FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters...
CVE-2026-67289
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controll
#advisory
共收录 23627 条相关情报。
← 返回所有主题FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname...
CVE-2026-67293
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability.
FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder...
CVE-2026-67290
FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer...
CVE-2026-67294
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-si
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in...
CVE-2026-67291
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments
FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264...
CVE-2026-66401
FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fail
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache...
CVE-2026-67288
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS...
CVE-2025-71404
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi...
CVE-2025-71402
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-ou
Rejected reason: ** DUPLICATE ** This CVE Record has been rejected by the Zephyr Project CNA. CVE...
CVE-2026-10772
Rejected reason: ** DUPLICATE ** This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigne
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation...
CVE-2025-71403
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute
guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer
CVE-2026-67354
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
CVE-2026-67298
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD
CVE-2026-67291
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments
Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
CVE-2026-67311
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fail
FreeRDP before 3.29.0 Use-After-Free via async message proxy
CVE-2026-67300
FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAI
FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
CVE-2026-67299
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER
FreeRDP before 3.29.0 Denial of Service via smartcard cache
CVE-2026-67288
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept
FreeRDP before 3.29.0 Denial of Service via serial DeviceControl
CVE-2026-67303
FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_proce
FreeRDP before 3.29.0 Path Traversal via drive redirection
CVE-2026-67295
FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to