Cri-o: cri-o checkpoint restore bypasses destination security context

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Cri-o: cri-o: insufficient validation during container checkpoint restore

Gcc: libstdc++ integer overflow in `new` operator

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

Gnutls: gnutls: security bypass due to incorrect name constraint handling

Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

Gcc: integer wrap in `std

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers