Rsync: --safe-links option bypass leads to path traversal

Qemu: denial of service via improper synchronization in qemu nbd server during socket closure

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Pam: improper hostname interpretation in pam_access leads to access control bypass

Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

Apache Thrift: TSSLTransportFactory.java hostname verification

Apache Thrift: Swift Compact Protocol integer overflow

Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws

Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

ptrace: slightly saner 'get_dumpable()' logic

Users: `root` appended to group listings

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()