Red Hat Enterprise Linux 10.0

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Binutils: binutils: arbitrary code execution via malformed xcoff object file processing

ice: fix double-free of tx_buf skb

netfilter: nat: use kfree_rcu to release ops

Virtio-win: virtio-win: memory corruption via use-after-free in virtio blk device reset

drm/gem: Try to fix change_handle ioctl, attempt 4

mm/list_lru: drain before clearing xarray entry on reparent

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Rsync: --safe-links option bypass leads to path traversal

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Libsoup: libsoup: denial of service via use-after-free in http/2 server

Corosync: corosync: denial of service via integer overflow in join message validation

Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

P11-kit: null dereference via c_derivekey with specific null parameters

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

Libxml2: libxml2: denial of service via crafted xsd-validated document

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

Libssh: libssh: use-after-free via data callbacks on closed channels

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

Libssh: libssh: denial of service via automatic certificate authentication loop

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

Gstreamer: incomplete fix of cve-2026-1940

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Libsoup: libsoup: authentication bypass via digest authentication replay attack