CWE-416 · Use After Free (page 20)
Page 20 of 89 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7908 | Critical | 9.6 | 2026-05-06 | Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-7907 | High | 8.8 | 2026-05-06 | Use after free in DOM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-7906 | High | 8.8 | 2026-05-06 | Use after free in SVG in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-7901 | High | 8.8 | 2026-05-06 | Use after free in ANGLE in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-7898 | High | 8.8 | 2026-05-06 | Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via malicious network traffic… |
CVE-2026-7897 | High | 7.5 | 2026-05-06 | Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to exe… |
CVE-2026-43237 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Manag… |
CVE-2026-43236 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release The atmel_hlcdc_plan… |
CVE-2026-43232 | High | 8.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync… |
CVE-2026-43203 | High | 7.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: atm: fore200e: fix use-after-free in tasklets during device removal When the PCA-200E or… |
CVE-2026-43138 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: reset: gpio: suppress bind attributes in sysfs This is a special device that's created dy… |
CVE-2026-43111 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: HID: roccat: fix use-after-free in roccat_report_event roccat_report_event() iterates ove… |
CVE-2026-43084 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among a… |
CVE-2026-43076 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline data i_size during inode read When reading an inode from disk, ocf… |
CVE-2026-23631 | High | 8.1 | 2026-05-05 | Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchr… |
CVE-2026-23479 | High | 8.8 | 2026-05-05 | Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processComman… |
CVE-2026-43059 | High | 7.8 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f67… |
CVE-2026-24082 | High | 7.8 | 2026-05-04 | Memory Corruption when copying data from a freed source while executing performance counter deselect operation. |
CVE-2026-22166 | High | 8.1 | 2026-05-01 | A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared libra… |
CVE-2026-22165 | High | 8.1 | 2026-05-01 | A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a write UAF crash in the GPU GLES user-space shared lib… |
CVE-2026-43056 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, a… |
CVE-2026-43050 | High | 7.0 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sock_def_readable() A race condition exists between lec_a… |
CVE-2026-43049 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Pres… |
CVE-2026-43027 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregis… |
CVE-2026-43019 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field a… |
CVE-2026-43018 | High | 8.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn look… |
CVE-2026-43016 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). syzbo… |
CVE-2026-43015 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: macb: fix clk handling on PCI glue driver removal platform_device_unregister() may s… |
CVE-2026-31769 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: gpib: fix use-after-free in IO ioctl handlers The IBRD, IBWRT, IBCMD, and IBWAIT ioctl ha… |
CVE-2026-31758 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Flush anchored URBs in usbtmc_release When calling usbtmc_release, pending a… |
CVE-2026-31731 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: thermal: core: Address thermal zone removal races with resume Since thermal_zone_pm_compl… |
CVE-2026-31718 | Critical | 9.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger When a durable file… |
CVE-2026-31715 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() The xfstests… |
CVE-2026-31703 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: writeback: Fix use after free in inode_switch_wbs_work_fn() inode_switch_wbs_work_fn() ha… |
CVE-2026-31702 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() In f2fs_compress_write_en… |
CVE-2026-31695 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Currently we execute `SET_… |
CVE-2026-5655 | Medium | 5.5 | 2026-04-30 | SDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 allows denial of service |
CVE-2026-7111 | High | 8.4 | 2026-04-29 | Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or m… |
CVE-2026-7363 | High | 8.8 | 2026-04-28 | Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a… |
CVE-2026-7361 | High | 8.8 | 2026-04-28 | Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2026-7359 | High | 8.8 | 2026-04-28 | Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-7358 | High | 8.8 | 2026-04-28 | Use after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-7357 | High | 7.5 | 2026-04-28 | Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially exploit heap c… |
CVE-2026-7356 | High | 8.8 | 2026-04-28 | Use after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium se… |
CVE-2026-7355 | High | 8.8 | 2026-04-28 | Use after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-7352 | High | 8.3 | 2026-04-28 | Use after free in Media in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-7350 | High | 8.3 | 2026-04-28 | Use after free in WebMIDI in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-7349 | High | 7.5 | 2026-04-28 | Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to execute arbitrary code inside a sandbox via… |
CVE-2026-7348 | High | 8.8 | 2026-04-28 | Use after free in Codecs in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-7347 | High | 8.1 | 2026-04-28 | Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chrom… |
CVE-2026-7344 | High | 8.8 | 2026-04-28 | Use after free in Accessibility in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to poten… |
CVE-2026-7343 | High | 7.5 | 2026-04-28 | Use after free in Views in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-7342 | High | 8.8 | 2026-04-28 | Use after free in WebView in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafte… |
CVE-2026-7341 | High | 8.8 | 2026-04-28 | Use after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-7338 | High | 7.5 | 2026-04-28 | Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to potentially exploit heap corruption via mal… |
CVE-2026-7336 | High | 8.8 | 2026-04-28 | Use after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-7335 | High | 8.8 | 2026-04-28 | Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-7334 | High | 8.8 | 2026-04-28 | Use after free in Views in Google Chrome on Mac prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2026-7333 | Critical | 9.6 | 2026-04-28 | Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-7322 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-5943 | High | 7.8 | 2026-04-27 | Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modification… |
CVE-2026-5942 | Medium | 5.5 | 2026-04-27 | Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalid… |
CVE-2026-5940 | High | 7.8 | 2026-04-27 | Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes. |
CVE-2026-5939 | Medium | 5.5 | 2026-04-27 | A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code… |
CVE-2026-6786 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-6785 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence… |
CVE-2026-31669 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are l… |
CVE-2026-31665 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: fix use-after-free in timeout object destroy nft_ct_timeout_obj_destro… |
CVE-2026-31652 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/stat: deallocate damon_call() failure leaking damon_ctx damon_stat_start() alway… |
CVE-2026-31650 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on disconnect The vub300 driver maintains an explicit ref… |
CVE-2026-31644 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() When lan966x_fdma_relo… |
CVE-2026-31597 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY filemap_fault() may drop t… |
CVE-2026-31589 | Critical | 9.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_fre… |
CVE-2026-31588 | High | 8.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to u… |
CVE-2026-31587 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm: move component registration to unmanaged version q6apm component regis… |
CVE-2026-31586 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() cgwb_release_workfn() calls c… |
CVE-2026-31584 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix use-after-free in encoder release path The fops_vcodec_relea… |
CVE-2026-31583 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: media: em28xx: fix use-after-free in em28xx_v4l2_open() em28xx_v4l2_open() reads dev->v4l… |
CVE-2026-31582 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Fix use-after-free on USB disconnect After powerz_disconnect() frees the… |
CVE-2026-31581 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct i… |
CVE-2026-31580 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: bcache: fix cached_dev.sb_bio use-after-free and crash In our production environment, we… |
CVE-2026-31578 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: media: as102: fix to not free memory after the device is registered in as102_usb_probe() … |
CVE-2026-31576 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: media: hackrf: fix to not free memory after the device is registered in hackrf_probe() In… |
CVE-2026-31566 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib amdgpu_amdkfd_submit_ib(… |
CVE-2026-31554 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: futex: Require sys_futex_requeue() to have identical flags Nicholas reported that his LLM… |
CVE-2026-31541 | High | 7.8 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix trace_marker copy link list updates When the "copy_trace_marker" option is e… |
CVE-2026-6919 | Critical | 9.6 | 2026-04-23 | Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-31533 | Critical | 9.8 | 2026-04-23 | In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling… |
CVE-2026-31532 | High | 7.8 | 2026-04-23 | In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN rece… |
CVE-2026-31530 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called… |
CVE-2026-31527 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: driver core: platform: use generic driver_override infrastructure When a driver is probed… |
CVE-2026-31511 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete This fixe… |
CVE-2026-31504 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race… |
CVE-2026-31501 | Critical | 9.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path cppi5_hdesc_get_p… |
CVE-2026-31500 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error(… |
CVE-2026-31493 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix use of completion ctx after free On admin queue completion handling, if the… |
CVE-2026-31490 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix use-after-free in migration restore When an error is returned from xe_srio… |
CVE-2026-31488 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commi… |
CVE-2026-31485 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-lpspi: fix teardown order issue (UAF) There is a teardown order issue in the… |
CVE-2026-31474 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxch… |