Microsoft Word Information Disclosure Vulnerability

Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib

Microsoft Bing Remote Code Execution Vulnerability

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Crash when handling long CNAME response in net

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Picomatch has a ReDoS vulnerability via extglob quantifiers

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermic

Incus does not verify combined fingerprint when downloading images from simplestreams servers

Squid vulnerable to Denial of Service in ICP Request handling

Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line

Squid has issues in ICP message handling

CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

etcd: Authorization bypasses in multiple APIs