Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing

Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling

Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8

M17n-lib: heap use-after-free write in re_init_ic()

M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()

Sssd: sssd: denial of service via incomplete identity provider authentication requests

Sssd: sssd: denial of service via crafted passkey kerberos authentication request

Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

Device-mapper-multipath: local denial of service via blocking ipc send operations

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Libxml2: memory leak leading to local denial of service in xmllint interactive shell

Gnuplot: segmentation fault via io_str_init_static_internal function

Gnuplot: gnuplot segmentation fault on x11_graphics

Gnuplot: gnuplot segmentation fault on canvas_text

Gnuplot: gnuplot segmentation fault on xstrftime

Gnuplot: gnuplot segmentation fault on getannotatestring

Gnuplot: gnuplot segmentation fault on plot3d_points

Libvirt: stack use-after-free in virnetclientioeventloop()

Libvirt: negative g_new0 length can lead to unbounded memory allocation

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

Gimp: gimp: paa integer overflow out-of-bounds read

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters

Sssd: sssd: information disclosure via odata injection in entra id lookups

Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling

Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

Gimp: gimp integer overflow

Grub2: read: integer overflow may lead to out-of-bounds write

Luksmeta: missing slot-range validation permits out-of-gap device i/o

Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()

Kernel: netfilter: xtables out-of-bounds read in u32_match_it()

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

Sssd: sssd: denial of service via missing sid extension in certificate mapping

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak

Openvswitch: open vswitch: denial of service via malformed ftp epasv command