Permalink CVE-2026-18536

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

• https://github.com/robrwo/Data-Entropy/security/advisories/GHSA-845w-rcqw-jwvv vendor-advisory
• https://metacpan.org/release/RRWO/Data-Entropy-0.010/changes release-notes
• https://metacpan.org/release/RRWO/Data-Entropy-0.008/view/lib/Data/Entropy.pm#S…
• https://security.metacpan.org/docs/guides/random-data-for-security.html technical-description
• http://www.openwall.com/lists/oss-security/2026/08/01/8

---

Data-Entropy

• <0.010

Permalink CVE-2026-67338

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  14 packages

  • python313Packages.jupyterlab-git
  • python313Packages.jupyterlab-lsp
  • python313Packages.jupyterlab-vim
  • python314Packages.jupyterlab-git
  • python314Packages.jupyterlab-lsp
  • python314Packages.jupyterlab-vim
  • python313Packages.jupyterlab-server
  • python314Packages.jupyterlab-server
  • python313Packages.jupyterlab-widgets
  • python314Packages.jupyterlab-widgets
  • python313Packages.jupyterlab-pygments
  • python314Packages.jupyterlab-pygments
  • python313Packages.jupyterlab-execute-time
  • python314Packages.jupyterlab-execute-time
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

JupyterLab before 4.5.9 Stored XSS via Extension Manager

• GitHub Security Advisory (GHSA-vmhf-c436-hxj4) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: JupyterLab before 4.5.9 Stored XSS via Extension Manager third-party-advisory

---

jupyterlab

• ==4.5.9
• <4.5.9

Permalink CVE-2026-67298

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  1 month, 1 week ago maintainer.ignore
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow

• GitHub Security Advisory (GHSA-qmvw-52ph-q5pv) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67288

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Denial of Service via smartcard cache

• GitHub Security Advisory (GHSA-ph3q-f9w8-7jf3) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via smartcard cache third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67291

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

• GitHub Security Advisory (GHSA-hgj8-g595-wfc6) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67303

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Denial of Service via serial DeviceControl

• GitHub Security Advisory (GHSA-pfxq-3qmw-8vjx) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via serial DeviceControl third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67292

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure

• GitHub Security Advisory (GHSA-8v6m-2cmc-chx9) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67300

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Use-After-Free via async message proxy

• GitHub Security Advisory (GHSA-33gg-h66j-3697) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Use-After-Free via async message proxy third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67289

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

• GitHub Security Advisory (GHSA-mwwh-mhp9-q7vm) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection third-party-advisory

---

FreeRDP

• ==3.29.0
• <3.29.0

Permalink CVE-2026-67302

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service

• GitHub Security Advisory (GHSA-v89x-pc32-hqr7) vendor-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67304

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup

• GitHub Security Advisory (GHSA-78jj-45vh-jpm5) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67306

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  1 month, 1 week ago maintainer.ignore
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE

• GitHub Security Advisory (GHSA-qrxx-7g3c-j6w3) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67290

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

• GitHub Security Advisory (GHSA-whq8-c3v3-p8v8) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF third-party-advisory

---

FreeRDP

• ==3.29.0
• <3.29.0

Permalink CVE-2026-67293

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Improper Certificate Hostname Validation

• GitHub Security Advisory (GHSA-5wr6-8m8j-3h7f) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Improper Certificate Hostname Validation third-party-advisory

---

FreeRDP

• ==3.29.0
• <3.29.0

Permalink CVE-2026-67299

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

• GitHub Security Advisory (GHSA-34hq-hwjw-q8v3) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message third-party-advisory

---

FreeRDP

• ==3.29.0
• <3.29.0

Permalink CVE-2026-67294

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 TLS Certificate EKU Bypass

• GitHub Security Advisory (GHSA-89c6-jjrw-96h4) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 TLS Certificate EKU Bypass third-party-advisory

---

FreeRDP

• ==3.29.0
• <3.29.0

Permalink CVE-2026-67296

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Denial of Service via RDPEI PDU

• GitHub Security Advisory (GHSA-jm8r-22j6-4m4v) vendor-advisory
• VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via RDPEI PDU third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67301

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

• GitHub Security Advisory (GHSA-vxp3-7g6q-rq2w) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-67295

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @cizra
  • @DeimElias
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Path Traversal via drive redirection

• GitHub Security Advisory (GHSA-8xqm-wp3f-rfp9) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Path Traversal via drive redirection third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-66401

2.4 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Physical (P)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Physical (P)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264

• GitHub Security Advisory (GHSA-8jj2-67pg-j6mg) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 third-party-advisory

---

FreeRDP

• ==3.29.0
• <3.29.0

Permalink CVE-2026-67297

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response

• GitHub Security Advisory (GHSA-2c6r-4pr4-9x8m) vendor-advisory
• VulnCheck Advisory: FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-66402

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @DeimElias
  • @cizra
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass

• GitHub Security Advisory (GHSA-43hh-p3vw-hfx3) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass third-party-advisory

---

FreeRDP

• <3.29.0
• ==3.29.0

Permalink CVE-2026-32853

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 2 weeks ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj vendor-advisory
• https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b… patch
• https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of… third-party-advisory

---

LibVNCServer

• =<0.9.15
• ==009008e2f4d5a54dd71f422070df3af7b3dbc931

Permalink CVE-2026-32854

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 2 weeks ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

LibVNCServer httpd proxy NULL Pointer Dereference

• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x vendor-advisory
• https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf20… patch
• https://www.vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dere… third-party-advisory

---

LibVNCServer

• =<0.9.15
• ==dc78dee51a7e270e537a541a17befdf2073f5314

Permalink CVE-2026-25552

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

• GitHub Security Advisory (GHSA-wjx2-9fpq-8997)
• https://www.vulncheck.com/advisories/ghost-cli-ip-spoofing-via-x-forwarded-for-… third-party-advisory

---

Ghost-CLI

• <1.30.1

Permalink CVE-2026-68770

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  3 packages

  • python313Packages.llm-sentence-transformers
  • python314Packages.llm-sentence-transformers
  • pkgsRocm.python3Packages.llm-sentence-transformers
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored reference Product R… 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

• GitHub Issue issue-tracking
• Pull Request vendor-advisory
• Patch Commit patch
• https://www.vulncheck.com/advisories/sentence-transformers-arbitrary-code-execu… third-party-advisory

Ignored references (1)

• Product Repository product

---

sentence-transformers

• =<5.5.1

Permalink CVE-2026-62959

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)

• https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g x_refsource_CONFIRMexploit
• https://github.com/coturn/coturn/pull/1965 x_refsource_MISC
• https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4 x_refsource_MISC
• https://github.com/coturn/coturn/releases/tag/4.15.0 x_refsource_MISC

---

coturn

• ==>= 4.5.2, < 4.15.0

Permalink CVE-2026-65981

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover

• https://github.com/coturn/coturn/security/advisories/GHSA-69wx-x7x6-pjj8 x_refsource_CONFIRM
• https://github.com/coturn/coturn/commit/37df0513168f830a7c9ce0a411db0300fa182f05 x_refsource_MISC

---

coturn

• ==< 4.15.0

Permalink CVE-2026-62663

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  5 packages

  • bankstown-lv2
  • nltk-data.universal-treebanks-v20
  • python313Packages.asteroid-filterbanks
  • python314Packages.asteroid-filterbanks
  • pkgsRocm.python3Packages.asteroid-filterbanks
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)

• https://github.com/masci/banks/security/advisories/GHSA-98rr-gvc9-3cjh x_refsource_CONFIRMexploit

---

banks

• ==< 2.4.4

Needs backports 26.05

Permalink CVE-2026-61536

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  5 packages

  • bankstown-lv2
  • nltk-data.universal-treebanks-v20
  • python313Packages.asteroid-filterbanks
  • python314Packages.asteroid-filterbanks
  • pkgsRocm.python3Packages.asteroid-filterbanks
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

• https://github.com/masci/banks/security/advisories/GHSA-64vx-6h2c-rjh7 x_refsource_CONFIRM

---

banks

• ==< 2.4.3

Needs backports 26.05

Permalink CVE-2026-64816

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/rapidraw-ntlmv2-credential-leak-via-unc-pa… third-party-advisory

---

RapidRAW

• <1.6.0