net: skbuff: preserve shared-frag marker during coalescing

crypto: algif_aead - Revert to operating out-of-place

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Sandbox escape in the Responsive Design Mode component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

Sandbox escape in the Storage: IndexedDB component

Sandbox escape in the Graphics: WebRender component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

Hplip: incomplete fix for cve-2026-8631

IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

ipv6: fix possible UAF in icmpv6_rcv()

netfilter: conntrack: remove sprintf usage

tipc: fix double-free in tipc_buf_append()

nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

libceph: Fix potential out-of-bounds access in crush_decode()

sctp: purge outqueue on stale COOKIE-ECHO handling

MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer

Heap-buffer-overflow write in planar bitmap decoder

smb: client: validate dacloffset before building DACL pointers

Samba: remote code execution in samr

smb: client: fix potential UAF and double free in smb2_open_file()

RDMA/iwcm: Fix workqueue list corruption by removing work_list

ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

Possible arbitrary code execution during DNSSEC validation

Sandbox escape in the Profile Backup component

Use-After-Free in SOAP using Apache map

SQL injection in pdo_firebird via NUL bytes in quoted strings

Other issue in the WebRTC component

Incorrect boundary conditions in the Audio/Video: Playback component

Gnutls: gnutls: authentication bypass via nul character in username

tcp: fix potential race in tcp_v6_syn_recv_sock()

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

usbip: validate number_of_packets in usbip_pack_ret_submit()

Uninitialized memory in the Audio/Video: Web Codecs component

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx