glib: GLib: Buffer underflow in GVariant parser leads to heap corruption

A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings...

glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses instead of =, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information...

CVE-2026-59646

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24 2.1.X...

CVE-2026-59646

CVE-2026-59646 affects Bouncy Castle for Java before 1.85 (and BC-Java LTS before 2.73.12, plus BC-FJA before bctls-fips 1.0.24/2.0.24/2.1.24). The root cause is the DTLS handshake reassembler allocating a buffer from an unchecked 24-bit length. This can impact DTLS processing and buffer handling...

EUVD-2026-51989

FreeRDP before 3.30.0 = 3.29.0 contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStreamRead function client/Windows/wfcliprdr.c. When an OLE paste consumer e.g. explorer.exe calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStreamRead requests file...

Linux Distros Unpatched Vulnerability : CVE-2026-67303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in...

Linux Distros Unpatched Vulnerability : CVE-2026-67292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong...

OESA-2026-3189 python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0, whe...

CVE-2026-67303

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

CVE-2026-67292

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious...

CVE-2026-67292

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious...

EUVD-2026-51811

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious...

CVE-2026-67303

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

CVE-2026-67292

FreeRDP before 3.29.0 is affected by a buffer over-disclosure in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client reuses a fixed 1024-byte Pong response stream, not sealing its length to the received Ping payload. A non-empty Ping from a malicious gateway/WebSocke...

CVE-2026-67292

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious...

CVE-2026-67303 FreeRDP before 3.29.0 Denial of Service via serial DeviceControl

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

CVE-2026-67303

FreeRDP vulnerability CVE-2026-67303 affects FreeRDP before 3.29.0. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0. This mismat...

CVE-2026-67292 FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious...

CVE-2026-67305

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDRFILECONTENTSRESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data...

CVE-2026-18536

CVE-2026-18536 affects Data::Entropy versions before 0.010 for Perl. The modules read remote entropy sources over plain HTTP (RandomOrg and RandomnumbersInfo). The remote sources’ integrity checks are weak, trivially matching any non-empty string, enabling an on-path attacker (e.g., open Wi‑Fi, c...