Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69320

Tracked CVEs

6432

Critical

702

Exploited in wild

4480

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

129 matches

CVE-2026-114041Medium· 6.5

1w ago

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service …

▾ SunlitFreeRDP · FreeRDPEPSS 0.32%via CVEORG

CVE-2026-114046Medium· 6.5PoC

1w ago

FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a …

▾ TwilightFreeRDP · FreeRDPEPSS 0.25%via CVEORG

CVE-2026-114044Medium· 5.3

1w ago

FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can sen…

▾ SunlitFreeRDP · FreeRDPEPSS 0.25%via CVEORG

CVE-2026-114042Medium· 6.5PoC

1w ago

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well…

▾ TwilightFreeRDP · FreeRDPEPSS 0.35%via CVEORG

CVE-2026-114045High· 8.8

1w ago

FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client…

▾ TwilightFreeRDP · FreeRDPEPSS 0.58%via CVEORG

CVE-2026-114043Medium· 6.5PoC

1w ago

Vulnerability in FreeRDP

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buff…

▾ TwilightFreeRDP · FreeRDPEPSS 0.28%via CVEORG

CVE-2026-114047Medium· 6.8

1w ago

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept …

▾ SunlitFreeRDP · FreeRDPEPSS 0.19%via CVEORG

CVE-2026-111880High· 7.4

1w ago

FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward s…

▾ TwilightFreeRDP · FreeRDPEPSS 0.32%via CVEORG

CVE-2026-111881High· 7.6PoC

1w ago

FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-…

▾ MidnightFreeRDP · FreeRDPEPSS 0.24%via CVEORG

CVE-2026-111377Medium· 6.5

1w ago

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAS…

▾ SunlitFreeRDP · FreeRDPEPSS 0.32%via CVEORG

CVE-2026-111376Medium· 5.0PoC

1w ago

FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can a…

▾ TwilightFreeRDP · FreeRDPEPSS 0.17%via CVEORG

CVE-2026-111374Medium· 5.3PoC

1w ago

FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensi…

▾ TwilightFreeRDP · FreeRDPEPSS 0.30%via CVEORG

CVE-2026-111373Medium· 5.3

1w ago

FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passe…

▾ SunlitFreeRDP · FreeRDPEPSS 0.28%via CVEORG

CVE-2026-111379High· 7.3PoC

1w ago

FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height…

▾ MidnightFreeRDP · FreeRDPEPSS 0.19%via CVEORG

CVE-2026-111378High· 7.5PoC

1w ago

FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning …

▾ MidnightFreeRDP · FreeRDPEPSS 0.52%via CVEORG

CVE-2026-111375Medium· 4.8PoC

1w ago

FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-…

▾ TwilightFreeRDP · FreeRDPEPSS 0.32%via CVEORG

CVE-2026-111380High· 8.8PoC

1w ago

FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2…

▾ MidnightFreeRDP · FreeRDPEPSS 0.32%via CVEORG

CVE-2026-111382High· 8.8

1w ago

FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC4…

▾ TwilightFreeRDP · FreeRDPEPSS 0.38%via CVEORG

CVE-2026-111381High· 7.3PoC

1w ago

FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent …

▾ MidnightFreeRDP · FreeRDPEPSS 0.18%via CVEORG

CVE-2026-110839High· 7.1PoC

2w ago

FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output compon…

FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output compon…

▾ MidnightFreeRDP · FreeRDPEPSS 0.27%via NVD

CVE-2026-110838High· 7.5

2w ago

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an inp…

▾ TwilightFreeRDP · FreeRDPEPSS 0.33%via NVD

CVE-2026-110837High· 7.1PoC

2w ago

FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements

FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A ma…

▾ MidnightFreeRDP · FreeRDPEPSS 0.37%via NVD

CVE-2026-110836Medium· 6.5PoC

2w ago

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero …

▾ TwilightFreeRDP · FreeRDPEPSS 0.31%via NVD

CVE-2026-110835Medium· 4.0PoC

2w ago

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host …

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host …

▾ TwilightFreeRDP · FreeRDPEPSS 0.26%via NVD

CVE-2026-110834Medium· 6.5PoC

2w ago

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create o…

▾ TwilightFreeRDP · FreeRDPEPSS 0.31%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

Vulnerability in FreeRDP

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset

FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE

FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest

FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping

FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3

FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser

FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title

FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends

FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser

FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output compon…

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input

FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host …

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message

FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

Vulnerability in FreeRDP

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset

FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE

FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest

FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping

FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3

FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser

FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title

FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends

FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser

FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output compon…

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input

FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host …

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial