crypto: algif_aead - Revert to operating out-of-place

Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

net: skbuff: propagate shared-frag marker through frag-transfer helpers

protobufjs: Code injection through bytes field defaults in generated toObject code

xfrm: esp: avoid in-place decrypt on shared skb frags

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

net/sched: fix pedit partial COW leading to page cache corruption

net: gro: don't merge zcopy skbs

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

net: skbuff: preserve shared-frag marker during coalescing

netfilter: flowtable: strictly check for maximum number of actions

Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

fast-uri vulnerable to host confusion via failed IDN canonicalization

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

ws: Uninitialized memory disclosure

Quadratic string concatentation in consumeComment in net/mail

Quadratic string concatenation in consumePhrase in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

xmldom: XML injection through unvalidated DocumentType serialization

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Go JOSE affect by a panic in JWE decryption

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console