Security update for freerdp

This update for freerdp fixes the following issues: CVE-2026-24491: heap-use-after-free in videotimer bsc1257981. CVE-2026-24675: heap-use-after-free in urbselectinterface bsc1257982. CVE-2026-24676: heap-use-after-free in audioformatcompatible bsc1257983. CVE-2026-24679: heap-buffer-overflow in...

GHSA-8VRH-3PM2-V4V6

creationtimestamp| type| source ---|---|--- 2026-02-25 16:10:19+00:00| seen| https://gist.github.com/alon710/e8bd93f4619202bc0c1f669862922839...

kernel: Linux kernel: xHCI driver isochronous event handling race condition leading to data loss or UAF

A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface driver. This vulnerability allows data loss or buffer Use-After-Free UAF due to a race condition during isochronous Ring Underrun/Overrun event handling...

CVE-2025-14103

creationtimestamp| type| source ---|---|--- 2026-02-25 13:10:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mfoqwufv6l2q 2026-02-25 21:26:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfpmntuxkt2n...

GHSA-HHFX-5X8J-F5F6

creationtimestamp| type| source ---|---|--- 2026-02-25 04:40:18+00:00| seen| https://gist.github.com/alon710/1f5269447a1894adbb81b93906c7462d...

CVE-2026-3043

A flaw has been found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and...

CVE-2026-3042

A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public a...

CVE-2026-27614

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the affected Stacktrace in the web UI. When Pygments...

CVE-2026-27614

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the affected Stacktrace in the web UI. When Pygments...

CVE-2026-27614 Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the affected Stacktrace in the web UI. When Pygments...

GHSA-6FX5-5CW5-4897

creationtimestamp| type| source ---|---|--- 2026-02-25 01:08:23+00:00| seen| https://gist.github.com/alon710/8e3d60e2310dc13fae41246bc5dac4c9...

CVE-2025-67491 OpenEMR has Stored XSS in ub04 helper

OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-site scripting vulnerability in the ub04 helper of the billing interface. The variable $data is passed in a click event handler enclosed in...

kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling

A flaw was found in the Linux kernel's Bluetooth subsystem. A use-after-free UAF vulnerability exists in the hcidisconnectallsync function. This can occur if a Bluetooth connection is deleted while a controller event is being processed concurrently. A local attacker could potentially exploit this...

CVE-2026-2784

creationtimestamp| type| source ---|---|--- 2026-02-25 00:02:21+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfnevsrrem2c 2026-02-28 02:01:56+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfv4yg5pzm2o...

CVE-2026-2783

creationtimestamp| type| source ---|---|--- 2026-02-25 00:02:19+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfnevrqegb2o 2026-02-28 02:01:56+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfv4yg5pzm2o...

CVE-2026-2772

creationtimestamp| type| source ---|---|--- 2026-02-25 00:02:17+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfnevpneau2d 2026-02-28 02:01:52+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfv4ye2syf2g...

CVE-2026-2771

creationtimestamp| type| source ---|---|--- 2026-02-25 00:02:17+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfnevpneau2d 2026-02-28 02:01:51+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfv4ycvd6i2f...

CVE-2026-2761

creationtimestamp| type| source ---|---|--- 2026-02-25 00:02:12+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfnevnkbfq2y 2026-02-28 02:01:47+00:00| seen| https://bsky.app/profile/slackers.it/post/3mfv4yasoc52y 2026-03-01 00:27:17+00:00| seen|...

PT-2026-21988

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.2 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4 GitLab CE/EE versions 18.9 through 18.9.0 Description An unauthenticated user could potentially cause a denial of service by sending specially crafted files to...

Bugsink 跨站脚本漏洞

Bugsink is an open-source, self-hosted bug tracking software developed by Bugsink. Versions of Bugsink prior to 2.0.13 contained a cross-site scripting vulnerability. This vulnerability stemmed from unvalidated attackers who could submit events to the project, allowing them to store arbitrary...