Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

Cri-o: cri-o checkpoint restore bypasses destination security context

Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters

Heap Use-After-Free in the PKCS7_verify() Function

protobufjs: Code injection through bytes field defaults in generated toObject code

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

Code execution vulnerability in SWIG code generation in cmd/go

Kata Container to Guest micro VM privilege escalation

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

Ovn: ovn: information disclosure via crafted dhcpv6 packets

FTP Command Injection via CRLF in basic-ftp

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

Podman: podman missing tls verification

Containers/image: digest type does not guarantee valid type

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

Apache Thrift: Swift Range crash in skip()

Kata Containers: CopyFile Policy Subversion via Symlinks

Vim modeline bypass via various options affects Vim < 9.2.0276

Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Gnutls: vulnerability in gnutls othername san export

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy

Rsync < 3.4.3 Integer Overflow Information Disclosure

Moby: Off-by-one error in plugin privilege validation

Libssh: invalid return code for chacha20 poly1305 with openssl backend

Openssh: regresshion - race condition in ssh allows rce/dos

Cri-o: cri-o: insufficient validation during container checkpoint restore

KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

Dpdk: dpdk: double offset bug in vhost log mapping calculation

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

net/sched: fix pedit partial COW leading to page cache corruption

net: gro: don't merge zcopy skbs

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

gfs2: Fix use-after-free in iomap inline data write path