CVE-2026-90191

A flaw was found in the Linux kernel's mailbox: riscv-sbi-mpxy component. This vulnerability arises from insufficient validation of the SBI System Binary Interface return value, which dictates the number of bytes copied from shared memory into the RPMI RISC-V Platform Management Interface...

CVE-2026-90185

A flaw was found in the Linux kernel's nullblk module. This vulnerability occurs because concurrent operations on configfs attributes are not properly synchronized. A local user could exploit this timing issue to modify data during device setup, leading to an out-of-bounds memory access. This cou...

CVE-2026-90181

A flaw was found in the Linux kernel's ublk universal block driver. A local attacker could trigger an xarray allocation failure during the teardown of a shared memory zero-copy SHMEMZC buffer. This issue causes the teardown process to enter an infinite retry loop, preventing forward progress and...

CVE-2026-90161

A flaw was found in the Linux kernel's erofs filesystem. A local attacker could craft a malicious erofs image containing invalid interlaced ztailpacking pclusters. When this image is processed, it could lead to an out-of-bounds read from kernel memory. This vulnerability may allow an attacker to...

CVE-2026-90151

A flaw was found in the Linux kernel's Network File System version 4 NFSv4 component. This vulnerability occurs when an NFSv4 client allocation fails, leaving a stale pointer to a freed client. A local attacker could potentially exploit this use-after-free condition by triggering a callback looku...

DEBIAN-CVE-2026-109948

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcardTransmitCall that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing...

DEBIAN-CVE-2026-109951

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NU...

CVE-2026-109948

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcardTransmitCall that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing...

DEBIAN-CVE-2026-109947

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRPMJREAD with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on...

CVE-2026-109947

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRPMJREAD with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on...

DEBIAN-CVE-2026-109676

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

DEBIAN-CVE-2026-109677

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to...

CVE-2026-109676

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109677

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to...

CVE-2025-58774

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity,...

CVE-2025-58772

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability...

CVE-2025-58773

AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability...

CVE-2025-58771

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and...

CVE-2026-109947

FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRPMJREAD with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on...

CVE-2026-109676

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...