CVE-2026-111382

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit a heap-based out-of-bounds write vulnerability by sending specially crafted display frames to a client during video stream processing. This flaw allows client memory to be corrupted, potentially resulting in...

CVE-2026-103896

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

CVE-2026-103896

The 10Web Booster WordPress plugin (versions up to and including 2.34.5 ) is vulnerable to unauthenticated limited file write and cache poisoning . The root cause is the OptimizerWebPageCache::get_cache_file_dir() function, which concatenates raw, unsanitized $_GET parameters into the on-disk cac...

CVE-2026-103896 10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

EUVD-2026-102671

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 CVSS score: 5.4, a path traversal flaw in the command lin...

CVE-2026-111446

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

CVE-2026-111446

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

CVE-2026-111446

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

EUVD-2026-102608

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

DEBIAN-CVE-2026-111380

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

DEBIAN-CVE-2026-111382

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-111380

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

CVE-2026-111382

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

Exploit for Out-of-bounds Write in Gnu Glibc

CVE-2024-2961 — PHP File Read to RCE glibc iconv 배포 정보...

CVE-2026-111382 FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-111382

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

EUVD-2026-102563

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-111382 FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-111382

FreeRDP before version 3.32.0 is vulnerable to a client-side heap out-of-bounds write in the general_LumaToYUV444 and general_ChromaV2ToYUV444 functions. A malicious RDP server can trigger this by sending RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at the surface height, ...