Overview 661 matches · 0 in Waratek scope · 0 protected · 8 exploited · 5 CISA KEV · 17 public PoC · 2 EPSS ≥ 0.5
661matches
0in Waratek scope0.0%
0protected0.0%
8exploited1.2%
5CISA KEV0.8%
17public PoC2.6%
2EPSS ≥ 0.50.3%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
0.2%
Not applicable
660
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
661
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 210 / year
20031
Not applicable1
High1
not blocked1
Working exploit published1
20042
Not applicable2
High2
not blocked2
No public exploit2
20051
Not applicable1
High1
not blocked1
No public exploit1
20061
Not applicable1
High1
not blocked1
Proof of concept only1
20071
Not applicable1
High1
not blocked1
No public exploit1
20080
20091
Not applicable1
High1
not blocked1
No public exploit1
20103
Not applicable3
High3
not blocked3
No public exploit3
20112
Not applicable2
High2
not blocked2
No public exploit2
20120
20130
20145
Not applicable5
High5
not blocked5
Exploited1
Working exploit published1
No public exploit3
20152
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20163
Not applicable3
High3
not blocked3
No public exploit3
201724
Not applicable24
High24
not blocked24
Working exploit published1
Proof of concept only1
No public exploit22
201843
Not applicable43
High43
not blocked43
Exploited1
No public exploit42
201924
Not applicable24
High24
not blocked24
Working exploit published3
Forecast only1
No public exploit20
202031
Outside Waratek scope1
Not applicable30
High31
not blocked31
Exploited2
No public exploit29
202143
Not applicable43
High43
not blocked43
Proof of concept only3
No public exploit40
202236
Not applicable36
High36
not blocked36
Exploited2
Working exploit published1
No public exploit33
202339
Not applicable39
High39
not blocked39
Working exploit published1
Proof of concept only5
No public exploit33
202491
Not applicable91
High91
not blocked91
Proof of concept only3
No public exploit88
202598
Not applicable98
High98
not blocked98
Exploited1
Proof of concept only2
No public exploit95
2026210
Not applicable210
High210
not blocked210
Exploited1
Working exploit published1
Proof of concept only10
No public exploit198
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-120221 | High | 2026-11-13 | Not applicable | No public exploit | In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected. |
| CVE-2026-96969 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96115 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. |
| CVE-2026-95961 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95934 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85862 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-122163 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network. |
| CVE-2026-119992 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119964 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
| CVE-2026-119963 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
| CVE-2026-119962 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network. |
| CVE-2026-119957 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119934 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| CVE-2026-119817 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Shell allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119399 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118719 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118702 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118296 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118220 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Multiple Provider Router allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112796 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Event Collector Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112758 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-109503 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-105566 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105547 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105545 | High | 2026-11-10 | Not applicable | No public exploit | An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. |
| CVE-2026-105526 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Winsock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105496 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105025 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| CVE-2026-103571 | High | 2026-11-10 | Not applicable | No public exploit | An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The security update addresses the vulnerability by correcting how the Windows CNG Key Isolation Service handles memory. |
| CVE-2026-125269 | High | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory. |
| CVE-2026-68994 | High | 2026-11-05 | Not applicable | No public exploit | A double free vulnerability in NPU driver due to improper pointer management (941) |
| CVE-2026-92211 | High | 2026-11-04 | Not applicable | No public exploit | Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428. |
| CVE-2026-121956 | High | 2026-11-04 | Not applicable | Proof of concept only | FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process. |
| CVE-2026-119116 | High | 2026-10-30 | Not applicable | No public exploit | A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6. |
| CVE-2026-85890 | High | 2026-10-29 | Not applicable | No public exploit | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-88812 | High | 2026-10-27 | Not applicable | No public exploit | A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context. |
| CVE-2026-83831 | High | 2026-10-27 | Not applicable | No public exploit | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-117943 | High | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-112457 | High | 2026-10-26 | Not applicable | No public exploit | A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process memory. |
| CVE-2026-112410 | High | 2026-10-26 | Not applicable | No public exploit | A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may cause an unexpected process termination. |
| CVE-2026-94300 | High | 2026-10-21 | Not applicable | No public exploit | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. |
| CVE-2026-97830 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. |
| CVE-2026-97812 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-97811 | High | 2026-10-13 | Not applicable | No public exploit | Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
| CVE-2026-97772 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97767 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-95943 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95635 | High | 2026-10-13 | Not applicable | No public exploit | Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-88171 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-88149 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88071 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85936 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Shell allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85904 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85829 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-84012 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83916 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Error Reporting allows an authorized attacker to execute code locally. |
| CVE-2026-83842 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83634 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70158 | High | 2026-10-13 | Not applicable | No public exploit | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
| CVE-2026-70062 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. |
| CVE-2026-109943 | High | 2026-10-13 | Not applicable | Proof of concept only | FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled. |
| CVE-2026-108132 | High | 2026-10-13 | Not applicable | No public exploit | Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. |
| CVE-2026-109257 | High | 2026-10-12 | Not applicable | Proof of concept only | FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown. |
| CVE-2026-95702 | High | 2026-10-09 | Not applicable | No public exploit | Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries. |
| CVE-2026-107209 | High | 2026-10-07 | Not applicable | No public exploit | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55. |
| CVE-2026-47558 | High | 2026-09-30 | Not applicable | No public exploit | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. |
| CVE-2026-98154 | High | 2026-09-25 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path. |
| CVE-2026-6794 | High | 2026-09-23 | Not applicable | No public exploit | IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process. |
| CVE-2026-91018 | High | 2026-09-22 | Not applicable | No public exploit | lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system. |
| CVE-2026-20135 | High | 2026-09-16 | Not applicable | No public exploit | A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper buffer management during the TLS 1.3 connection. An attacker could exploit this vulnerability by sending a crafted TLS 1.3 packet to an affected system through a TLS 1.3-enabled listening socket. A successful exploit could allow the attacker to cause the LINA process to crash, which would cause the device to reload. The reload can happen before or after authentication of the connection.Note: TLS 1.3 connections include both data traffic and user-management traffic. |
| CVE-2026-85921 | High | 2026-09-14 | Not applicable | No public exploit | Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
| CVE-2026-23789 | High | 2026-09-14 | Not applicable | No public exploit | An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driver (due to improper cleanup of dma_buf references during error handling) leads to kernel memory corruption and potential arbitrary code execution. |
| CVE-2026-57842 | High | 2026-09-11 | Not applicable | No public exploit | NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time. |
| CVE-2026-87585 | High | 2026-09-09 | Not applicable | No public exploit | Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) |
| CVE-2026-61915 | High | 2026-09-09 | Not applicable | No public exploit | An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties. |
| CVE-2026-81950 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-80080 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-79907 | High | 2026-09-08 | Not applicable | No public exploit | Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-77504 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72958 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71353 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-71351 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70567 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70562 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69876 | High | 2026-09-08 | Not applicable | No public exploit | Use after free in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. |
| CVE-2026-69725 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Windows Hello allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69398 | High | 2026-09-08 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69337 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Windows Registry allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69322 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69309 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69292 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-55007 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-84964 | High | 2026-09-03 | Not applicable | No public exploit | A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly. |
| CVE-2026-33630 | High | 2026-09-03 | Not applicable | No public exploit | c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7. |
| CVE-2026-52023 | High | 2026-09-01 | Not applicable | No public exploit | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree() |
| CVE-2026-19316 | High | 2026-08-28 | Not applicable | No public exploit | A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic. |
| CVE-2026-75159 | High | 2026-08-27 | Not applicable | No public exploit | An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts. |
| CVE-2026-18798 | High | 2026-08-25 | Not applicable | No public exploit | Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary. |
| CVE-2026-47895 | High | 2026-08-22 | Not applicable | No public exploit | In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed. |
| CVE-2026-63652 | High | 2026-08-19 | Not applicable | Proof of concept only | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0. |