Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters

Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block