Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

gfs2: Fix use-after-free in iomap inline data write path

RDMA/rxe: Fix double free in rxe_srq_from_init

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability

GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability

net/sched: Enforce that teql can only be used as root qdisc

Grub2: missing unregister call for gettext command may lead to use-after-free

Linux-pam: incomplete fix for cve-2025-6020

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension

Linux-pam: linux-pam directory traversal

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Xorg: xwayland: use-after-free in syncinittrigger()

Xorg: xwayland: use-after-free in playreleasedevents()

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

Xorg: xwayland: heap overflow in xkbwritekeysyms()

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

X.org: xwayland: use-after-free of the root cursor

Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability

Networkmanager-libreswan: local privilege escalation via leftupdown

Glib: integer overflow in in g_escape_uri_string()

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow

Grub2: net: out-of-bounds write in grub_net_search_config_file()

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()