Authentication bypass in N-able N-central through version 2026.1 allows unauthenticated remote attackers to circumvent authentication controls via an alternate path or channel (CWE-288), resulting in high confidentiality impact against the vulnerable system. The CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N/VC:H) indicates exploitation requires elevated attack complexity but no credentials, suggesting a non-trivial bypass technique such as direct access to an unauthenticated API endpoint or alternate URL path that bypasses the primary authentication gateway. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the Participants Database WordPress plugin before 2.7.8.4 lets remote unauthenticated attackers inject arbitrary SQL through an improperly sanitized user-supplied parameter, exposing and tampering with the WordPress database. Publicly available exploit code exists (disclosed by WPScan), though EPSS remains low at 0.18% and the flaw is not on CISA KEV. The high 9.1 CVSS reflects full read/write database compromise without authentication.
Password reset link host poisoning in DynamicKit for Elementor WordPress plugin (versions before 1.0.3) enables unauthenticated attackers to redirect victims' password reset emails to an attacker-controlled domain, carrying a valid reset key issued by the legitimate WordPress site. When the victim clicks the link, the attacker captures the reset token and achieves full account takeover. A publicly available exploit exists via WPScan, though EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation despite the severity rating and POC availability.
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to silently reroute plaintext HTTP requests through an attacker-controlled proxy, exposing Authorization headers, Basic auth credentials, request method, absolute URL, Host, and body content. Affected are axios versions >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0) running in Node.js environments. No public exploit or CISA KEV listing has been identified, but the CVSS 4.0 score of 8.3 with AT:P reflects that exploitation requires a prior or concurrent prototype pollution primitive elsewhere in the same process.
Session hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers to obtain an authenticated session for any arbitrary existing user - including site administrators - by exploiting improper account binding in the post-registration auto-login flow. Exploitation is constrained to sites running a supported but non-default plugin configuration, which explains the AC:H in the CVSS vector and the SSVC 'Automatable: no' designation despite total technical impact. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.14% (4th percentile) and SSVC 'Exploitation: none' indicate no confirmed widespread exploitation at time of analysis.
Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attackers to brute-force password-reset verification codes by bypassing the plugin's rate-limit control. The rate limiter and code storage are both keyed on a client-supplied value, meaning an attacker can arbitrarily reset their attempt counter and exhaust the verification code space, resulting in full compromise of any account - including site administrators - on affected WordPress installations. A publicly available proof-of-concept exploit exists; no CISA KEV confirmation has been issued, but the admin-takeover impact makes this a high-priority patch for any site running the affected configuration.
Password reset authentication bypass in the Chat On Desk Order Notifications WordPress plugin (versions before 1.0.9) allows unauthenticated remote attackers to take over arbitrary user accounts, including administrators, by submitting a new password without completing OTP verification. Exploitation is conditional on the SMS one-time-password reset feature being active on the target site. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and SSVC rates exploitation status as 'none,' suggesting currently limited attacker uptake despite disclosed exploit code. No confirmed active exploitation (CISA KEV) at time of analysis.
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.
Unauthenticated information disclosure in the Mapster WP Maps WordPress plugin (all versions before 1.24.0) exposes the full title and body content of any post - including drafts, private, pending, and trashed posts - through an unprotected public REST API endpoint. Any remote attacker with network access to the WordPress site can enumerate and read content that site owners explicitly withheld from publication, bypassing WordPress's native post-status and capability access controls. A publicly available proof-of-concept exists per WPScan reporting; however, the EPSS score of 0.14% (4th percentile) indicates exploitation has not yet become widespread, and the vulnerability is not listed in the CISA KEV catalog.
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop managers to cause arbitrary local PHP files to be included and executed on every subsequent front-end request, including those made by unauthenticated visitors. The attack is staged: a privileged user (shop manager) poisons a stored plugin setting with a directory traversal sequence, after which the web server silently executes the targeted local file on every page load without further attacker interaction. A publicly available proof-of-concept exists; EPSS is low at 0.50% (40th percentile), suggesting exploitation has not yet reached broad automated scanning, though the POC lowers the bar significantly for targeted attacks against WooCommerce stores.
Unrestricted PHP file upload in the Theme Demo Import WordPress plugin (≤1.1.3) enables administrator-level users - including non-super-admin site admins on multisite installs - to bypass WordPress's native file-type validation and upload executable PHP files to the server's uploads directory, resulting in full remote code execution. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.14% (4th percentile), suggesting exploitation remains uncommon. No confirmed active exploitation in CISA KEV; however, SSVC rates technical impact as total.
Unrestricted PHP file upload in Everest Toolkit (WordPress plugin ≤1.2.3) enables authenticated Administrators - including non-super-admin site administrators on multisite networks - to place executable PHP web shells in the wp-content/uploads directory via the demo-content import feature. Full remote code execution on the underlying web server is achievable upon requesting the uploaded file. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), indicating this remains a targeted rather than widespread threat despite total technical impact.
Reflected XSS in the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin (all versions before 5.0.0) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by exploiting an AJAX endpoint that lacks both nonce validation and capability checks. A publicly available exploit exists per WPScan, lowering the bar for abuse, though EPSS sits at just 0.17% (7th percentile) and CISA has not added this to KEV - suggesting opportunistic rather than widespread active exploitation. The scope-changed CVSS vector (S:C) reflects that a successful attack breaks out of the plugin context into the victim's browser session, enabling session hijacking or credential theft against authenticated WordPress users.
Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.
Unauthenticated forged conversion event injection in Pixel Tag Manager for WooCommerce (all versions before 2.2.1) allows any remote attacker to submit fabricated e-commerce conversion events to the site's server-side advertising APIs - such as Meta Conversions API or Google Ads - using the site's own stored credentials. The root cause is a missing authorization check on a WordPress AJAX action (CWE-284), meaning the endpoint processes requests from anyone without verifying identity or role. A publicly available exploit exists per WPScan; however, the EPSS score of 0.14% (4th percentile) indicates opportunistic exploitation has not yet been observed at scale.
Missing authorization controls in the Buckaroo WooCommerce Payments Plugin before 4.9.0 allow any authenticated WordPress user - including low-privilege Subscribers - to trigger payment capture refunds against any captured order via an unprotected AJAX endpoint. The flaw causes direct financial integrity loss for merchants, as unauthorized refund processing reverses captured payments without any approval workflow. A publicly available exploit exists per WPScan, though EPSS remains very low at 0.13% (3rd percentile), indicating exploitation has not become widespread despite the accessible attack surface.
Authentication bypass in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) lets unauthenticated attackers reset the password of any account, including administrators, resulting in full site takeover. The `ssoprocess_ajax()` handler is exposed via `wp_ajax_nopriv_` and performs a password reset on any email-identified account with no ownership token or capability check, guarded only by a nonce that the plugin itself publicly broadcasts to logged-out visitors. Reported by Wordfence with a maximal CVSS of 9.8; no public exploit has been identified at time of analysis.
Heap-based remote code execution in the FreeRDP Windows client (all versions before 3.29.0) is triggered when a user pastes clipboard content sourced from a malicious RDP server. The client fails to validate the server-supplied data size in CLIPRDR_FILE_CONTENTS_RESPONSE PDUs against the destination buffer, allowing an oversized payload to corrupt heap memory. A publicly available vendor advisory (GHSA-cj9v-h4hq-29jr, reported by VulnCheck) documents the flaw; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9) lets an authenticated low-privileged user mint a SCIM bearer token whose provider ID collides with an existing SSO, SAML, OIDC, generic OAuth, or social provider namespace, causing SCIM user routes to operate on global accounts the token never provisioned. Attackers can list, read, rewrite (email/profile with no uniqueness check), and delete arbitrary Better Auth users and sessions, yielding full account takeover and unauthorized deprovisioning. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor's detailed root-cause writeup makes exploitation straightforward once the plugin is enabled.
Stored cross-site scripting in the Download Manager WordPress plugin before 3.3.66 allows any authenticated user with the Author role or above to inject a malicious JavaScript payload into a download package title, which then executes in the browser of every visitor - including unauthenticated users - who views any page rendering that package. A publicly available proof-of-concept exists, though the EPSS score of 0.19% (9th percentile) and absence of a CISA KEV listing suggest exploitation remains limited and targeted rather than widespread. Vendor-released patch version 3.3.66 is available.
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider and mcp plugins, which advertise the 'none' signing algorithm in OIDC discovery and accept plain PKCE by default. Relying parties whose JWT libraries negotiate the algorithm from discovery metadata without pinning can be tricked into accepting unsigned ID tokens, while exposed authorization URLs allow interception of codes because plain PKCE offers no protection. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user to inject persistent JavaScript into a profile field that executes in any visitor's browser - including logged-in administrators - upon viewing the attacker's public participant profile page. A publicly available proof-of-concept exploit exists, and the CVSS scope change (S:C) reflects that the injected script runs in victim browser contexts entirely outside the plugin's security boundary, enabling credential theft or admin-level site takeover. EPSS is low (0.15%, 5th percentile), suggesting mass exploitation has not yet materialized despite the public POC.
Stored cross-site scripting in the Codeless Page Builder WordPress plugin (versions through 1.1.4) allows contributor-level users to inject arbitrary HTML and JavaScript by supplying unsanitized input as an HTML tag name via a shortcode attribute. When a higher-privileged user such as an administrator views the crafted content, the payload executes in their browser session, enabling session hijacking or unauthorized administrative actions. A public exploit proof-of-concept is available via WPScan; exploitation probability is low per EPSS (0.15%, 5th percentile), suggesting opportunistic rather than widespread active targeting.
Stored cross-site scripting in Admin Columns for ACF Fields WordPress plugin (through 0.3.2) allows contributor-level users to inject unsanitized JavaScript via Advanced Custom Fields values that execute in the browser session of any higher-privileged user who views the affected post-list admin screen. The scope change (S:C in CVSS) reflects that the payload crosses privilege boundaries - a low-privileged contributor can target editors and administrators. A publicly available exploit has been published by WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation in the wild, and this CVE is not listed in the CISA KEV catalog.
HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.
Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-option syntax, letting an attacker who controls clone options smuggle -u<helper> (the short form of --upload-pack=<helper>) past the block on --upload-pack/-u. Applications calling Repo.clone_from with attacker-influenced multi_options and allow_unsafe_options=False are affected, allowing Git to execute an arbitrary helper command during clone despite the safety gate being active. Reported by VulnCheck with a working local proof-of-concept; publicly available exploit code exists, but there is no public exploit identified as used in active attacks and it is not in CISA KEV.
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only roles - run sandboxed JavaScript by submitting a SQL 'DEFINE FUNCTION ... LANGUAGE js' statement, defeating a control that was supposed to restrict scripting to security administrators. The prior GHSA-48qw-824m-86pr hardening added a UPDATE_SECURITY permission gate to the polyglot engine, but the SQL route to JavaScript never invokes it, so low-privilege users regain the very capability the gate was meant to remove. Reported by VulnCheck; the vendor advisory publicly documents a complete two-request exploitation recipe, and the vendor scores it CVSS 4.0 9.3 (Critical), though the runtime sandbox meaningfully limits real-world impact.
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the server by supplying an arbitrary {database} parameter to the time series (/ts/*), batch, Prometheus, and Grafana HTTP handlers. Roughly 14 endpoints resolve the target database and call getDatabase(...) without invoking canAccessToDatabase(...), so a caller scoped to one database (or, per the code, potentially an anonymous request) gains full read/write over databases they were never granted. Reported by VulnCheck with a vendor patch (26.7.2) available; the GHSA advisory publishes concrete exploitation requests, and while EPSS is not provided the CVSS 4.0 base score is 9.3 (Critical). This is not in CISA KEV.
TLS server-identity verification bypass in FreeRDP 3.x (all versions <= 3.28.0) lets a network attacker positioned between an RDP client and server defeat certificate hostname validation. Because tls_verify_certificate()/tls_match_hostname()/x509_utils_get_dns_names() perform custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity APIs, NUL-truncated SAN values, CN acceptance despite non-matching SANs, and IP-literal matching without iPAddress SAN comparison all pass verification. Reported by VulnCheck with a vendor patch (3.29.0); no public exploit identified at time of analysis and it is not on CISA KEV.
TLS server certificate purpose validation bypass in FreeRDP before 3.29.0 allows a trusted, hostname-matching certificate issued only for client authentication (clientAuth EKU) to be accepted as a valid RDP server certificate. This weakens the trust model in environments that rely on Extended Key Usage separation between client and server certificates, enabling an attacker who can present such a certificate to impersonate the RDP server. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and not listed in CISA KEV.
Memory over-disclosure and denial of service in FreeRDP RDP clients (before 3.29.0) using the gateway WebSocket transport allows a malicious or man-in-the-middle gateway/WebSocket peer to read bytes beyond a received Ping payload or crash the client. Because the client's Pong reply reuses a fixed 1024-byte response stream whose length is never sealed to the actual Ping payload, a non-empty Ping causes the client to return an overlong Pong that leaks stale buffer contents (including the masking key, which lets the peer unmask the reply); a zero-length Ping hits an assertion and terminates the client. Reported by VulnCheck; a vendor patch is available, but no public exploit was identified at time of analysis.
Directory traversal in Support Genix WordPress plugin before 1.4.48 exposes arbitrary server files to unauthenticated remote attackers via the ticket-attachment download route. Exploitation is constrained to files matching an allowlisted extension set, yet this still enables disclosure of other users' private ticket attachments and any other allowlisted-extension files accessible to the web server process. A publicly available proof-of-concept exists per WPScan, though EPSS sits at only 0.25% (17th percentile), indicating low observed exploitation pressure despite the low attack complexity.
TLS server-authentication bypass in FreeRDP RDP client versions 3.28.0 and earlier lets a man-in-the-middle present a wildcard certificate (*.example.com) that is wrongly accepted for multi-label subdomains such as a.b.example.com. The flaw lives in tls_match_hostname() in libfreerdp/crypto/tls.c, which treats a wildcard as matching any hostname ending in the parent domain - behavior stricter OpenSSL X509_check_host() rejects. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).
Vote-limit bypass in YOP Poll WordPress plugin before 7.0.6 allows unauthenticated remote attackers to cast unlimited votes on any public poll by spoofing IP addresses through client-controlled HTTP forwarding headers. The plugin enforces its per-IP vote restriction by reading attacker-supplied headers such as X-Forwarded-For rather than the validated TCP connection IP, making the restriction trivially circumventable. A publicly available proof-of-concept exists per WPScan reporting; EPSS sits at 0.14% (4th percentile), indicating low broad exploitation activity at time of analysis despite the low attack complexity.
Unauthenticated order status manipulation is possible in the Event Tickets and Registration WordPress plugin across all versions before 5.29.0.1, due to a completely absent authorization check on an order-management REST endpoint. Any remote actor - with no credentials or privileges - can alter the status of existing orders, enabling fraud scenarios such as marking unpaid orders as completed. A publicly available exploit exists per WPScan; however, EPSS at 0.14% (4th percentile) indicates mass exploitation has not materialized at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated server-side request forgery in the Pixelavo WordPress plugin before 1.5.4 allows any visitor to inject arbitrary Facebook conversion events using the site administrator's stored Conversions API access token. The plugin registers an AJAX endpoint protected only by a nonce that is emitted in plaintext on every public page load, rendering the nonce trivially obtainable and the endpoint effectively unprotected. Attackers can poison the administrator's Facebook Ads analytics with fabricated conversion data and exhaust the configured API quota, degrading ad targeting and measurement. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical).
Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blocklist by supplying abbreviated git option names that git's CLI resolves to dangerous long-options at runtime. This is an incomplete fix of CVE-2026-42215 (patched in 3.1.47): the guard canonicalizes only underscore-to-hyphen but does not model git's unambiguous long-option prefix abbreviation feature, so a kwarg like `upload_p` passes the blocklist unchanged yet arrives at git as `--upload-pack`, enabling arbitrary command execution. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, though the GHSA advisory includes precise source code and sufficient technical detail to substantially lower exploitation barrier.
Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows authenticated Contributors to elevate their accounts to Administrator by poisoning a membership plan's stored role meta. The `save_meta_boxes()` function accepts the `_wps_plan_user_role` POST parameter with no server-side allowlist blocking privileged roles; the only guards applied - `sanitize_key()` and `wp_roles()->is_role()` - both pass 'administrator' as valid. Full exploitation requires the companion Pro plugin to be active, as it is the component that reads the stored meta and calls `add_role()` during membership lifecycle events. No public exploit has been identified at time of analysis, though Wordfence has published full technical detail and the vulnerable source lines are publicly browsable.
Privilege escalation in the Pronamic Pay WordPress plugin (all versions ≤10.1.0) enables authenticated Subscriber-level users to self-escalate to Administrator by submitting a tampered Gravity Forms field value that is passed unvalidated into WordPress's `WP_User::set_role()`. The flaw is in `maybe_update_user_role()` within the plugin's Gravity Forms extension, which performs no allowlist check, capability comparison, or permission verification before applying the attacker-supplied role string. Exploitation is gated on a specific administrator-configured Gravity Forms payment feed setup, but once that configuration exists, a low-privilege user can achieve full WordPress site compromise. No public exploit or CISA KEV listing confirmed at time of analysis; a patch was released in version 10.2.0.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to inject persistent JavaScript into a conversational-form display setting that then executes in the browser of any site visitor who views the affected form. The vulnerability is particularly relevant on WordPress multisite installations, where administrators do not hold the unfiltered_html capability and are therefore expected to be constrained to safe content - making this a bypass of that trust model. A public proof-of-concept exists per WPScan, though EPSS sits at 0.16% (6th percentile), suggesting negligible observed exploitation activity at time of analysis.
Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-controlled arguments to four public API methods. `Repo.archive()` and `git.ls_remote()` forward caller-supplied keyword arguments into the git argument vector without consulting GitPython's own unsafe-options denylist, enabling arbitrary command execution via options such as `--exec` or `--upload-pack`. `Repo.iter_commits()` and `Repo.blame()` accept unsanitized revision strings without a leading-dash check, so a value like `--output=/path/to/file` is interpreted by git as an option, truncating an arbitrary file. No public exploit code or CISA KEV listing was identified at time of analysis; a vendor-released patch is available in 3.1.51.
Heap out-of-bounds read in FreeRDP's TSMF FFmpeg decoder allows a malicious RDP server to crash connecting client processes by sending malformed AVC1 MPEG2VIDEOINFO media type data with undersized ExtraData buffers. All FreeRDP releases prior to 3.29.0 are affected (CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*), with the root cause being fixed-offset heap reads in the media format parser that proceed without validating source buffer length - a CWE-125 pattern. No CISA KEV listing or public exploit code has been identified at time of analysis; the vendor has released a patch at version 3.29.0 and the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity consequence per the provided vector.
Heap buffer overflow in FreeRDP's server-side RAIL channel handler (versions ≤ 3.28.0) allows any connecting RDP client to crash the FreeRDP server process through a crafted RAIL PDU. The root cause is an unchecked subtraction of RAIL_PDU_HEADER_LENGTH from a client-controlled orderLength field in rail_server_handle_messages(); values 0-3 cause an unsigned integer underflow to a very large size, which causes pointer arithmetic wraparound that defeats the Stream_EnsureRemainingCapacity() guard, ultimately triggering an out-of-bounds heap write via WTSVirtualChannelRead(). No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available in FreeRDP 3.29.0.
Null pointer dereference in FreeRDP's smartcard virtual channel allows remote unauthenticated attackers to crash the process by sending malformed smartcard IRP (I/O Request Packet) requests. All FreeRDP releases before 3.29.0 are affected: crafting an IRP with a non-zero cReaders field but truncated reader-state payload causes the decoder to fail, after which the free_reader_states cleanup function dereferences a null pointer and terminates the session. Impact is limited to denial of service - no confidentiality or integrity compromise is possible. No public exploit code or CISA KEV listing identified at time of analysis.
Client process termination in FreeRDP before 3.29.0 is achievable by remote unauthenticated attackers through crafted smartcard cache requests. The flaw resides in the NDR (Network Data Representation) decoder for SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations, which accept NULL for the LookupName pointer; when strlen() is subsequently called on that null pointer, the client process crashes. Exploitation requires smartcard emulation to be enabled on the FreeRDP client. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-reachable, zero-prerequisite nature of the crash path makes this a credible DoS risk wherever the feature is deployed.
Denial of service in FreeRDP before 3.29.0 allows any unauthenticated network-reachable RDP client to exhaust server memory by sending a crafted RDPEI PDU with a large declared body length and no corresponding body data. The RDPEI server channel handler allocates a stream buffer sized to the attacker-controlled length field without first validating it against any maximum, making exploitation trivially repeatable. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the unauthenticated pre-auth vector (CVSS 4.0 PR:N, AV:N, AC:L) and 8.7 score indicate meaningful priority for deployments running FreeRDP in server mode.
Memory exhaustion in FreeRDP before 3.29.0 allows unauthenticated attackers controlling a malicious RD Gateway endpoint to crash the client by sending Transfer-Encoding: chunked HTTP response bodies of unbounded size. The `http_response_recv_body()` function fails to enforce the configured `RESPONSE_SIZE_LIMIT` exclusively for chunked responses, creating an exploitable gap in the intended safety boundary. No active exploitation (CISA KEV) or public POC has been identified, but the CVSS 4.0 score of 8.7 reflects the low attack complexity once an attacker can serve a malicious gateway response.