pyasn1 has a DoS vulnerability in decoder

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

Qemu-kvm: vnc websocket handshake use-after-free

Libsoup: out-of-bounds read in cookie date handling of libsoup http library

Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup

Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled

Libsoup: out of bounds reads in soup_headers_parse_request()

Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition header

Libsoup: denial of service attack to websocket server

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

Rsync: path traversal vulnerability in rsync

Rsync: info leak via uninitialized stack contents

Qemu: denial of service via improper synchronization in qemu nbd server during socket closure

Out of bounds read in IMAP parsing

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

Gnome-remote-desktop: uncontrolled resource consumption due to malformed rdp pdus

Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process

Yelp: arbitrary file read

Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library

Pam: improper hostname interpretation in pam_access leads to access control bypass

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component

Uninitialized memory in the Audio/Video: Web Codecs component

Vim affected by Command injection via newline in glob()

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Xorg: xmayland: use-after-free in xpresentnotify structure creation

Xorg: xwayland: use-after-free in xkb client resource removal

Xorg: xmayland: value overflow in xkbsetcompatmap()

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension

Gimp: multiple use after free in xcf parser

Gimp: multiple heap buffer overflows in tga parser

389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow

ptrace: slightly saner 'get_dumpable()' logic

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Libblockdev: lpe from allow_active to root in libblockdev via udisks

Icu: stack buffer overflow in the srbroot::addtag function

Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

The issue was addressed with improved memory handling

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

The issue was addressed with improved memory handling

The issue was addressed with improved memory handling