Permalink CVE-2026-67326

7.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored maintainer @fabaff 15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

GitPython before 3.1.50 Newline Injection via config_writer section

• GitHub Security Advisory (GHSA-mv93-w799-cj2w) vendor-advisory
• VulnCheck Advisory: GitPython before 3.1.50 Newline Injection via config_writer section third-party-advisory

---

GitPython

• <3.1.50
• ==3.1.50

Permalink CVE-2026-67324

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

GitPython 3.1.50 Authentication Bypass via Joined Short Options

• GitHub Security Advisory (GHSA-v396-v7q4-x2qj) vendor-advisory
• VulnCheck Advisory: GitPython 3.1.50 Authentication Bypass via Joined Short Options third-party-advisory

---

GitPython

• <3.1.51
• ==3.1.51

Permalink CVE-2026-67323

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

GitPython before 3.1.51 Command Injection via unguarded Git options

• GitHub Security Advisory (GHSA-956x-8gvw-wg5v) vendor-advisory
• VulnCheck Advisory: GitPython before 3.1.51 Command Injection via unguarded Git options third-party-advisory

---

GitPython

• <3.1.51
• ==3.1.51

Permalink CVE-2026-67325

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

GitPython before 3.1.51 Command Injection via option prefix abbreviation

• GitHub Security Advisory (GHSA-2f96-g7mh-g2hx) vendor-advisory
• VulnCheck Advisory: GitPython before 3.1.51 Command Injection via option prefix abbreviation third-party-advisory

---

GitPython

• <3.1.51
• ==3.1.51

Permalink CVE-2026-67322

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

• GitHub Security Advisory (GHSA-rwj8-pgh3-r573) vendor-advisory
• VulnCheck Advisory: GitPython before 3.1.52 Environment Variable Exfiltration via clone_from third-party-advisory

---

GitPython

• ==3.1.52
• <3.1.52

Permalink CVE-2026-18536

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

• https://github.com/robrwo/Data-Entropy/security/advisories/GHSA-845w-rcqw-jwvv vendor-advisory
• https://metacpan.org/release/RRWO/Data-Entropy-0.010/changes release-notes
• https://metacpan.org/release/RRWO/Data-Entropy-0.008/view/lib/Data/Entropy.pm#S…
• https://security.metacpan.org/docs/guides/random-data-for-security.html technical-description
• http://www.openwall.com/lists/oss-security/2026/08/01/8

---

Data-Entropy

• <0.010

Permalink CVE-2026-67338

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse ignored
  14 packages

  • python313Packages.jupyterlab-git
  • python313Packages.jupyterlab-lsp
  • python313Packages.jupyterlab-vim
  • python314Packages.jupyterlab-git
  • python314Packages.jupyterlab-lsp
  • python314Packages.jupyterlab-vim
  • python313Packages.jupyterlab-server
  • python314Packages.jupyterlab-server
  • python313Packages.jupyterlab-widgets
  • python314Packages.jupyterlab-widgets
  • python313Packages.jupyterlab-pygments
  • python314Packages.jupyterlab-pygments
  • python313Packages.jupyterlab-execute-time
  • python314Packages.jupyterlab-execute-time
  15 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

JupyterLab before 4.5.9 Stored XSS via Extension Manager

• GitHub Security Advisory (GHSA-vmhf-c436-hxj4) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: JupyterLab before 4.5.9 Stored XSS via Extension Manager third-party-advisory

---

jupyterlab

• ==4.5.9
• <4.5.9

Permalink CVE-2026-67298

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  15 hours ago maintainer.ignore
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

• GitHub Security Advisory (GHSA-qmvw-52ph-q5pv) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67288

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Denial of Service via smartcard cache

• GitHub Security Advisory (GHSA-ph3q-f9w8-7jf3) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via smartcard cache third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67291

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

• GitHub Security Advisory (GHSA-hgj8-g595-wfc6) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67303

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Denial of Service via serial DeviceControl

• GitHub Security Advisory (GHSA-pfxq-3qmw-8vjx) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via serial DeviceControl third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67292

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure

• GitHub Security Advisory (GHSA-8v6m-2cmc-chx9) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67300

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Use-After-Free via async message proxy

• GitHub Security Advisory (GHSA-33gg-h66j-3697) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Use-After-Free via async message proxy third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67289

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

• GitHub Security Advisory (GHSA-mwwh-mhp9-q7vm) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67302

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service

• GitHub Security Advisory (GHSA-v89x-pc32-hqr7) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67304

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup

• GitHub Security Advisory (GHSA-78jj-45vh-jpm5) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67290

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

• GitHub Security Advisory (GHSA-whq8-c3v3-p8v8) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67293

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Improper Certificate Hostname Validation

• GitHub Security Advisory (GHSA-5wr6-8m8j-3h7f) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Improper Certificate Hostname Validation third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67299

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

• GitHub Security Advisory (GHSA-34hq-hwjw-q8v3) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67294

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 TLS Certificate EKU Bypass

• GitHub Security Advisory (GHSA-89c6-jjrw-96h4) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 TLS Certificate EKU Bypass third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67296

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

• GitHub Security Advisory (GHSA-jm8r-22j6-4m4v) vendor-advisory
• VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via RDPEI PDU third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67301

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

• GitHub Security Advisory (GHSA-vxp3-7g6q-rq2w) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67306

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  15 hours ago maintainer.ignore
• @LeSuisse accepted 15 hours ago
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE

• GitHub Security Advisory (GHSA-qrxx-7g3c-j6w3) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67295

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Path Traversal via drive redirection

• GitHub Security Advisory (GHSA-8xqm-wp3f-rfp9) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Path Traversal via drive redirection third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-66401

2.4 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Physical (P)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Physical (P)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264

• GitHub Security Advisory (GHSA-8jj2-67pg-j6mg) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67297

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response

• GitHub Security Advisory (GHSA-2c6r-4pr4-9x8m) vendor-advisory
• VulnCheck Advisory: FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-66402

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 8 hours ago
• @LeSuisse accepted 15 hours ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  15 hours ago maintainer.ignore
• @LeSuisse published on GitHub 15 hours ago

FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass

• GitHub Security Advisory (GHSA-43hh-p3vw-hfx3) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-32853

updated 17 hours ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse accepted 17 hours ago
• @LeSuisse published on GitHub 17 hours ago

LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj vendor-advisory
• https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b… patch
• https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of… third-party-advisory

---

LibVNCServer

• =<0.9.15
• ==009008e2f4d5a54dd71f422070df3af7b3dbc931

Permalink CVE-2026-32854

updated 17 hours ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse accepted 17 hours ago
• @LeSuisse published on GitHub 17 hours ago

LibVNCServer httpd proxy NULL Pointer Dereference

• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x vendor-advisory
• https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf20… patch
• https://www.vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dere… third-party-advisory

---

LibVNCServer

• =<0.9.15
• ==dc78dee51a7e270e537a541a17befdf2073f5314

Permalink CVE-2026-25552

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 8 hours ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

• GitHub Security Advisory (GHSA-wjx2-9fpq-8997)
• https://www.vulncheck.com/advisories/ghost-cli-ip-spoofing-via-x-forwarded-for-… third-party-advisory

---

Ghost-CLI

• <1.30.1

Permalink CVE-2026-68770

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 1 hour ago by @LeSuisse Activity log

• Created suggestion 2 days, 8 hours ago
• @LeSuisse ignored
  3 packages

  • python313Packages.llm-sentence-transformers
  • python314Packages.llm-sentence-transformers
  • pkgsRocm.python3Packages.llm-sentence-transformers
  2 days, 1 hour ago
• @LeSuisse accepted 2 days, 1 hour ago
• @LeSuisse ignored reference Product R… 2 days, 1 hour ago
• @LeSuisse published on GitHub 2 days, 1 hour ago

sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

• GitHub Issue issue-tracking
• Pull Request vendor-advisory
• Patch Commit patch
• https://www.vulncheck.com/advisories/sentence-transformers-arbitrary-code-execu… third-party-advisory

Ignored references (1)

• Product Repository product

---

sentence-transformers

• =<5.5.1