CVE-2026-77220 | Medium | 6.5 | 2026-08-21 | PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the… |
CVE-2026-76891 | Low | 3.1 | 2026-08-19 | Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76890 | Low | 3.1 | 2026-08-19 | Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-17523 | High | 7.8 | 2026-07-27 | A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code wi… |
CVE-2026-10671 | High | 7.1 | 2026-07-14 | In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel ob… |
CVE-2026-54778 | Medium | 6.2 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer ide… |
CVE-2026-58592 | High | 8.3 | 2026-07-01 | Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAs… |
CVE-2026-12610 | Medium | 6.4 | 2026-06-30 | A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is… |
CVE-2026-57435 | High | 7.5 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrappe… |
CVE-2026-53175 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
On netns teardown, f… |
CVE-2026-53085 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
bpf: fix mm lifecycle in open-coded task_vma iterator
The open-coded task_vma iterator re… |
CVE-2026-53033 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Take state lock for af_unix iter
When a BPF iterator program updates a sock… |
CVE-2026-53006 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible UAF in icmpv6_rcv()
Caching saddr and daddr before pskb_pull() is prob… |
CVE-2026-52976 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
Two error handling issues exist… |
CVE-2026-52973 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
futex: Drop CLONE_THREAD requirement for private default hash alloc
Currently need_futex_… |
CVE-2026-52952 | High | 8.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
In __iommu_group_set… |
CVE-2026-52950 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
drm/xe/dma-buf: fix UAF with retry loop
Retry doesn't work here, since bo will be freed o… |
CVE-2026-52924 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
sctp: purge outqueue on stale COOKIE-ECHO handling
sctp_stream_update() is only invoked w… |
CVE-2026-52923 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
ipc: limit next_id allocation to the valid ID range
The checkpoint/restore sysctl path ca… |
CVE-2026-12328 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed eviden… |
CVE-2026-12326 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-12293 | Critical | 9.8 | 2026-06-16 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12291 | High | 8.8 | 2026-06-16 | Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-42014 | Medium | 6.6 | 2026-06-16 | A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability… |
CVE-2026-6040 | High | 7.3 | 2026-06-15 | A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked agains… |
CVE-2026-46523 | Medium | 6.2 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image ca… |
CVE-2026-45447 | High | 8.8 | 2026-06-09 | Issue summary: A specially crafted PKCS#7 or S/MIME signed message could
trigger a use-after-free during PKCS#7 signature verification.
Impact summary: A use-… |
CVE-2026-46243 | High | 7.1 | 2026-06-01 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject userspace cifs.spnego descriptions
cifs.spnego key descriptions conta… |
CVE-2026-44422 | High | 7.5 | 2026-05-29 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multi… |
CVE-2026-46176 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
mlx5_ib_dev_res_srq_… |
CVE-2026-46166 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: use safe list iteration in radar detect work
The call to ieee80211_dfs_ca… |
CVE-2026-46125 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: remove station if connection prep fails
If connection preparation fails f… |
CVE-2026-45998 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix potential UAF after skb_unshare() failure
If skb_unshare() fails to unshare a… |
CVE-2026-45972 | Critical | 9.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential UAF and double free in smb2_open_file()
Zero out @err_iov and… |
CVE-2026-8854 | High | 7.5 | 2026-05-26 | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache. |
CVE-2026-3593 | High | 7.4 | 2026-05-20 | A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.
This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21… |
CVE-2026-8947 | High | 7.3 | 2026-05-19 | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, a… |
CVE-2026-8390 | High | 7.3 | 2026-05-12 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3. |
CVE-2026-6722 | Critical | 9.8 | 2026-05-10 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stor… |
CVE-2026-8090 | High | 7.3 | 2026-05-07 | Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0… |
CVE-2026-31703 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
writeback: Fix use after free in inode_switch_wbs_work_fn()
inode_switch_wbs_work_fn() ha… |
CVE-2026-7111 | High | 8.4 | 2026-04-29 | Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or m… |
CVE-2026-34001 | High | 7.8 | 2026-04-23 | A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFenc… |
CVE-2026-6754 | High | 7.5 | 2026-04-21 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Th… |
CVE-2026-6747 | High | 7.5 | 2026-04-21 | Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6746 | High | 7.5 | 2026-04-21 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thu… |
CVE-2026-6100 | High | 8.1 | 2026-04-13 | Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError… |
CVE-2026-34734 | High | 7.8 | 2026-04-09 | HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicio… |
CVE-2026-34774 | High | 8.1 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that… |
CVE-2026-35094 | Low | 3.3 | 2026-04-01 | A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. T… |
CVE-2026-5165 | Medium | 6.7 | 2026-03-30 | A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resul… |
CVE-2026-2436 | Medium | 6.5 | 2026-03-26 | A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees co… |
CVE-2026-33526 | High | 7.5 | 2026-03-26 | Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. Thi… |
CVE-2026-4729 | Critical | 9.8 | 2026-03-24 | Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-4721 | Critical | 9.8 | 2026-03-24 | Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence… |
CVE-2026-4696 | Critical | 9.8 | 2026-03-24 | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, an… |
CVE-2026-4691 | Critical | 9.8 | 2026-03-24 | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 14… |
CVE-2026-4688 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149… |
CVE-2026-33150 | High | 7.8 | 2026-03-20 | libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsyst… |
CVE-2026-32873 | High | 7.5 | 2026-03-20 | ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared)… |
CVE-2026-23868 | Medium | 5.1 | 2026-03-10 | Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to tr… |
CVE-2026-30978 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXf… |
CVE-2026-24678 | High | 7.5 | 2026-02-09 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after… |
CVE-2026-23074 | High | 7.8 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved:
net/sched: Enforce that teql can only be used as root qdisc
Design intent of teql is that… |
CVE-2025-12119 | Medium | 6.8 | 2025-11-18 | A mongoc_bulk_operation_t may read invalid memory if large options are passed. |
CVE-2025-61664 | Medium | 4.9 | 2025-11-18 | A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit comm… |
CVE-2025-61663 | Medium | 4.9 | 2025-11-18 | A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Fre… |
CVE-2025-54771 | Medium | 4.9 | 2025-11-18 | A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly ret… |
CVE-2025-54770 | Medium | 4.9 | 2025-11-18 | A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Fre… |
CVE-2025-10911 | Medium | 5.5 | 2025-09-25 | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. |
CVE-2025-49795 | High | 7.5 | 2025-06-16 | A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML inpu… |
CVE-2025-49794 | Critical | 9.1 | 2025-06-16 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the… |
CVE-2025-30653 | Medium | 6.5 | 2025-04-09 | An Expired Pointer Dereference vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adja… |
CVE-2024-45105 | Medium | 6.7 | 2024-09-13 | An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local at… |
CVE-2024-8250 | High | 7.8 | 2024-08-29 | NTLMSSP dissector crash in Wireshark 4.2.0 to 4.0.6 and 4.0.0 to 4.0.16 allows denial of service via packet injection or crafted capture file |
CVE-2024-39792 | High | 7.5 | 2024-08-14 | When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization. Note: Software v… |
CVE-2024-28889 | Medium | 5.9 | 2024-05-08 |
When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the atta… |
CVE-2024-23310 | Critical | 9.8 | 2024-02-20 | A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially cra… |
CVE-2024-23638 | Medium | 6.5 | 2024-01-24 | Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against C… |
CVE-2023-48698 | Medium | 6.8 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-48697 | Medium | 6.4 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-48696 | Medium | 6.7 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-48694 | Medium | 6.8 | 2023-12-05 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code… |
CVE-2023-48692 | Critical | 9.0 | 2023-12-05 | Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execu… |
CVE-2023-48316 | Critical | 9.8 | 2023-12-05 | Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execu… |
CVE-2023-48315 | High | 8.8 | 2023-12-05 | Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execu… |
CVE-2023-20212 | High | 7.5 | 2023-08-18 | A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected devi… |
CVE-2021-39228 | Medium | 6.5 | 2021-09-17 | Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Iss… |
CVE-2021-25443 | Medium | 5.3 | 2021-08-05 | A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker. |
CVE-2019-15691 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routi… |