PostgreSQL refint allows stack buffer overflow and SQL injection

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

libssh2 Heap Buffer Overflow via ETM Cipher Negotiation

libssh2 Heap Out-of-Bounds Read via publickey subsystem

libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation

libssh2 Double-Free Heap Corruption via sftp_open()

Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing

PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

PostgreSQL discloses MD5-hashed passwords via covert timing channel

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

PostgreSQL timeofday() can disclose portions of server memory

PostgreSQL server undersizes allocations, via integer wraparound

PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

xfs: resample the data fork mapping after cycling ILOCK

net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

crypto: qat - remove unused character device and IOCTLs

xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

net/handshake: Take a long-lived file reference at submit

userfaultfd: gate must_wait writability check on pte_present()