OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain

wifi: iwlwifi: mld: cancel mlo_scan_start_wk

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery

Arbitrary file write using cgo pkg-config directive in cmd/go

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys

zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()

Grub2: missing unregister call for gettext command may lead to use-after-free

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension

Linux-pam: linux-pam directory traversal

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Yggdrasil: local privilege escalation in yggdrasil

Xorg: xwayland: use-after-free in syncinittrigger()

Xorg: xwayland: use-after-free in playreleasedevents()

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

Xorg: xwayland: heap overflow in xkbwritekeysyms()

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

X.org: xwayland: use-after-free of the root cursor

Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability

Networkmanager-libreswan: local privilege escalation via leftupdown

Glib: integer overflow in in g_escape_uri_string()

Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation

Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

Bluez: stack overflow in name2utf8 causes dos and potential code execution

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow

Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Cockpit: cockpit: denial of service via unbounded connection thread spawning

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly