Information Disclosure

Cacti, the open-source network monitoring and graphing solution, contains an unspecified vulnerability addressed in Alpine Linux package version 1.2.31-0. The vulnerability type, affected component, and attacker-accessible impact are not disclosed in the available intelligence. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, leaving severity and exploitation conditions uncharacterized from the data provided.

Cacti, the network monitoring and graphing tool, received a security fix in Alpine Linux package version 1.2.31-0. The specific vulnerability class, technical root cause, and impact scope are not disclosed in the available intelligence. No CVSS score, CWE identifier, or advisory narrative accompanies this CVE at time of analysis, making independent severity assessment impossible from provided data alone.

JWT signature verification weakness in the Cacti network monitoring framework (fixed in 1.2.31) lets an authenticated low-privilege user forge or tamper with JSON Web Tokens whose signatures are not properly validated, undermining token integrity. The CWE-347 root cause combined with the vendor's 'Jwt Attack' and 'Information Disclosure' tags points to token forgery that can bypass intended authorization checks. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; it was reported through the Alpine Linux vendor channel and patched upstream by the Cacti project.

Cacti, the open-source network graphing and monitoring solution, has been patched in Alpine Linux at package version 1.2.31-0. The nature of the underlying vulnerability is not disclosed in the available data - no description, CWE classification, or CVSS scoring has been published at time of analysis. Alpine Linux's security team issued the fix, confirming a security-relevant change, but the specific impact class, affected component, and attack surface remain uncharacterized from available intelligence sources.

Cacti, a network monitoring and graphing tool packaged for Alpine Linux, has a security fix included in Alpine's cacti package version 1.2.31-0. The underlying vulnerability details - including attack vector, impact type, and affected component - are not disclosed in available intelligence sources. The sole confirmed data point is that Alpine Linux identified and remediated a security issue in their Cacti package at this version boundary.

Cacti network monitoring software on Alpine Linux has been patched in package version 1.2.31-0, addressing CVE-2026-39952. The underlying vulnerability type, root cause, and attacker-achievable impact are not described in any available intelligence source. No CVSS score, CWE classification, exploit code, or vendor advisory beyond the Alpine package fix note has been identified at time of analysis.

Cacti, the network monitoring and graphing tool packaged for Alpine Linux, received a security fix in version 1.2.31-0. The vulnerability details have not been publicly disclosed beyond the Alpine Linux vendor advisory indicating a patched package release. Because no CVSS score, CWE classification, or technical description is available, the nature, severity, and exploitability of the underlying flaw cannot be characterized at this time.

Cacti, the open-source network monitoring and graphing solution, received a security fix in Alpine Linux's packaged version 1.2.31-0. The nature of the underlying vulnerability is not disclosed in the available intelligence - no CVE description, CVSS score, CWE classification, or exploit details have been published at this time. The sole confirmed fact is that Alpine Linux issued a patched package, meaning users running Cacti on Alpine Linux below version 1.2.31-0 should upgrade. No public exploit identified at time of analysis.

Cacti network monitoring software received a security fix in Alpine Linux package version 1.2.31-0, addressing CVE-2026-39949. The underlying vulnerability type, attack vector, and specific impact are not disclosed in available intelligence - the sole data point is the Alpine Linux vendor advisory confirming a patched package version. No further characterization of attacker capabilities, affected components, or exploitation conditions can be made from available data without risk of fabrication.

Cacti network monitoring software received a security fix packaged by Alpine Linux in version 1.2.31-0. The specific vulnerability details, attack vector, and impact have not been disclosed in the available intelligence - only the fix version is confirmed. No CVSS score, CWE classification, or technical description accompanies this CVE, making independent impact assessment impossible without additional vendor disclosure.

Cacti, the PHP-based network graphing and monitoring solution, received a security fix in Alpine Linux package version 1.2.31-0 addressing CVE-2026-39902. The specific nature of the vulnerability - its type, attack vector, and impact - is not disclosed in the available intelligence data. No exploitation status, CVSS score, or CWE classification is present, making it impossible to characterize attacker capability or affected scope beyond the confirmed patch version.

Cacti, the PHP-based network monitoring and graphing solution, has been patched in Alpine Linux at version 1.2.31-0. The nature of the underlying vulnerability is not disclosed in the available intelligence - only the Alpine Linux vendor advisory confirms that a fix was applied at this version boundary. No CVSS score, CWE classification, or technical description is available, making independent risk assessment impossible without consulting upstream Cacti release notes or the Alpine Linux changelog.

Cacti, the open-source network graphing and monitoring solution, received a security fix in Alpine Linux package version 1.2.31-0. The nature, impact class, and root cause of this vulnerability are not disclosed in the available intelligence data - the sole data point is the Alpine Linux vendor advisory confirming a patched package. No CVSS score, CWE classification, or vulnerability description has been published at time of analysis, making independent risk assessment impossible without additional vendor disclosure.

Cacti, a widely-deployed network monitoring and graphing tool, has been patched in Alpine Linux's package ecosystem at version 1.2.31-0. The underlying vulnerability details - including attack vector, impact class, and exploitation mechanism - are not disclosed in the available intelligence. No CVSS score, CWE classification, or vendor description has been published at time of analysis, making precise impact characterization impossible. No public exploit or CISA KEV listing is associated with this CVE.

Cacti, the open-source network monitoring and graphing solution, has been patched in Alpine Linux at package version 1.2.31-0. The nature of the underlying vulnerability is not disclosed in available intelligence - no CVE description, CVSS vector, CWE classification, or vendor advisory beyond the Alpine security tracker entry has been identified at time of analysis. Security teams running Cacti on Alpine Linux should treat this as an uncharacterized but vendor-confirmed fix requiring upgrade. No public exploit or active exploitation has been identified.

Cacti, the open-source network monitoring and graphing tool, has a vulnerability addressed in Alpine Linux package version 1.2.31-0 (corresponding to Cacti upstream 1.2.31). The nature, impact, and attack surface of this vulnerability are not disclosed in available intelligence - no CVE description, CWE classification, or CVSS scoring has been published at time of analysis. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.

Cacti, the PHP-based network monitoring and graphing solution, has received a security fix in Alpine Linux's packaging at version 1.2.31-0. The nature of the underlying vulnerability - its attack vector, impact, and exploitability - is not disclosed in available intelligence. No CVSS score, CWE classification, or vendor security advisory beyond the Alpine Linux package changelog has been identified at time of analysis, making authoritative risk assessment impossible without further data.

CVE-2026-39895 affects Cacti as packaged for Alpine Linux, with a fix available in Alpine package version 1.2.31-0. The underlying vulnerability type, attack vector, and impact are not disclosed in the available data - the sole intelligence source is an Alpine Linux vendor report confirming the fix. No CVSS score, CWE, or detailed description has been published at the time of this analysis, making it impossible to characterize the precise risk without additional vendor or NVD disclosure.

WEasyPrint on Alpine Linux was patched at package version 69.0-r0, addressing an unspecified vulnerability in the HTML-to-PDF rendering library. The upstream vulnerability details, including attack vector, impact class, and affected upstream version range, are not disclosed in the available intelligence. No exploitation status, CVSS scoring, or CWE classification has been published at this time, making precise impact assessment impossible without consulting the upstream WEasyPrint changelog or a vendor advisory.

PHP 8.3 on Alpine Linux was patched in package version 8.3.32-r0, addressing an unspecified vulnerability tracked as CVE-2026-12184. The underlying vulnerability type, affected functionality, and attacker-achievable impact are not disclosed in the available intelligence - only the fixed Alpine package version is confirmed. No exploitation has been identified, and no CVSS score or CWE classification has been published at the time of this analysis.

Xen Hypervisor was patched in Alpine Linux via package version xen 4.22.0-r0 addressing the security issue tracked as XSA-501. The specific vulnerability class, affected component, and attacker capabilities are not disclosed in the available intelligence - only the fix package version is confirmed by the Alpine Linux vendor advisory. Security teams running Xen on Alpine Linux should treat this as a priority upgrade given that Xen Security Advisories (XSAs) historically address hypervisor-level issues with potentially significant guest-escape or privilege-escalation impact.

Xen Hypervisor is affected by a security vulnerability tracked as XSA-501, which has been remediated in Alpine Linux's xen package at version 4.22.0-r0. The specific nature, impact class, and attack surface of this vulnerability are not disclosed in the available intelligence data - only the patch version and the originating vendor report from Alpine Linux are confirmed. Given the XSA (Xen Security Advisory) designation, this affects Xen's hypervisor stack and may carry implications for guest-to-host or guest-to-guest isolation, though this cannot be confirmed from current data. No active exploitation has been identified at time of analysis.

Xen Hypervisor on Alpine Linux is affected by an uncharacterized security vulnerability addressed by Xen Security Advisory XSA-507. The fix is delivered via Alpine Linux package xen version 4.22.0-r0. The nature of the vulnerability, affected attack surface, and potential impact cannot be determined from available intelligence - only the package-level fix is confirmed by the Alpine vendor.

Xen Hypervisor on Alpine Linux was patched in package version 4.22.0-r0 addressing the issue tracked as XSA-506. The underlying vulnerability details, affected Xen versions, and precise impact are not disclosed in the available intelligence - only the Alpine Linux fix package is identified. Security teams running Xen on Alpine Linux should treat this as a security-relevant update pending full XSA-506 advisory disclosure.

XSA-505 is a Xen Project Security Advisory addressed in Alpine Linux by upgrading the xen package to version 4.22.0-r0. The specific vulnerability class, attack vector, and impact are not disclosed in the available data - the sole confirmed fact is that Alpine Linux vendors have issued a fix. Without the Xen Project's upstream advisory text, the nature of the flaw (e.g., guest-to-host escape, DoS, privilege escalation within a guest) cannot be determined. No public exploit code or CISA KEV listing has been identified at time of analysis.

Xen hypervisor, as packaged in Alpine Linux, was patched in version 4.22.0-r0 addressing the issue tracked as XSA-504 and CVE-2026-62431. The available intelligence is extremely sparse - only the Alpine Linux vendor report confirms a fix was issued; the underlying vulnerability class, attack vector, and impact remain undisclosed in the provided data. No public description, CVSS vector, or CWE has been furnished, making a definitive characterization of exploitability or impact impossible at this time.

Xen Hypervisor is affected by a security vulnerability tracked as XSA-503, addressed in Alpine Linux via the xen 4.22.0-r0 package update. The underlying nature of the flaw - including its attack vector, impact class, and exploitation requirements - is not disclosed in the available intelligence data. Alpine Linux has confirmed the fix through a package update, but no CVSS score, CWE classification, or vulnerability description has been published in the provided data. No public exploit identified at time of analysis.

Alpine Linux has issued a package update fixing an unspecified Xen vulnerability tracked as XSA-502, resolved in the Alpine package xen-4.22.0-r0. The underlying flaw corresponds to Xen Security Advisory 502, but the specific vulnerability class, impact, and affected component have not been disclosed in the available intelligence. Without CVSS scoring, CWE classification, or an upstream XSA advisory body, the precise attacker capability - whether guest escape, privilege escalation, denial of service, or information disclosure - cannot be determined from the data provided.

Xen Hypervisor contains a vulnerability addressed by XSA-500, with Alpine Linux releasing a fix in xen package version 4.22.0-r0. The underlying technical details, affected subsystem, and attacker-achievable impact are not disclosed in the available intelligence - only the patch version and reporting vendor are confirmed. Security teams running Xen on Alpine Linux should apply the available update pending fuller disclosure from the Xen Security Team.

Xen Hypervisor is affected by a security vulnerability tracked as XSA-499 (CVE-2026-62427), addressed in Alpine Linux's xen package at version 4.22.0-r0. The nature, root cause, and impact of the flaw are not disclosed in the available data - the only confirmed intelligence is the Alpine Linux vendor fix. No CVSS scoring, CWE classification, KEV status, or exploit information is available at time of analysis.

Xen Hypervisor on Alpine Linux is affected by a security vulnerability tracked as XSA-499 (CVE-2026-62426), addressed in Alpine's xen package version 4.22.0-r0. The specific vulnerability class, affected Xen upstream version range, and attack impact are not disclosed in the available intelligence - the sole confirmed data point is the Alpine Linux vendor fix. No exploitation status, CVSS score, or CWE classification is available at time of analysis.

Xen Hypervisor on Alpine Linux received a security fix packaged as xen 4.22.0-r0, addressing the issue tracked as XSA-497. The underlying vulnerability details, impact class, and affected attack surface are not disclosed in the available intelligence - only the vendor fix confirmation from Alpine Linux is present. Without the XSA-497 advisory content, the specific impact to confidentiality, integrity, or availability cannot be characterized from this data alone.

Xen Hypervisor contains a vulnerability addressed by XSA-497, fixed in Alpine Linux's xen package at version 4.22.0-r0. The specific nature of the flaw - its attack vector, impact class, and exploitation conditions - is not disclosed in available intelligence; the sole confirmed data point is the Alpine Linux vendor fix. No CVSS score, CWE classification, or detailed technical description is available, preventing characterization of attacker capability or affected scope. No public exploit or CISA KEV listing has been identified at time of analysis.

Xen Hypervisor, as packaged in Alpine Linux, has been patched in version 4.22.0-r0 to address a vulnerability tracked as XSA-497. The specific nature of the flaw - its impact class, affected subsystem, and attacker capability - is not disclosed in the available intelligence. Alpine Linux's vendor advisory confirms the fix but provides no further technical detail, leaving the actual vulnerability behavior uncharacterized at time of analysis.

Xen Hypervisor contains a security vulnerability tracked as XSA-497, addressed in Alpine Linux's xen package version 4.22.0-r0. The specific vulnerability class, affected component, and impact are not disclosed in the available intelligence - only the Alpine Linux vendor advisory confirms a fix exists. Security teams running Xen on Alpine Linux should treat this as a priority patch given the hypervisor attack surface, which can include guest-to-host escapes, privilege escalation, or denial of service depending on the XSA class. No public exploit has been identified at time of analysis.

Xen Hypervisor, as packaged in Alpine Linux, received a security fix in package version 4.22.0-r0 addressing the issue tracked as XSA-497. The underlying vulnerability details, including attack vector, impact class, and affected Xen upstream versions, are not disclosed in the available intelligence - only Alpine's vendor advisory confirms a fix was shipped. Without the full XSA-497 advisory, the scope of exploitation risk cannot be characterized beyond the patch signal itself.

Xen Hypervisor on Alpine Linux contains a vulnerability addressed by XSA-495, patched in Alpine package xen-4.22.0-r0. The specific vulnerability class, affected Xen upstream version range, and attacker impact are not disclosed in the available intelligence - only the Alpine vendor fix is confirmed. Security teams running Xen on Alpine Linux should treat this as a hypervisor-level security issue warranting prompt patching, given that XSA advisories historically cover privilege escalation, information disclosure, or denial-of-service conditions affecting guest-to-host isolation.

PHP 8.3 (php83) on Alpine Linux received a security fix in package version 8.3.33-r0, as reported by the Alpine Linux vendor. The underlying vulnerability details, attack vector, and impact class are not disclosed in the available intelligence - only the fixed package version is known. Security teams running Alpine Linux with php83 prior to 8.3.33-r0 should treat this as an uncharacterized but vendor-confirmed security fix and upgrade accordingly.

Samba on Alpine Linux received a security fix in package version 4.23.10-r0, addressing an unspecified vulnerability reported by the Alpine Linux vendor. The underlying flaw, affected attack surface, and exploitability are not disclosed in available intelligence - the CVE record contains only a changelog-style fix reference with no description, CVSS score, or CWE assignment. Security teams running Alpine Linux with Samba should treat this as an uncharacterized patch and apply it promptly given Samba's historically high-severity vulnerability surface (RCE, privilege escalation, authentication bypass). No public exploit and no CISA KEV listing have been identified at time of analysis.

Samba on Alpine Linux received a security fix in package version 4.23.10-r0, addressing an unspecified vulnerability. The underlying nature of the flaw, affected attack surface, and potential attacker impact cannot be determined from the available intelligence - no CVE description, CVSS vector, or CWE has been published. No public exploit identified at time of analysis, and no CISA KEV listing exists for this CVE.

Samba on Alpine Linux was patched in package version 4.23.10-r0, addressing an unspecified vulnerability. The nature of the flaw, affected attack surface, and potential impact are not derivable from the available data - only the fix version and affected platform (Alpine Linux) are confirmed. No CVSS score, CWE classification, or vulnerability description has been published at time of analysis, making risk characterization impossible without additional vendor disclosure.

Gitea received a security fix in Alpine Linux package version 1.27.1-r0, addressing an unspecified vulnerability tracked as CVE-2026-59774. The underlying vulnerability class, attack vector, and impact are not disclosed in the available intelligence. Administrators running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly, as the absence of public detail does not imply low severity.

perl-yaml on Alpine Linux has been patched in package version 1.320.0-r0 to address CVE-2026-63676. The nature of the underlying vulnerability - including its class, impact, and exploitability - is not described in available intelligence. The sole confirmed data point is that Alpine Linux issued a fixed package, indicating the upstream perl-yaml Perl module contained a security defect requiring remediation.

mbedTLS version 3.x (packaged as mbedtls3) on Alpine Linux contains a vulnerability addressed in Alpine package version 3.6.7-r0. The underlying vulnerability details - including attack vector, impact class, and exploitation requirements - are not disclosed in the available intelligence. The only confirmed fact is that Alpine Linux's vendor advisory identifies a fix in the mbedtls3 3.6.7-r0 package. No CVSS score, CWE classification, or exploit status is available at time of analysis.

Mbed TLS (mbedtls3) received a security fix in Alpine Linux package version 3.6.7-r0, addressing an unspecified vulnerability. The nature of the flaw - whether it affects cryptographic operations, TLS handshake processing, certificate validation, or another component - is not disclosed in the available intelligence. No CVSS score, CWE classification, or vulnerability description has been published, making independent risk assessment impossible at this time.

mbedtls3 on Alpine Linux received a security fix in package version 3.6.7-r0, addressing an unspecified vulnerability in the mbedTLS cryptographic library. The vulnerability details, including attack vector, impact class, and affected functionality, are not disclosed in the available intelligence. No CVSS score, CWE classification, or technical description was provided by the Alpine Linux vendor advisory beyond the package version bump.

Mbed TLS 3.x on Alpine Linux received a security fix in package version 3.6.7-r0, addressing an unspecified vulnerability reported by the Alpine Linux vendor. The nature of the underlying flaw - whether cryptographic, memory safety, or protocol-level - is not disclosed in available intelligence. No exploit activity, CVSS scoring, or CWE classification is available at time of analysis, making independent risk assessment impossible without consulting the upstream Mbed TLS security advisory.

mbedtls3 on Alpine Linux received a security fix in package version 3.6.7-r0. The underlying vulnerability type, impact, and affected upstream MbedTLS version range are not described in the available CVE record - only the Alpine package fix version is confirmed. No exploitation status, CVSS score, or CWE classification has been assigned at time of analysis.

Gitea received a security fix in Alpine Linux package version 1.27.1-r0, addressing an unspecified vulnerability in the Gitea self-hosted Git service. The upstream CVE record (CVE-2026-60004) contains minimal public detail - the nature, impact, and exploitability of the underlying flaw are not disclosed in available intelligence sources. Security teams running Gitea on Alpine Linux should treat the package update as a security-relevant change pending further disclosure.

Mbed TLS 3.x (mbedtls3) on Alpine Linux has been patched in Alpine package version 3.6.7-r0 to address CVE-2026-35336. The underlying vulnerability type, technical root cause, and exploitability details are not disclosed in currently available intelligence - only the Alpine Linux vendor advisory confirms a fix was issued. Security teams using Alpine Linux with mbedtls3 should treat this as requiring immediate patching given that cryptographic libraries commonly underpin TLS, certificate validation, and encryption across many dependent packages.

Mbed TLS (mbedtls) received a security fix in Alpine Linux package version 4.1.1-r0, addressing CVE-2026-54441. The nature of the underlying vulnerability - its impact class, attack vector, and exploitability - is not disclosed in the available intelligence. No CVSS score, CWE classification, or technical description has been published, making meaningful impact assessment impossible at this time. No public exploit has been identified and CISA KEV status is not confirmed.

Mbed TLS (mbedtls), the widely-used open-source TLS/SSL library, received a security fix in Alpine Linux packaged as version 4.1.1-r0. The nature of the underlying vulnerability - its type, impact, attack surface, and affected version range - is not disclosed in the available intelligence. No CVSS score, CWE classification, exploitation status, or vulnerability description has been published at time of analysis. Alpine Linux's vendor advisory constitutes the sole source for this CVE.

Mbed TLS in Alpine Linux received a security fix packaged as version 4.1.1-r0, addressing an unspecified vulnerability. The upstream nature, exploitability, and impact of this flaw cannot be determined from the available intelligence - no CVE description, CVSS vector, CWE classification, or vendor advisory details were provided. No public exploit and no CISA KEV listing have been identified at time of analysis.

mbedTLS on Alpine Linux was patched in package version 4.1.1-r0, addressing an unspecified vulnerability in the TLS/SSL library. The underlying flaw, affected version range, and attack surface are not described in the available data - only the fix package version is confirmed. No CVSS score, CWE, or exploitation status has been published at time of analysis.

Mbed TLS (mbedtls) received a security fix in Alpine Linux package version 4.1.1-r0, addressing an unspecified vulnerability. The nature of the flaw, affected upstream Mbed TLS version, and impact class are not disclosed in the available data - only the Alpine package fix version is confirmed. No CVSS score, CWE classification, or exploit information is available at time of analysis.

mbedTLS on Alpine Linux received a security fix packaged as 4.1.1-r0 in the Alpine repository. The underlying vulnerability details - including attack vector, impact class, and affected mbedTLS upstream versions - are not disclosed in available intelligence sources. No CVSS score, CWE classification, or advisory narrative accompanies this entry; the sole confirmed fact is that Alpine Linux has patched the mbedTLS package at the 4.1.1-r0 Alpine package revision. Security teams using Alpine-based images or systems should treat this as an uncharacterized security fix requiring immediate package update pending further upstream disclosure.

Mbed TLS (mbedtls) on Alpine Linux has been patched in Alpine package version 4.1.1-r0 to address CVE-2026-50580. The nature of the underlying vulnerability - its class, impact, and exploitability - is not described in the available intelligence. The only confirmed data point is the existence of a fixed Alpine package; all other risk signals (CVSS, CWE, KEV, EPSS, POC) are absent, making independent risk assessment impossible without vendor disclosure.

Mbed TLS (mbedtls) in Alpine Linux was patched in package release 4.1.1-r0, addressing an unspecified vulnerability. The nature of the flaw, affected upstream versions, and potential attacker impact cannot be determined from the available data - only the Alpine package fix version is confirmed. No CVSS score, CWE classification, or detailed description has been published at time of analysis.

Mbed TLS (mbedtls) on Alpine Linux contains an unspecified vulnerability addressed in Alpine package version 4.1.1-r0. The nature of the flaw - whether it involves cryptographic weakness, memory corruption, or another class of defect - is not disclosed in the available intelligence. No CVSS score, CWE classification, or exploit data has been published. Security teams running Alpine Linux with mbedtls should treat this as a required update pending full upstream disclosure.

Mbed TLS (mbedtls) in Alpine Linux contains a vulnerability addressed in package version 4.1.1-r0. The nature of the flaw - whether it involves memory corruption, cryptographic weakness, or another class - is not disclosed in the available intelligence. The fix is confirmed by the Alpine Linux vendor advisory. No CVSS score, CWE classification, or exploitation data is available at time of analysis, making risk characterization largely indeterminate beyond the vendor's decision to issue a patch.

Command injection and arbitrary file truncation in the Perl GD module before 2.86 (perl-gd 2.86-r0 on Alpine) arise because GD::Image's _make_filehandle helper opened filenames using Perl's two-argument open(). When an application passes an attacker-influenced filename to constructors like GD::Image->new or newFrom*, prefixes such as `cmd |`, `| cmd`, or `> file` are interpreted by Perl as a command pipe or redirect, yielding command execution or destructive file truncation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS is 0.26% (50th percentile).

py3-aiohttp in Alpine Linux received a security fix packaged as version 3.14.1-r0. The nature of the underlying vulnerability - its attack vector, impact, and exploitation conditions - is not described in the available intelligence. This CVE record is minimal: only the affected package name and the Alpine Linux fix version are confirmed. Security teams should consult the upstream aiohttp changelog and Alpine Linux security advisories for the actual vulnerability details before assessing risk.

Client-side memory corruption in FreeRDP (all versions before 3.27.1) lets a malicious or compromised RDP server compromise a connecting client through improperly bounds-checked bitmap cache orders. The cacheId field of Cache Bitmap V2/V3 orders was masked to only two bits (0x0003) instead of three (0x0007) and used to index cell-cache arrays without validating it against the negotiated number of cells, enabling out-of-bounds access controlled by the server. There is no public exploit identified at time of analysis and EPSS is low (0.45%, 36th percentile), but the CVSS 8.8 reflects full confidentiality, integrity and availability impact once a user connects to the attacker's server.

Out-of-bounds read in FreeRDP's H264 decompression codec allows a malicious or compromised RDP server to trigger memory disclosure and potential client crash when a user connects and receives crafted video frames with mismatched dimensions. Affected clients include all FreeRDP builds prior to 3.27.0 using any of the supported H264 backends (FFmpeg, OpenH264, Android MediaCodec, Windows Media Foundation). No public exploit has been identified at time of analysis, though CVSS 4.0 signals high confidentiality and availability impact with only passive user interaction required.

GStreamer gst-plugins-good received a security fix in Alpine Linux package version 1.26.3-r0. The specific vulnerability class, impact, and affected functionality within this multimedia plugin collection are not disclosed in available intelligence sources. Alpine Linux vendor confirmed the fix, but no CVSS scoring, CWE classification, or technical description has been published, making full impact assessment impossible at this time.

FreeRDP received a security fix in Alpine Linux package version 3.27.1-r0, addressing an undisclosed vulnerability. The nature, severity, and impact of the underlying flaw are not specified in the available intelligence - no CVE description, CVSS score, CWE classification, or advisory has been published at time of analysis. FreeRDP is an open-source RDP client and server implementation widely used on Linux systems; until further details are disclosed, the risk to affected deployments cannot be quantified.

Arbitrary file write in Git LFS versions 0.5.2 through 3.7.0 allows a malicious repository to overwrite files outside the working tree when a user runs git lfs checkout or git lfs pull against a repository containing crafted symbolic or hard links that collide with LFS-tracked file paths. The flaw is fixed in v3.7.1 and is also exploitable in bare repositories under specific conditions. No public exploit identified at time of analysis, and EPSS is very low (0.05%), but the CVSS 4.0 score of 8.6 reflects the high integrity impact achievable through routine developer workflows.

GStreamer's gst-plugins-good package on Alpine Linux received a security fix in version 1.26.3-r0, addressing an unspecified vulnerability. The nature of the flaw, affected functionality, and attacker impact are not disclosed in the available data - only the vendor patch record from Alpine Linux confirms a security-relevant change. No CVSS score, CWE classification, or exploit intelligence is available to characterize severity or exploitability at this time.

GStreamer's gst-plugins-good package on Alpine Linux received a security fix in version 1.26.3-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - no description, CVSS vector, CWE classification, or exploit details have been published at time of analysis. The fix is confirmed only by Alpine Linux's vendor advisory, making the actual impact, affected attack surface, and exploitability unknown pending further disclosure.