CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to an Out-Of-Bounds Read in the `general_YUV444ToRGB_8u_P3AC4R_BGRX` function. This issue arises from insufficient data for the `pSrc` variable, resulting in crashes.
FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to an Out-Of-Bounds Write in the `writePixelBGRX` function. The issue is caused by incorrect calculations of the `nHeight` and `srcStep` variables and has been fixed in version 3.0.0-beta3.
FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to an Out-Of-Bounds Write in the `progressive_decompress` function. The issue is caused by incorrect calculations of the `nXSrc` and `nYSrc` variables. It has been addressed in versions 2.11.0 and 3.0.0-beta3.
FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), has a vulnerability in the `clear_decompress_bands_data` function that lacks offset validation, leading to an out-of-bounds write. Exploitation of this vulnerability may result in unauthorized writes.
FreeRDP, a free implementation of the RDP protocol, has a vulnerability in the `general_LumaToYUV444` function due to an Out-Of-Bounds Read. This issue arises from processing the `in` variable without checking if it contains sufficient data.
FreeRDP, a free implementation of the RDP protocol, has an Integer Overflow vulnerability in the `gdi_CreateSurface` function, leading to Out-Of-Bound Write. This issue affects FreeRDP based clients only and does not affect FreeRDP proxies.
FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. This issue may cause application crashes.
There is a sensitive information leak through log files in Acronis Agent products (Linux, macOS, Windows) before build 35433.
CVE-2023-41751 involves sensitive information disclosure due to improper token expiration validation. The affected product is Acronis Agent (Windows) before build 32047.
CVE-2023-41750 concerns sensitive information disclosure due to missing authorization. The affected products are Acronis Agent (Linux, macOS, Windows) before build 32047.
In FreeRDP, affected versions have a missing offset validation that may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. The lack of proper boundary checks when looping through `multi_opaque_rect->numRectangles` can result in Out-of-Bounds Read errors, likely leading to a crash.
FreeRDP, a free implementation of the RDP protocol, has an issue with missing offset validation leading to out of bounds read. In the `libfreerdp/codec/rfx.c` file, the lack of validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr` can lead to application crashes.
FreeRDP, a free implementation of the RDP protocol, has an issue with offset validation leading to Out Of Bound Write. This can be triggered when `rect->left` and `rect->top` are equal to `surface->width` and `surface->height`, which should cause a crash in practice.
FreeRDP, a free implementation of the RDP protocol, has a vulnerability in the `nsc_rle_decompress_data` function that allows for an Out-Of-Bounds Read. This issue arises because it does not check if `context->Planes` contains data of sufficient length.
FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to a Null Pointer Dereference leading to a crash in RemoteFX handling. The issue occurs in the `rfx_process_message_tileset` function, where improper memory allocation for tiles may result in accessing a NULL pointer.
The vulnerability in FreeRDP affects clients and involves an integer underflow leading to a Denial of Service (DOS). The issue occurs when an insufficient block length is provided, and proper length validation is not performed.
FreeRDP has a Global-Buffer-Overflow vulnerability in the ncrush_decompress function, which can be triggered by crafted input. This issue causes application crashes and has been addressed in versions 2.11.0 and 3.0.0-beta3.
CVE-2023-41747 involves sensitive information disclosure due to unauthenticated path traversal. The affected products are Acronis Cloud Manager (Windows) before build 6.2.23089.203.
CVE-2023-41745 vulnerability involves sensitive information disclosure due to excessive collection of system information. The affected products are Acronis Agent (Linux, macOS, Windows) before build 30991 and Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
Eclipse Leshan, a device management server, is vulnerable to XXE attacks in versions containing `DDFFileParser` and `DefaultDDFFileValidator`. Users are only at risk if they parse untrusted DDF files.