shared-frag marker during coalescing

netfilter: flowtable: strictly check for maximum number of actions

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…

Arbitrary file write using cgo pkg-config directive in cmd/go

Grub2: missing unregister call for gettext command may lead to use-after-free

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Grub2: net: out-of-bounds write in grub_net_search_config_file()

Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentials

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

fast-uri vulnerable to host confusion via failed IDN canonicalization

undici WebSocket client vulnerable to denial of service via fragment count bypass

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter