WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-416✕
Overview 7,490 matches · 6 in Waratek scope · 1 protected · 105 exploited · 86 CISA KEV · 188 public PoC · 53 EPSS ≥ 0.5
7,490matches 6in Waratek scope0.1% 1protected0.0% 105exploited1.4% 86CISA KEV1.1% 188public PoC2.5% 53EPSS ≥ 0.50.7%
Protected by Waratek 1 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 0.1% Outside Waratek scope 29 0.4% Not applicable 7,455 99.5% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 7,490 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 0.0% partly blocked 0 0.0% not blocked 7,489 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 105 1.4% Working exploit published 85 1.1% Proof of concept only 205 2.7% Forecast only 19 0.3% No public exploit 7,076 94.5%
split by peak 2,769 / year
Not applicable: 7,455Outside Waratek scope: 29No exploit published: 5Protected by Waratek: 1 High: 7,490 not blocked: 7,489blocked by ARMR today: 1 No public exploit: 7,076Forecast only: 19Proof of concept only: 205Working exploit published: 85Exploited: 105
20062 Not applicable2 High2 not blocked2 Exploited1 No public exploit1 20071 Not applicable1 High1 not blocked1 No public exploit1 20081 Not applicable1 High1 not blocked1 No public exploit1 20096 Not applicable6 High6 not blocked6 Exploited1 Working exploit published1 No public exploit4 201023 Not applicable23 High23 not blocked23 Exploited3 Working exploit published4 No public exploit16 201128 Not applicable28 High28 not blocked28 No public exploit28 201248 Not applicable48 High48 not blocked48 Exploited2 Working exploit published1 No public exploit45 201336 Not applicable36 High36 not blocked36 Exploited4 Working exploit published4 No public exploit28 201419 Not applicable19 High19 not blocked19 Exploited3 Working exploit published1 No public exploit15 201529 Not applicable29 High29 not blocked29 Exploited1 Working exploit published5 No public exploit23 2016103 Not applicable103 High103 not blocked103 Exploited3 Working exploit published17 No public exploit83 2017196 Outside Waratek scope1 Not applicable195 High196 not blocked196 Exploited3 Working exploit published16 No public exploit177 2018279 Outside Waratek scope1 Not applicable278 High279 not blocked279 Exploited2 Working exploit published11 Proof of concept only1 No public exploit265 2019351 Outside Waratek scope10 Not applicable341 High351 not blocked351 Exploited8 Working exploit published15 Proof of concept only1 Forecast only1 No public exploit326 2020241 Outside Waratek scope6 Not applicable235 High241 not blocked241 Exploited5 Working exploit published2 Proof of concept only4 Forecast only1 No public exploit229 2021408 No exploit published1 Outside Waratek scope6 Not applicable401 High408 not blocked408 Exploited16 Proof of concept only3 Forecast only13 No public exploit376 2022536 Outside Waratek scope3 Not applicable533 High536 not blocked536 Exploited8 Working exploit published1 Proof of concept only39 No public exploit488 2023473 Outside Waratek scope1 Not applicable472 High473 not blocked473 Exploited13 Working exploit published2 Proof of concept only48 Forecast only3 No public exploit407 20241,025 No exploit published1 Not applicable1,024 High1,025 not blocked1,025 Exploited12 Proof of concept only37 Forecast only1 No public exploit975 2025916 Outside Waratek scope1 Not applicable915 High916 not blocked916 Exploited16 Working exploit published4 Proof of concept only13 No public exploit883 20262,769 Protected by Waratek1 No exploit published3 Not applicable2,765 High2,769 blocked by ARMR today1 not blocked2,768 Exploited4 Working exploit published1 Proof of concept only59 No public exploit2,705
20062008201020122014201620182020202220242026
7,490 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 75 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-129456 High 2026-11-14 Not applicable No public exploit In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count of the attribute's interned sub-TLV chain out of balance, so that the chain is freed while routes stored by bgpd (Adj-RIB-In entries and RIB paths) still point to it. When those routes are later replaced, withdrawn or cleared, for example when the session goes down, bgpd reads the freed memory, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. The issue was reproduced with "soft-reconfiguration inbound" configured for the neighbor, and the reporter observed that the crash does not occur on every attempt.
CVE-2026-52790 High 2026-11-13 Not applicable Proof of concept only BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-128016 High 2026-11-13 Not applicable No public exploit FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.
CVE-2026-128015 High 2026-11-13 Not applicable No public exploit FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.
CVE-2026-120221 High 2026-11-13 Not applicable No public exploit In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected.
CVE-2026-121753 High 2026-11-12 Not applicable No public exploit Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28587.
CVE-2026-121742 High 2026-11-12 Not applicable No public exploit Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28757.
CVE-2026-121741 High 2026-11-12 Not applicable No public exploit Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30421.
CVE-2026-120150 High 2026-11-12 Not applicable No public exploit Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120147 High 2026-11-12 Not applicable No public exploit Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120143 High 2026-11-12 Not applicable No public exploit Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116332 High 2026-11-12 Not applicable No public exploit Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116323 High 2026-11-12 Not applicable No public exploit Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116320 High 2026-11-12 Not applicable No public exploit Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116319 High 2026-11-12 Not applicable No public exploit Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116307 High 2026-11-12 Not applicable No public exploit Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116304 High 2026-11-12 Not applicable No public exploit Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-126921 High 2026-11-11 Not applicable No public exploit Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126919 High 2026-11-11 Not applicable No public exploit Use after free in BrowserTag in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126918 High 2026-11-11 Not applicable No public exploit Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126911 High 2026-11-11 Not applicable No public exploit Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-126904 High 2026-11-11 Not applicable No public exploit Use after free in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126901 High 2026-11-11 Not applicable No public exploit Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126900 High 2026-11-11 Not applicable No public exploit Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126899 High 2026-11-11 Not applicable No public exploit Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126895 High 2026-11-11 Not applicable No public exploit Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-126892 High 2026-11-11 Not applicable No public exploit Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126887 High 2026-11-11 Not applicable No public exploit Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126886 High 2026-11-11 Not applicable No public exploit Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126883 High 2026-11-11 Not applicable No public exploit Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126879 High 2026-11-11 Not applicable No public exploit Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-126877 High 2026-11-11 Not applicable No public exploit Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126873 High 2026-11-11 Not applicable No public exploit Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126869 High 2026-11-11 Not applicable No public exploit Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126867 High 2026-11-11 Not applicable No public exploit Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126865 High 2026-11-11 Not applicable No public exploit Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126864 High 2026-11-11 Not applicable No public exploit Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126863 High 2026-11-11 Not applicable No public exploit Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126861 High 2026-11-11 Not applicable No public exploit Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126852 High 2026-11-11 Not applicable No public exploit Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126851 High 2026-11-11 Not applicable No public exploit Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-123874 High 2026-11-11 Not applicable No public exploit A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
CVE-2026-123866 High 2026-11-11 Not applicable No public exploit A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-123864 High 2026-11-11 Not applicable No public exploit A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-96994 High 2026-11-10 Not applicable No public exploit Use after free in Winsock allows an authorized attacker to elevate privileges locally.
CVE-2026-96978 High 2026-11-10 Not applicable No public exploit Use after free in Windows Credential User Interface allows an authorized attacker to elevate privileges locally.
CVE-2026-96973 High 2026-11-10 Not applicable No public exploit Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-96971 High 2026-11-10 Not applicable No public exploit Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
CVE-2026-96177 High 2026-11-10 Not applicable No public exploit Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-96171 High 2026-11-10 Not applicable No public exploit Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-96155 High 2026-11-10 Not applicable No public exploit Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96124 High 2026-11-10 Not applicable No public exploit Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-96092 High 2026-11-10 Not applicable No public exploit Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-96076 High 2026-11-10 Not applicable No public exploit Use after free in Windows DIAL Client allows an authorized attacker to elevate privileges locally.
CVE-2026-96073 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96072 High 2026-11-10 Not applicable No public exploit Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
CVE-2026-96061 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96047 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96046 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96043 High 2026-11-10 Not applicable No public exploit Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96042 High 2026-11-10 Not applicable No public exploit Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96035 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96027 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96026 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96023 High 2026-11-10 Not applicable No public exploit Use after free in Windows Push Notification Core allows an authorized attacker to elevate privileges locally.
CVE-2026-96008 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96007 High 2026-11-10 Not applicable No public exploit Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVE-2026-96004 High 2026-11-10 Not applicable No public exploit Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-95997 High 2026-11-10 Not applicable No public exploit Use after free in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.
CVE-2026-95991 High 2026-11-10 Not applicable No public exploit Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95989 High 2026-11-10 Not applicable No public exploit Use after free in vhdmp.sys allows an authorized attacker to elevate privileges locally.
CVE-2026-95987 High 2026-11-10 Not applicable No public exploit Use after free in Windows User Manager Service allows an authorized attacker to elevate privileges locally.
CVE-2026-95979 High 2026-11-10 Not applicable No public exploit Use after free in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
CVE-2026-95976 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
CVE-2026-95968 High 2026-11-10 Not applicable No public exploit Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
CVE-2026-95966 High 2026-11-10 Not applicable No public exploit Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95956 High 2026-11-10 Not applicable No public exploit Use after free in Windows eSCL Scanner allows an unauthorized attacker to execute code over a network.
CVE-2026-95895 High 2026-11-10 Not applicable No public exploit Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95885 High 2026-11-10 Not applicable No public exploit Use after free in Windows Client for NFS allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-95876 High 2026-11-10 Not applicable No public exploit Use after free in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally.
CVE-2026-94522 High 2026-11-10 Not applicable No public exploit Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-94519 High 2026-11-10 Not applicable No public exploit Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-88249 High 2026-11-10 Not applicable No public exploit Use after free in Windows Client for NFS allows an unauthorized attacker to execute code over a network.
CVE-2026-88244 High 2026-11-10 Not applicable No public exploit Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-88242 High 2026-11-10 Not applicable No public exploit Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-88237 High 2026-11-10 Not applicable No public exploit Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVE-2026-88232 High 2026-11-10 Not applicable No public exploit Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.
CVE-2026-88221 High 2026-11-10 Not applicable No public exploit Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-88212 High 2026-11-10 Not applicable No public exploit Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-85862 High 2026-11-10 Not applicable No public exploit Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-85801 High 2026-11-10 Not applicable No public exploit Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
CVE-2026-83894 High 2026-11-10 Not applicable No public exploit Use after free in RPC Runtime allows an authorized attacker to elevate privileges locally.
CVE-2026-80094 High 2026-11-10 Not applicable No public exploit Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.
CVE-2026-72998 High 2026-11-10 Not applicable No public exploit Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-70231 High 2026-11-10 Not applicable No public exploit Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
CVE-2026-70120 High 2026-11-10 Not applicable No public exploit Use after free in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-69565 High 2026-11-10 Not applicable No public exploit Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally.
CVE-2026-69327 High 2026-11-10 Not applicable No public exploit Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code locally.
CVE-2026-59609 High 2026-11-10 Not applicable No public exploit In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59603 High 2026-11-10 Not applicable No public exploit In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abort during message retry handling due to a use after free. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
‹ prev page 1 of 75 next ›