Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

Samba: ctdb fails to do integrity checking of received packets

389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance

Pcp: pcp: remote denial of service and information leakage

Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()

Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string

Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser

389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

Samba: missing access check on reparse point operations

Samba: vfs_worm does not block directory modification

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

Incorrect boundary conditions in the JavaScript Engine: JIT component

FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow

Gimp: gimp: memory corruption due to integer overflow in ico file handling

Libarchive: libarchive: denial of service via malformed iso file processing

Libsoup: libsoup: header and http request injection via crlf injection

Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

Libsoup: libsoup: http request smuggling via malformed chunk headers

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()

Libssh: double free vulnerability in libssh key export functions

Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service

Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service

Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c

Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c

Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authentication

Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an unauthorized response with digest authentication

Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()

Libsoup: heap buffer overflow in sniff_unknown()

Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing

Golang-fips: golang fips zeroed buffer

Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c

Kernel: marvin vulnerability side-channel leakage in the rsa decryption operation

Kernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication

Ipa: invalid csrf protection

Libtiff: out-of-memory in tiffopen via a craft file