PT-2026-3654

Name of the Vulnerable Software and Affected Versions owntone-server versions prior to the commit 6d604a1 Description A flaw exists in owntone-server due to a NULL pointer dereference within the dacp reply playqueueedit clear function, located in the src/httpd dacp.c file. This issue, present...

CVE-2026-23534 FreeRDP has heap-buffer-overflow in clear_decompress_bands_data

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server can trigger a...

CVE-2026-23533

CVE-2026-23533 – FreeRDP : Affects FreeRDP prior to version 3.21.0, where the RDPGFX ClearCodec decode path can fail due to crafted residual data causing out-of-bounds writes. This leads to a client crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior...

CVE-2026-23533

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a...

CVE-2026-23531 FreeRDP has heap-buffer-overflow in clear_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when glyphData is present, cleardecompress calls freerdpimagecopynooverlap without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates...

CVE-2026-23531 FreeRDP has heap-buffer-overflow in clear_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when glyphData is present, cleardecompress calls freerdpimagecopynooverlap without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates...

kernel: drm/xe: Use local fence in error path of xe_migrate_clear

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xemigrateclear The intent of the error path in xemigrateclear is to wait on locally generated fence and then return. The code is waiting on m-fence which could be the local fence but this ...

FreeRDP security vulnerabilities

FreeRDP is an open-source RDP protocol implementation developed by the FreeRDP team. Versions of FreeRDP prior to 3.21.0 contained security vulnerabilities. These vulnerabilities stemmed from the cleardecompress function in ClearCodec, which did not validate the target rectangle, potentially...

CVE-2026-0942 Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs function in all versions up to, and including, 5.1.5. This makes it possible for unauthenticated...

CVE-2026-0942

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs function in all versions up to, and including, 5.1.2. This makes it possible for unauthenticated...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000820)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000820 advisory. The clearuser function in arch/arm64/lib/clearuser.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service system...

SUSE CVE-2025-68780

In the Linux kernel, the following vulnerability has been resolved: sched/deadline: only set freecpus for online runqueues Commit 16b269436b72 "sched/deadline: Modify cpudl::freecpus to reflect rd-online" introduced the cpudlset/clearfreecpu functions to allow the cpudl::freecpus mask to be...

PT-2026-3163

Name of the Vulnerable Software and Affected Versions SmartFTP Client version 10.0.2909.0 Description SmartFTP Client is susceptible to multiple denial of service issues. An attacker can cause the application to crash by providing specially crafted input. This can be achieved by submitting...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002138)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002138 advisory. The clearuser function in arch/arm64/lib/clearuser.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service system...

CVE-2026-0503

Due to missing authorization check in the SAP ERP Central Component SAP ECC and SAP S/4HANA SAP EHS Management, an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can...

UBUNTU-CVE-2025-68780

In the Linux kernel, the following vulnerability has been resolved: sched/deadline: only set freecpus for online runqueues Commit 16b269436b72 "sched/deadline: Modify cpudl::freecpus to reflect rd-online" introduced the cpudlset/clearfreecpu functions to allow the cpudl::freecpus mask to be...

Linux Distros Unpatched Vulnerability : CVE-2025-68780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sched/deadline: only set freecpus for online runqueues Commit 16b269436b72 sched/deadline: Modify cpudl::freecpus to reflect rd-online introduced the...

CVE-2018-4445

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2...

CVE-2021-33325

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the...

CVE-2019-18248

BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication channel. An attacker can disclose the product’s client credentials for connecting to the BIOTRONIK Remote Communication infrastructure...