Heap buffer overflow in libvpx

PostgreSQL missing validation of multibyte character length executes arbitrary code

PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

Use-after-free in the IPC component

Sandbox escape due to integer overflow in the Graphics component

Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash

Abrt: command-injection in abrt leading to local privilege escalation

The issue was addressed with improved memory handling

Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems

Libtiff: libtiff write-what-where

Libssh: incorrect return code handling in ssh_kdf() in libssh

Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme

Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service

Pcp: exposure of the redis server backend allows remote command execution via pmproxy

Postgresql: buffer overrun from integer overflow in array modification

Kernel: use after free in nvmet_tcp_free_crypto in nvme

Postgresql: extension script @substitutions@ within quoting allow sql injection

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

Libsoup: libsoup: heap buffer overflow during websocket client-frame masking

Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth

Libsoup: libsoup: heap buffer overflow during websocket message reassembly

Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to incorrect boundary conditions in the Telemetry component

Potential code smuggling via doc comments in cmd/cgo

Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response

Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication

Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

Buildah: buildah: container escape via improper bind mount validation

runc container breakout through process.cwd trickery and leaked fds

Libxml2: double-free/uaf in libxml2 python bindings

Udisks: out-of-bounds read in udisks daemon

Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

net: pull headers in qdisc_pkt_len_segs_init()

No description published yet

Podman: podman missing tls verification

Containers/image: digest type does not guarantee valid type

Shim: rce in http boot support may lead to secure boot bypass

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()