freerdp security, bug fix, and enhancement update

2:3.32.2-1 - Update to 3.32.2 - Backport gateway freeze and busy-loop fixes, including partial-header handling - Reset completed RDG header state before control-packet dispatch - Keep WebSocket and chunked-transfer decoder state separate Resolves: RHEL-277442 Resolves: RHEL-282285, RHEL-283665,...

Effect input validation error vulnerability

Versions of Effect prior to 0.1.0 and from 0.97.1 up to 4.0.0-beta.0 and 4.0.0-beta.103 contain an input validation error vulnerability. This vulnerability arises because the name, domain, and path fields in makeCookie allow semicolon separators; serializeCookie writes these values unchanged into...

Django information disclosure vulnerability

Versions prior to Django 6.1.3, versions prior to 6.0.10, and versions prior to 5.2.19 contain an information disclosure vulnerability. This vulnerability arises because UpdateCacheMiddleware and the cachepage decorator generate the same cache key for requests containing a header listed in the Va...

PT-2026-136746

Name of the Vulnerable Software and Affected Versions CGI for Perl versions prior to 5.00 Description HTTP header injection is possible due to entity decoding occurring after the newline check in the header function and unchecked values in multipart start and do push. When autoEscape is disabled,...

CVE-2026-119740

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

EUVD-2026-115401

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

SUSE CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2026-106804

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the imsqosnpn module. The wrxaarregister function copies the attacker-controlled host field from the SIP Via header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger...

CVE-2026-120458

Kvazaar through 2.3.2 contains an infinite loop vulnerability in readheader in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang t...

CVE-2026-120435

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

DEBIAN-CVE-2026-120435

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

CVE-2026-120458

Kvazaar through 2.3.2 contains an infinite loop vulnerability in readheader in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang t...

CVE-2026-120435

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

CVE-2026-120458

Kvazaar versions through 2.3.2 are vulnerable to a Denial of Service (DoS) condition due to an infinite loop in the read_header() function located in src/encmain.c. The vulnerability is triggered when the command-line encoder processes a crafted .y4m file that lacks a terminating newline characte...

CVE-2026-120458 Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser

Kvazaar through 2.3.2 contains an infinite loop vulnerability in readheader in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang t...

EUVD-2026-115218

Kvazaar through 2.3.2 contains an infinite loop vulnerability in readheader in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang t...

CVE-2026-120458 Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser

Kvazaar through 2.3.2 contains an infinite loop vulnerability in readheader in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang t...

CVE-2026-120458 Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser

Kvazaar through 2.3.2 contains an infinite loop vulnerability in readheader in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang t...

CVE-2026-120435 Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

EUVD-2026-115195

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...