Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

Integer overflow in the JavaScript: Standard Library component

Incorrect boundary conditions in the Graphics: ImageLib component

Use-after-free in the JavaScript: GC component

Incorrect boundary conditions in the WebRTC: Audio/Video component

Heap-use-after-free in gdi_set_bounds

Heap-use-after-free in update_pointer_new

FreeRDP has heap-buffer-overflow in clear_decompress_residual_data

FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface

FreeRDP has heap-buffer-overflow in clear_decompress

FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle

Sandbox escape due to incorrect boundary conditions in the Graphics component

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Workers component

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710,…

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

Gnutls: gnutls: denial of service via dtls zero-length fragment

gRPC-Go has an authorization bypass via missing leading slash in :path

FreeRDP has a heap-buffer-overflow in urb_select_configuration

FreeRDP has a global-buffer-overflow in crypto_base64_decode

FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call

Freeipa: idm: privilege escalation from host to domain admin in freeipa

Freeipa: idm: privilege escalation from host to domain admin in freeipa

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

Samba: samba: remote code execution in printing subsystem via unescaped job description

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

Gvfs: sftp: heap-based buffer overflow in read_reply()

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

Webkitgtk: use-after-free of jscvalue function parameters

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Use-after-free in the Networking: HTTP component

Privilege escalation in the Graphics: WebRender component

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

Heap Use-After-Free in the PKCS7_verify() Function