Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

Golang-fips: golang fips zeroed buffer

Openshift-console: unauthenticated installation of helm charts

Ovn: insufficient validation of bfd packets may lead to denial of service

Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

Sssd: use-after-free crash in sssd' 'sssd_pam' process

Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanism

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

Grub2: ufs: integer overflow may lead to heap based out-of-bounds write when handling symlinks

Grub2: command/gpg: use-after-free due to hooks not being removed on module unload

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Libssh: improper sanitation of paths received from scp servers

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

Sssd: sssd: denial of service via incomplete identity provider authentication requests

Sssd: sssd: denial of service via crafted passkey kerberos authentication request

Device-mapper-multipath: local denial of service via blocking ipc send operations

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Libxml2: memory leak leading to local denial of service in xmllint interactive shell

Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode

Sssd: sssd: information disclosure via odata injection in entra id lookups

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Grub2: read: integer overflow may lead to out-of-bounds write

Luksmeta: missing slot-range validation permits out-of-gap device i/o

Cri-o: cri-o: unvalidated image env var causes daemon crash

Gcc: integer wrap in `std

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

Sssd: sssd: denial of service via missing sid extension in certificate mapping

Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing

Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm

Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions

Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin

Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes

Cri-o: large /etc/passwd file may lead to denial of service

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

Libarchive: integer overflow while reading warc files at archive_read_support_format_warc.c