Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service

Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

Libssh: libssh: denial of service via oversized sftp read length

Libssh: libssh: denial of service via zero advertised channel packet size

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname…

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Inefficient candidate hostname parsing in crypto/x509

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

PostgreSQL discloses MD5-hashed passwords via covert timing channel

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

Libarchive: libarchive: denial of service via malformed iso file processing

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Libxml2: memory leak leading to local denial of service in xmllint interactive shell

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Libssh: libssh: denial of service via unchecked proxycommand fork() failure

SIG(0) validation during query flood may lead to undefined behavior

Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions

Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

Podman: arbitrary file write when importing oci archive

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

Rpm: heap buffer overflow in ndb slot table parsing

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup