Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce

Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap

Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret

Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

Gcc: integer wrap in `std

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding