https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:43:56.412156+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-14456 bdu:2026-14456 2026-10-03T17:43:56.493089+00:00 bdu:2026-14456 https://cve.radiocsirt.org/vuln/euvd-2026-343831 EUVD-2026-343831 2026-10-03T17:43:56.493127+00:00 EUVD-2026-343831 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67294 fkie_cve-2026-67294 2026-10-03T17:43:56.493141+00:00

FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.

 https://cve.radiocsirt.org/vuln/ghsa-v6mf-3jqv-cgr7 GHSA-v6mf-3jqv-cgr7 2026-10-03T17:43:56.493174+00:00

FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-67294 UBUNTU-CVE-2026-67294 2026-10-03T17:43:56.493193+00:00

Affected: Ubuntu:16.04:LTS: freerdp, Ubuntu:Pro:18.04:LTS: freerdp2, Ubuntu:18.04:LTS: freerdp, Ubuntu:Pro:20.04:LTS: freerdp2, Ubuntu:22.04:LTS: freerdp2, Ubuntu:24.04:LTS: freerdp3, Ubuntu:Pro:24.04:LTS: freerdp2, Ubuntu:26.04:LTS: freerdp3

FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2384 WID-SEC-W-2026-2384 — FreeRDP: Mehrere Schwachstellen 2026-10-03T17:43:56.493228+00:00

Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.