Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000_print_page() in gdevlp8k.c

Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Gvfs: gvfs-admin socket ownership race permits local root

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Icu: stack buffer overflow in the srbroot::addtag function

Gtk3: gtk2: library injection from cwd

Kernel: aoe: improper reference count leads to use-after-free vulnerability

Qemu: improper ide controller reset can lead to mbr overwrite

Xorg-x11-server: use-after-free bug in damagedestroy

Kernel: use after free bug in btsdio_remove due to race condition

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

Sssd: sssd: access control bypass via premature ldap access rule evaluation

Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.

USB: serial: io_ti: fix heap overflow in get_manuf_info()

Samba: group policy certificate enrollment uses http:// without validation

Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

Rsync: rsync server leaks arbitrary client files

Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method

Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write

Grub2: grub-core/gettext: integer overflow leads to heap oob write.

Grub2: fs/ufs: oob write in the heap

Grub2: reader/jpeg: heap oob write during jpeg parsing

Mpg123: buffer overflow when writing decoded pcm samples

Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file

Pcp: unsafe use of directories allows pcp to root privilege escalation

Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image

Nautilus: nautilus: arbitrary file deletion via trash symlink

Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

Libarchive: reading past eof may be triggered for piped file streams

Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

Opensc: potential pin bypass when card tracks its own login state

389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check

Flatpak: flatpak: arbitrary write in host context via flatpak build-init

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

Gvfs: afp: heap-based buffer overflow in dsi read path

Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers