CVE-2026-67304

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer...

CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

CVE-2026-66402

FreeRDP before 3.29.0 affected versions = 3.28.0 contains multiple TLS certificate identity validation weaknesses in tlsverifycertificate, tlsmatchhostname, and x509utilsgetdnsnames. Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware...

CVE-2026-67296

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

CVE-2026-67353

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and...

CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

CVE-2026-14164 affecting package libarchive for versions less than 3.7.7-7

CVE-2026-14164 affecting package libarchive for versions less than 3.7.7-7. A patched version of the package is available...

CVE-2026-41606 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41606 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-7260 affecting package php for versions less than 8.3.33-1

CVE-2026-7260 affecting package php for versions less than 8.3.33-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55971 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55971 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-56852 affecting package kata-containers for versions less than 3.19.1.kata3-7

CVE-2026-56852 affecting package kata-containers for versions less than 3.19.1.kata3-7. A patched version of the package is available...

CVE-2026-48144 affecting package thrift for versions less than 0.24.0-1

CVE-2026-48144 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-41607 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41607 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-49158 affecting package thrift for versions less than 0.24.0-1

CVE-2026-49158 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55968 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55968 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...