Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

Qemu-kvm: vnc websocket handshake use-after-free

Libsoup: out-of-bounds read in cookie date handling of libsoup http library

Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

Rsync: path traversal vulnerability in rsync

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

net-imap vulnerable to STARTTLS stripping via invalid response timing

Gnutls: gnutls: security bypass due to incorrect name constraint handling

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Out of bounds read in IMAP parsing

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

Gnome-remote-desktop: uncontrolled resource consumption due to malformed rdp pdus

Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the DOM: Networking component

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component

Uninitialized memory in the Audio/Video: Web Codecs component

Vim affected by Command injection via newline in glob()

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Xorg: xmayland: use-after-free in xpresentnotify structure creation

Xorg: xwayland: use-after-free in xkb client resource removal

Xorg: xmayland: value overflow in xkbsetcompatmap()

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension

Gimp: multiple use after free in xcf parser

Gimp: multiple heap buffer overflows in tga parser

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow

Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

smb: client: reject userspace cifs.spnego descriptions

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

ptrace: slightly saner 'get_dumpable()' logic

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

Gvfs: gvfs-admin socket ownership race permits local root

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Libblockdev: lpe from allow_active to root in libblockdev via udisks

Icu: stack buffer overflow in the srbroot::addtag function