Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121956 | high | 7.5 | No | FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into... | 2026-11-04 |
| CVE-2026-121955 | high | 7.5 | No | FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its... | 2026-11-04 |
| CVE-2026-121954 | medium | 6.5 | No | FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions... | 2026-11-04 |
| CVE-2026-121953 | critical | 9.8 | No | FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId ove... | 2026-11-04 |
| CVE-2026-121952 | critical | 9.8 | No | FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches val... | 2026-11-04 |
| CVE-2026-121951 | high | 7.5 | No | FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message ty... | 2026-11-04 |
| CVE-2026-121950 | medium | 6.5 | No | FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, caus... | 2026-11-04 |
| CVE-2026-121946 | high | 7.2 | No | zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that... | 2026-11-04 |
| CVE-2026-121945 | high | 7.6 | No | CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incide... | 2026-11-04 |
| CVE-2026-121944 | medium | 5.5 | No | sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause de... | 2026-11-04 |
| CVE-2026-121943 | medium | 4.8 | No | Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off... | 2026-11-04 |
| CVE-2026-121942 | medium | 6.1 | No | ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap m... | 2026-11-04 |
| CVE-2026-121940 | high | 8.8 | No | Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access o... | 2026-11-04 |
| CVE-2026-121939 | high | 8.1 | No | Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identiti... | 2026-11-04 |
| CVE-2026-121938 | medium | 5.3 | No | langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other... | 2026-11-04 |
| CVE-2026-121932 | critical | 10.0 | No | A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manip... | 2026-11-04 |
| CVE-2026-121931 | critical | 9.1 | No | A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of... | 2026-11-04 |
| CVE-2026-121930 | critical | 9.1 | No | A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the componen... | 2026-11-04 |
| CVE-2026-121937 | low | 3.1 | No | loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read ot... | 2026-11-04 |
| CVE-2026-121936 | medium | 6.5 | No | easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send P... | 2026-11-04 |