[Infinite loops and heap OOB read when parsing malformed ASF headers]

[wpa_config_write() follows symlinks (no O_NOFOLLOW) -> arbitrary root file overwrite by a netdev-group user]

[grub serial-mmio secure boot bypass]

[unbounded list indices from a Word document reach a wild pointer dereference in wvAssembleSimplePAP]

[RUSTSEC-2026-0293]

[GHSA-h547-rmjf-5m2m: Table permission bypass using trailing newlines in table names]

[GHSA-prgh-72vc-3xmc: Lock-order inversion in parallel grid tile decoding deadlocks the decoder permanently]

[GHSA-fqpw-fj22-78w4: Heap out-of-bounds read in encoder plugins for images whose luma and chroma bit depths differ]

[GHSA-4rv4-953r-p24q: Unreclaimable memory leak and uncaught std::bad_alloc in heif_track_get_next_raw_sequence_sample()]

[GHSA-rhgw-q5g8-xjh2: WebCodecs decoder plugin reads the coded rectangle out of a buffer sized for the visible rectangle]

[GHSA-vg7w-rp49-4fc2: The max_items security limit is not enforced for iinf child boxes]

[GHSA-xrp2-63fq-jm8q: Unbounded iref entry list and unbounded recursion in the reference-cycle check crash the parser]

[GHSA-484h-v688-jq5j: Source URL scheme bypasses sandboxed mode protections across multiple source subtypes]

[GHSA-5qpq-xqfv-j9pg: Invalid write if a decoder is reinitialized after allocation failure]

[GHSA-mjwj-v5mr-cmcg: PAR2 symlink bypass allows pickle remote code execution.]

[GHSA-q326-jpxx-jmjc: __wrapped__ dispatch bypass allows unauthenticated API access]

[Email header injection via C-escape \r in the recipient display name]

[Email header injection via bare CR in the subject field]

[SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses]

[Remote content blocking bypass via CSS escapes in FuncIRI attributes]