October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,204
Critical
1,207
High
5,399
Medium
5,731
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111375 FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in... |
critical | 9.1 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-21 |
| CVE-2026-111380 FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audi... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-21 |
| CVE-2026-111381 FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persisten... |
high | 7.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111382 FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerabil... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111373 FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the w... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111378 FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption v... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111379 FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persisten... |
high | 7.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-27 |
| CVE-2026-110838 FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110839 FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a he... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110833 FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute s... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110837 FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OF... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110830 FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-109257 FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initia... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-10-27 |
| CVE-2026-111374 FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability i... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111376 FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerabili... |
medium | 5.0 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111377 FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-110832 FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in w... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110834 FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerabili... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a... |
medium | 5.8 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110836 FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110829 FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110831 FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive... |
medium | 4.3 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-109953 FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vul... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109948 FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vul... |
medium | 4.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109949 FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authen... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109950 FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerabilit... |
medium | 4.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in D... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109952 The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109941 FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_pack... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109943 FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109944 FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardRelea... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109945 FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smar... |
medium | 5.9 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109946 FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region w... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109947 FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation v... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109678 FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-20 |
| CVE-2026-109679 FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_han... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-20 |
| CVE-2026-109680 FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_int... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-20 |
| CVE-2026-109938 Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109939 FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.