Sssd: sssd: denial of service via use-after-free in kcm ticket renewal

Libssh: null pointer dereference in libssh kex session id calculation

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Luksmeta: data corruption when handling luks1 partitions with luksmeta

Coreutils: heap buffer under-read in gnu coreutils sort via key specification

Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled

Grub2: fs/hfs+: refcount can be decremented twice

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.

Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection

Samba: vfs_streams_xattr uninitialized memory write possible

Sssd: sssd: denial of service via malformed pam v1 requests

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response

Libxml2: unbounded relaxng include recursion leading to stack overflow

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

Netavark: podman: netavark may resolve hostnames to unexpected hosts

Libssh: use of uninitialized variable in privatekey_from_file()

Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices

Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler

Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply

Libssh: libssh: denial of service via improper configuration file handling

Networkmanager: networkmanager file access

Libssh: libssh: denial of service due to malformed sftp message

Libxslt: type confusion in exsltfuncresultcompfunction of libxslt

Libssh: memory exhaustion via repeated key exchange in libssh

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

Libxml2: libxml2: denial of service via crafted xml catalogs

Popt-devel: popt-static: short realloc in poptconfigfiletostring

Popt-devel: popt-static: off-by-one in poptstuffargs

Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions

Libxml2: stack buffer overflow in xmllint interactive shell command handling

Popt-devel: popt-static: size_t underflow in singleoptionhelp