gfs2: Fix use-after-free in iomap inline data write path

netfilter: flowtable: strictly check for maximum number of actions

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free

Gcc: libstdc++ integer overflow in `new` operator

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

An issue was discovered in idrac in OpenStack Ironic before 35.0.1

Glib: integer overflow in in g_escape_uri_string()

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

fast-uri vulnerable to host confusion via failed IDN canonicalization

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Dracut: dracut: root code execution via dhcp options command injection

Samba: denial of service against ad dc wins server

In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service…

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Invalid handling of CLASS != IN

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

Crash during DNSSEC validation of malicious content

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

ws: Uninitialized memory disclosure

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

Prometheus Azure AD remote write OAuth client secret exposed via config API

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0

Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Go-getter may allow to arbitrary filesystem reads through git operations

Vite has a `server.fs.deny` bypass with queries

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

P11-kit: null dereference via c_derivekey with specific null parameters

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Excessive NSEC3 iterations cause high CPU load during insecure delegation validation

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

PKCS7_verify Signature Validation Bypass in AWS-LC

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Malformed BRID/HHIT records can cause named to terminate unexpectedly

pyasn1 has a DoS vulnerability in decoder

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

Rsync: path traversal vulnerability in rsync

Rsync: --safe-links option bypass leads to path traversal

Qemu: denial of service via improper synchronization in qemu nbd server during socket closure