CVE-2026-25997

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. This vulnerability, a heap use-after-free, occurs during an auto-reconnect operation when the xfclipboardformatsfree function frees memory that is still being accessed by another thread. A remote attacker could...

CVE-2026-25959

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A remote attacker could exploit a race condition in the clipboard handling feature. This vulnerability, known as a heap use-after-free, occurs when the system attempts to use memory that has already been released...

CVE-2026-25954

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol RDP. A remote attacker could exploit a use-after-free vulnerability in the xfrailserverlocalmovesize function. This occurs because the xfrailgetwindow function returns an unprotected pointer, allowing a main thread ...

CVE-2026-25953

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. This use-after-free vulnerability occurs in the xfAppUpdateWindowFromSurface function where a bare pointer to a window is obtained without proper lifetime protection. A remote attacker could exploit this by...

CVE-2026-25952

A flaw was found in FreeRDP. A remote attacker could exploit a use-after-free vulnerability in the xfSetWindowMinMaxInfo function. This occurs when a freed window pointer is dereferenced because the main thread concurrently deletes a window while the Remote Desktop Protocol RAIL channel thread is...

CVE-2026-25942

A flaw was found in FreeRDP. A malicious server can exploit this vulnerability by sending a specially crafted execResult value 7 or greater to the client. This unchecked value is used to index an array, leading to an out-of-bounds read in the xfrailserverexecuteresult function. This can potential...

CVE-2026-25941

A flaw was found in the FreeRDP client. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the RDPGFX channel. By sending a specially crafted WIRETOSURFACE2 Protocol Data Unit PDU with a bitmapDataLength value exceeding the actual data, an attacker c...

CVE-2026-27699

A flaw was found in basic-ftp, an FTP client library. A malicious FTP server can exploit a path traversal vulnerability CWE-22 within the downloadToDir method. This allows the server to send directory listings containing special sequences that trick the client into writing files to unintended...

CVE-2026-3146

A flaw was found in libvips. A local user could trigger a null pointer dereference by manipulating the vipsforeignloadmatrixheader function. This vulnerability could lead to a Denial of Service DoS, causing the application to become unresponsive. Mitigation Mitigation for this issue is either not...

CVE-2026-3147

A flaw was found in libvips. A local attacker could exploit a heap-based buffer overflow vulnerability in the vipsforeignloadcsvbuild function. This vulnerability, triggered by manipulating CSV file loading, could lead to unauthorized information disclosure, denial of service DoS, or limited data...

CVE-2026-3145

A flaw was found in libvips. A local attacker can exploit a vulnerability in the vipsforeignloadmatrixfileisa and vipsforeignloadmatrixheader functions by executing an empty but very large input. This can lead to memory corruption, potentially causing a denial of service or other impacts...

CVE-2026-3190

A flaw was found in Keycloak. The User-Managed Access UMA 2.0 Protection API endpoint for permission tickets fails to enforce the umaprotection role check. This allows any authenticated user with a token issued for a resource server client, even without the umaprotection role, to enumerate all...

CVE-2026-3184

A flaw was found in util-linux. Improper hostname canonicalization in the login1 utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAMRHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing...

Linux Distros Unpatched Vulnerability : CVE-2026-2770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Bindings WebIDL component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and...

Linux Distros Unpatched Vulnerability : CVE-2026-2791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Linux Distros Unpatched Vulnerability : CVE-2026-2784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Linux Distros Unpatched Vulnerability : CVE-2026-2771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and...

CVE-2026-27572

A flaw was found in Wasmtime, a runtime for WebAssembly. This vulnerability allows an attacker to cause a Denial of Service DoS by sending an excessive number of HTTP header fields. The Wasmtime implementation of the wasi:http/types.fields resource does not gracefully handle this condition, leadi...

CVE-2026-27195

A flaw was found in Wasmtime. When a host embedding repeatedly calls an asynchronous function TypedFunc::callasync exported by a WebAssembly Wasm component and drops the returned future before it completes, Wasmtime will encounter a panic. This issue can lead to a denial of service DoS, making th...

CVE-2026-25882

A flaw was found in Fiber, an Express-inspired web framework for Go. This denial of service DoS vulnerability allows a remote attacker to crash the application. By sending requests to routes containing more than 30 parameters, the attacker can exploit missing validation during route registration...