Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

Sssd: sssd: access control bypass via premature ldap access rule evaluation

Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.

Samba: group policy certificate enrollment uses http:// without validation

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method

Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write

Grub2: grub-core/gettext: integer overflow leads to heap oob write.

Grub2: fs/ufs: oob write in the heap

Grub2: grub-core/gettext: integer overflow leads to heap oob write and read.

Grub2: reader/jpeg: heap oob write during jpeg parsing

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

Libarchive: reading past eof may be triggered for piped file streams

Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto

Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup

Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto

Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

Pcp: pcp: remote denial of service and information leakage

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()

Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

Samba: missing access check on reparse point operations

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

Apache Thrift: C++ JSON OOB read

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

SpdyStream: DOS on CRI

Libarchive: libarchive: denial of service via malformed iso file processing

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()

Libssh: double free vulnerability in libssh key export functions

Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

Golang-fips: golang fips zeroed buffer

Ovn: insufficient validation of bfd packets may lead to denial of service

Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou