CWE-416 · Use After Free (page 6)
Page 6 of 82 — CVEs classified under CWE-416, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14005 | High | 8.8 | 2026-06-30 | Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures t… |
CVE-2026-13965 | High | 8.8 | 2026-06-30 | Use after free in Oilpan in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13918 | High | 8.8 | 2026-06-30 | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-13915 | High | 8.8 | 2026-06-30 | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2026-13899 | High | 8.8 | 2026-06-30 | Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-13898 | High | 8.8 | 2026-06-30 | Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-13888 | High | 8.8 | 2026-06-30 | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-13885 | High | 8.8 | 2026-06-30 | Use after free in Skia in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT… |
CVE-2026-13880 | Critical | 9.6 | 2026-06-30 | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-13879 | Medium | 6.5 | 2026-06-30 | Use after free in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive informatio… |
CVE-2026-13878 | Critical | 9.6 | 2026-06-30 | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-13870 | High | 8.8 | 2026-06-30 | Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-13869 | Critical | 9.6 | 2026-06-30 | Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-13861 | Critical | 9.6 | 2026-06-30 | Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-13855 | High | 7.5 | 2026-06-30 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to ex… |
CVE-2026-13854 | Critical | 9.6 | 2026-06-30 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2026-13853 | Critical | 9.6 | 2026-06-30 | Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-13848 | High | 8.8 | 2026-06-30 | Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-13846 | Critical | 9.6 | 2026-06-30 | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-13845 | High | 8.8 | 2026-06-30 | Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-13844 | High | 7.8 | 2026-06-30 | Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious… |
CVE-2026-13832 | High | 8.3 | 2026-06-30 | Use after free in Headless in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-13831 | High | 7.5 | 2026-06-30 | Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to execute arbit… |
CVE-2026-13830 | High | 8.8 | 2026-06-30 | Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic… |
CVE-2026-13827 | High | 7.8 | 2026-06-30 | Use after free in Updater in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromi… |
CVE-2026-13823 | High | 8.3 | 2026-06-30 | Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-13821 | High | 8.8 | 2026-06-30 | Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13815 | High | 8.8 | 2026-06-30 | Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-13814 | High | 7.5 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-13811 | High | 8.8 | 2026-06-30 | Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-13807 | High | 7.5 | 2026-06-30 | Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to exe… |
CVE-2026-13805 | High | 8.8 | 2026-06-30 | Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium sec… |
CVE-2026-13804 | High | 8.3 | 2026-06-30 | Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-13802 | High | 7.5 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arb… |
CVE-2026-13799 | High | 8.1 | 2026-06-30 | Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic… |
CVE-2026-13792 | Critical | 9.6 | 2026-06-30 | Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2026-13789 | Critical | 9.6 | 2026-06-30 | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
CVE-2026-13788 | High | 8.8 | 2026-06-30 | Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (C… |
CVE-2026-13787 | High | 8.1 | 2026-06-30 | Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traff… |
CVE-2026-13786 | High | 8.8 | 2026-06-30 | Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security… |
CVE-2026-13785 | Critical | 9.6 | 2026-06-30 | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-13784 | High | 8.8 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-13783 | High | 8.8 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-13782 | Critical | 10.0 | 2026-06-30 | Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-13779 | High | 8.1 | 2026-06-30 | Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traf… |
CVE-2026-13778 | High | 7.8 | 2026-06-30 | Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via a malicious peripheral. (Chromiu… |
CVE-2026-13775 | Critical | 9.8 | 2026-06-30 | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
CVE-2026-13774 | High | 8.1 | 2026-06-30 | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbit… |
CVE-2026-57585 | High | 7.5 | 2026-06-30 | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught erro… |
CVE-2026-10655 | Medium | 6.5 | 2026-06-30 | The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP socket file descriptor directly from the calling thread im… |
CVE-2026-14178 | Medium | 5.9 | 2026-06-30 | openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parser_cxt.nls_fmt_str。在 seqscan + sort 执行路径下，该字符串原本被分配在 SeqScan… |
CVE-2026-43746 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. P… |
CVE-2026-43742 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43740 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visio… |
CVE-2026-43734 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43731 | High | 8.8 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43727 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43726 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43720 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43717 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43716 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing malic… |
CVE-2026-43715 | High | 8.8 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, t… |
CVE-2026-43709 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, t… |
CVE-2026-43704 | Medium | 5.3 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, t… |
CVE-2026-43699 | Medium | 6.5 | 2026-06-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPad… |
CVE-2026-43663 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macO… |
CVE-2026-39872 | Medium | 6.5 | 2026-06-29 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macO… |
CVE-2026-13595 | Medium | 6.8 | 2026-06-29 | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a ra… |
CVE-2026-10646 | High | 7.4 | 2026-06-28 | Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo… |
CVE-2026-49417 | High | 7.0 | 2026-06-27 | Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be re… |
CVE-2026-49412 | High | 7.8 | 2026-06-27 | The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this… |
CVE-2026-53300 | High | 7.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-after-free issue The AI-generated review reported a potentia… |
CVE-2026-53296 | High | 7.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: free channels on probe error On probe error, free the previously o… |
CVE-2026-53290 | High | 7.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put called before stream disable in close In xe_eu_stall_stre… |
CVE-2026-48090 | Medium | 5.9 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filte… |
CVE-2026-47205 | Medium | 5.9 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.36.0 until 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vul… |
CVE-2026-47207 | Medium | 6.5 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if… |
CVE-2026-13283 | High | 7.5 | 2026-06-25 | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-13282 | Medium | 6.8 | 2026-06-25 | Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local attacker to potentially exploit heap corruption via physical acc… |
CVE-2026-7531 | Critical | 9.8 | 2026-06-25 | Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a… |
CVE-2025-60465 | Medium | 6.1 | 2026-06-25 | A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial o… |
CVE-2025-60464 | High | 7.8 | 2026-06-25 | A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2026-12921 | High | 7.8 | 2026-06-25 | In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files which can res… |
CVE-2026-57438 | Medium | 6.6 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_x… |
CVE-2026-57437 | Medium | 5.3 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source documen… |
CVE-2026-57436 | Medium | 5.3 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new r… |
CVE-2026-57435 | High | 7.5 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrappe… |
CVE-2026-57236 | High | 8.2 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g… |
CVE-2026-53276 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer In iso_sock_rebind_bc(), the… |
CVE-2026-53275 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query… |
CVE-2026-53273 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b… |
CVE-2026-53272 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race w… |
CVE-2026-53264 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER an… |
CVE-2026-53260 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a w… |
CVE-2026-53259 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under idev->lock syzbot reported a splat [1]… |
CVE-2026-53256 | High | 8.0 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channe… |
CVE-2026-53248 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free in metadata dst teardown airoha_metadata_dst_free() runs… |
CVE-2026-53247 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() ca… |
CVE-2026-53240 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_p… |
CVE-2026-53239 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race b… |