CVE Vulnerability Database
Search and browse 419,817 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-121963 | MEDIUM | 5.9 | 0.3% | Nov 4, 2026 | FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows mal... |
| CVE-2026-121962 | HIGH | 8.1 | 0.3% | Nov 4, 2026 | FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Aut... |
| CVE-2026-121961 | MEDIUM | 5.9 | 0.3% | Nov 4, 2026 | FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the... |
| CVE-2026-121960 | HIGH | 7.5 | 0.5% | Nov 4, 2026 | FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSReque... |
| CVE-2026-121959 | MEDIUM | 6.5 | 0.3% | Nov 4, 2026 | FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO ... |
| CVE-2026-121958 | HIGH | 7.5 | 0.3% | Nov 4, 2026 | FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates... |
| CVE-2026-121957 | HIGH | 7 | 0.3% | Nov 4, 2026 | FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory... |
| CVE-2026-121956 | HIGH | 7.5 | 0.4% | Nov 4, 2026 | FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb... |
| CVE-2026-121955 | MEDIUM | 6.5 | 0.4% | Nov 4, 2026 | FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCa... |
| CVE-2026-121954 | MEDIUM | 6.5 | 0.4% | Nov 4, 2026 | FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset com... |
| CVE-2026-121953 | CRITICAL | 9.8 | 0.6% | Nov 4, 2026 | FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with... |
| CVE-2026-121952 | CRITICAL | 9.8 | 0.5% | Nov 4, 2026 | FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects on... |
| CVE-2026-121951 | HIGH | 7.5 | 0.4% | Nov 4, 2026 | FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with a... |
| CVE-2026-121950 | MEDIUM | 6.5 | 0.3% | Nov 4, 2026 | FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREA... |
| CVE-2026-119746 | MEDIUM | 5.9 | — | Nov 4, 2026 | ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web... |
| CVE-2026-109518 | HIGH | 7.7 | — | Nov 4, 2026 | On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (includin... |
| CVE-2026-106554 | — | — | — | Nov 4, 2026 | One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time ... |
| CVE-2026-66736 | — | — | — | Nov 4, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-39431 | HIGH | 7.2 | 0.5% | Nov 4, 2026 | On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible... |
| CVE-2026-39430 | CRITICAL | 9.8 | 0.2% | Nov 4, 2026 | On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management a... |
| CVE-2026-122008 | MEDIUM | 5 | — | Nov 4, 2026 | Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileCo... |
| CVE-2026-122007 | MEDIUM | 6.5 | — | Nov 4, 2026 | Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an aut... |
| CVE-2026-122006 | CRITICAL | 9.8 | 0.7% | Nov 4, 2026 | The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server ... |
| CVE-2026-121640 | CRITICAL | 9.1 | 0.5% | Nov 4, 2026 | An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has obse... |
| CVE-2026-121639 | CRITICAL | 9.2 | 0.7% | Nov 4, 2026 | A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthentic... |