Overview 1,350 matches · 2 in Waratek scope · 0 protected · 6 exploited · 5 CISA KEV · 10 public PoC · 1 EPSS ≥ 0.5
1,350matches
2in Waratek scope0.1%
0protected0.0%
6exploited0.4%
5CISA KEV0.4%
10public PoC0.7%
1EPSS ≥ 0.50.1%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
0.1%
Outside Waratek scope
20
1.5%
Not applicable
1,328
98.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
1,350
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 418 / year
20081
Not applicable1
Medium1
not blocked1
No public exploit1
20091
Not applicable1
Medium1
not blocked1
No public exploit1
20103
Not applicable3
Medium3
not blocked3
No public exploit3
201128
Not applicable28
Medium28
not blocked28
No public exploit28
201232
Not applicable32
Medium32
not blocked32
No public exploit32
20132
Not applicable2
Medium2
not blocked2
No public exploit2
20146
Not applicable6
Medium6
not blocked6
Working exploit published1
No public exploit5
201512
Not applicable12
Medium12
not blocked12
No public exploit12
201612
Not applicable12
Medium12
not blocked12
Working exploit published1
No public exploit11
201751
Not applicable51
Medium51
not blocked51
Working exploit published1
Proof of concept only2
No public exploit48
201838
Not applicable38
Medium38
not blocked38
Working exploit published1
Proof of concept only1
No public exploit36
201999
Outside Waratek scope7
Not applicable92
Medium99
not blocked99
Exploited1
No public exploit98
202076
Outside Waratek scope4
Not applicable72
Medium76
not blocked76
No public exploit76
202184
No exploit published1
Outside Waratek scope1
Not applicable82
Medium84
not blocked84
Exploited3
No public exploit81
2022146
No exploit published1
Outside Waratek scope1
Not applicable144
Medium146
not blocked146
Exploited1
Proof of concept only8
No public exploit137
2023136
Outside Waratek scope1
Not applicable135
Medium136
not blocked136
Exploited1
Proof of concept only23
No public exploit112
2024111
Outside Waratek scope1
Not applicable110
Medium111
not blocked111
Proof of concept only10
No public exploit101
202594
Outside Waratek scope1
Not applicable93
Medium94
not blocked94
Proof of concept only8
No public exploit86
2026418
Outside Waratek scope4
Not applicable414
Medium418
not blocked418
Proof of concept only40
No public exploit378
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-128240 | Medium | 2026-11-13 | Not applicable | No public exploit | GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process. |
| CVE-2026-120152 | Medium | 2026-11-12 | Not applicable | No public exploit | Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected. |
| CVE-2026-116310 | Medium | 2026-11-12 | Not applicable | No public exploit | Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected. |
| CVE-2026-126891 | Medium | 2026-11-11 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-124740 | Medium | 2026-11-11 | Not applicable | No public exploit | A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests. |
| CVE-2026-119055 | Medium | 2026-11-11 | Not applicable | No public exploit | CWE- 416: Use After Free vulnerability exists that could cause arbitrary code execution when a local attacker could trick the end user to open a specially crafted malicious SSD file. |
| CVE-2026-96992 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-96983 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network. |
| CVE-2026-96179 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in DNS Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96110 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows OLE allows an authorized attacker to disclose information locally. |
| CVE-2026-96059 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in HID class driver allows an authorized attacker to disclose information locally. |
| CVE-2026-96017 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in DNS Server allows an authorized attacker to deny service over a network. |
| CVE-2026-95913 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Hyper-V allows an unauthorized attacker to deny service over a network. |
| CVE-2026-88215 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-61467 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in the MigTD virtio driver for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-44625 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-40697 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free for some Intel(R) Wireless Software for Windows within Ring 3: User Applications may allow denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (low) and availability (low) impacts. |
| CVE-2026-40427 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free for some Intel(R) QuickAssist Technology Driver for Windows within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-126049 | Medium | 2026-11-10 | Not applicable | No public exploit | Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory. |
| CVE-2026-125394 | Medium | 2026-11-10 | Not applicable | Proof of concept only | FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing. |
| CVE-2026-120819 | Medium | 2026-11-10 | Not applicable | No public exploit | A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected. |
| CVE-2026-120811 | Medium | 2026-11-10 | Not applicable | No public exploit | A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash. |
| CVE-2026-120809 | Medium | 2026-11-10 | Not applicable | No public exploit | A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engine is enabled. |
| CVE-2026-119965 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119918 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. |
| CVE-2026-119871 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows IP Translation Configuration Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119869 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119836 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Management Services allows an authorized attacker to disclose information locally. |
| CVE-2026-113864 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112980 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112750 | Medium | 2026-11-10 | Not applicable | No public exploit | Numeric truncation error in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
| CVE-2026-105530 | Medium | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows System Events Broker allows an authorized attacker to disclose information locally. |
| CVE-2026-125265 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents. |
| CVE-2026-125255 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents. |
| CVE-2026-124684 | Medium | 2026-11-09 | Not applicable | No public exploit | This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buffer while a previously returned raw character pointer remains in use. Successful triggering may cause the Escargot-based process to crash, resulting in a denial of service. |
| CVE-2026-124308 | Medium | 2026-11-07 | Not applicable | Proof of concept only | Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash. |
| CVE-2026-124307 | Medium | 2026-11-07 | Not applicable | No public exploit | Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads dereference freed APS objects in CABACReader::readAlf() and AdaptiveLoopFilter::reconstructCoeff(), causing crashes or heap corruption. |
| CVE-2026-85032 | Medium | 2026-11-03 | Not applicable | No public exploit | The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which parses host OUT data byte by byte and fills a packet buffer at usb->rx_pkt, while the USB device stack thread runs mctp_usb_class_disable(). The disable handler used k_work_cancel(), which removes a queued work item but returns immediately without waiting for a handler that is already running, and then called mctp_usb_reset_rx_state() to mctp_pktbuf_free() the packet buffer the worker may still be using. Both entry points into mctp_usb_class_disable() are driven by the attached USB host: a SET_CONFIGURATION request and a USB bus reset both reach it via usbd_config_reset() in subsys/usb/device_next/usbd_config.c. A host that streams partial MCTP frames on the bulk OUT endpoint and repeatedly forces a configuration change or bus reset therefore controls both the data being parsed and the moment the teardown runs, and can retry the race indefinitely without credentials or user interaction. If the free lands while the worker holds the pointer, the worker writes host-supplied bytes into freed memory of the dedicated MCTP heap (CONFIG_MCTP_HEAP_SIZE in subsys/pmci/mctp/mctp_memory.c), corrupting recycled buffers or sys_heap free-block metadata; this window requires genuine parallelism, i.e. CONFIG_SMP or a preemptible CONFIG_SYSTEM_WORKQUEUE_PRIORITY. With the default cooperative workqueue the worker can still yield inside mctp_bus_rx() (application callback or a control-message reply blocking in mctp_usb_tx()), after which it resumes and calls mctp_pktbuf_free(usb->rx_pkt) on a pointer the teardown has NULLed, dereferencing NULL and faulting on targets with null-pointer detection. The fix replaces the cancel with k_work_cancel_sync() plus a new struct k_work_sync out_work_sync, so disable waits for the RX worker to finish before draining the FIFO and freeing the packet buffer. The affected code is the MCTP subsystem, which is marked experimental, built only with CONFIG_MCTP_USB. |
| CVE-2026-121508 | Medium | 2026-11-03 | Not applicable | No public exploit | Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure |
| CVE-2026-121080 | Medium | 2026-11-03 | Not applicable | No public exploit | Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118446 | Medium | 2026-11-03 | Not applicable | No public exploit | A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation alive. Accessing an element after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the element is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access an array element after the parent object has been freed. The pybddisasm package is no longer maintained. |
| CVE-2026-118445 | Medium | 2026-11-03 | Not applicable | No public exploit | A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation alive. Accessing the member after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the member is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access a member reference after the parent object has been freed. The pybddisasm package is no longer maintained. |
| CVE-2026-58927 | Medium | 2026-11-02 | Not applicable | No public exploit | The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process. |
| CVE-2026-20583 | Medium | 2026-11-02 | Not applicable | No public exploit | In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9747. |
| CVE-2026-20581 | Medium | 2026-11-02 | Not applicable | No public exploit | In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750. |
| CVE-2026-20580 | Medium | 2026-11-02 | Not applicable | No public exploit | In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11412004; Issue ID: MSV-9752. |
| CVE-2026-20570 | Medium | 2026-11-02 | Not applicable | No public exploit | In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9926. |
| CVE-2026-20569 | Medium | 2026-11-02 | Not applicable | No public exploit | In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9927. |
| CVE-2026-20568 | Medium | 2026-11-02 | Not applicable | No public exploit | In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11439283; Issue ID: MSV-10003. |
| CVE-2026-120337 | Medium | 2026-11-02 | Not applicable | Proof of concept only | A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-101183 | Medium | 2026-11-02 | Not applicable | No public exploit | UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-76024 | Medium | 2026-10-30 | Not applicable | No public exploit | Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-119378 | Medium | 2026-10-30 | Not applicable | No public exploit | SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits. |
| CVE-2026-119372 | Medium | 2026-10-30 | Not applicable | Proof of concept only | SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process. |
| CVE-2026-119338 | Medium | 2026-10-30 | Not applicable | Proof of concept only | Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4. |
| CVE-2026-93516 | Medium | 2026-10-28 | Not applicable | No public exploit | A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context. |
| CVE-2026-93515 | Medium | 2026-10-28 | Not applicable | No public exploit | A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context. |
| CVE-2026-117948 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117947 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117944 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117939 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117938 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117935 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117934 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117927 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117924 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117923 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117916 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117914 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117913 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117911 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117909 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117908 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117907 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117906 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117905 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117903 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117902 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117898 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117896 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117895 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117885 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117882 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117880 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117878 | Medium | 2026-10-27 | Not applicable | No public exploit | Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117877 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117876 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117875 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117874 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117865 | Medium | 2026-10-27 | Not applicable | No public exploit | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-82388 | Medium | 2026-10-26 | Not applicable | No public exploit | bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object's embedded hf->sdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client's request list (session->reqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client's list along with the request's func, uuid and pool pointers, and zeroing the hf->slc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation. The failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway's SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call. Once the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session->param->pool, which is now NULL, and the SDP receive paths call session->param->func() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf->acl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session->reqs into a self-referential list that the host's list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service. The fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected. |
| CVE-2026-113904 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash. |
| CVE-2026-113903 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to unexpected memory modification. |
| CVE-2026-113901 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash. |
| CVE-2026-112695 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination. |
| CVE-2026-112693 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. |
| CVE-2026-112666 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination. |
| CVE-2026-112653 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination. |
| CVE-2026-112615 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination. |
| CVE-2026-112599 | Medium | 2026-10-26 | Not applicable | No public exploit | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash. |