Total
7843 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-13595 | 2 Kernel, Redhat | 4 Util-linux, Enterprise Linux, Hardened Images and 1 more | 2026-07-08 | N/A | 6.8 MEDIUM |
| A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | |||||
| CVE-2026-53247 | 1 Linux | 1 Linux Kernel | 2026-07-07 | N/A | 9.8 CRITICAL |
| In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed. | |||||
| CVE-2026-53248 | 1 Linux | 1 Linux Kernel | 2026-07-07 | N/A | 8.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free in metadata dst teardown airoha_metadata_dst_free() runs metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, an use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed. | |||||
| CVE-2022-30065 | 2 Busybox, Siemens | 13 Busybox, Scalance Sc622-2c, Scalance Sc622-2c Firmware and 10 more | 2026-07-07 | 6.8 MEDIUM | 7.8 HIGH |
| A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. | |||||
| CVE-2026-53157 | 1 Linux | 1 Linux Kernel | 2026-07-07 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type. | |||||
| CVE-2026-10536 | 1 Haxx | 1 Curl | 2026-07-07 | N/A | 9.8 CRITICAL |
| A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation. | |||||
| CVE-2025-59615 | 1 Qualcomm | 120 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 117 more | 2026-07-07 | N/A | 6.6 MEDIUM |
| Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization. | |||||
| CVE-2025-59616 | 1 Qualcomm | 96 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 93 more | 2026-07-07 | N/A | 6.6 MEDIUM |
| Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory. | |||||
| CVE-2025-59617 | 1 Qualcomm | 96 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 93 more | 2026-07-07 | N/A | 6.6 MEDIUM |
| Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input. | |||||
| CVE-2026-57984 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 7.5 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2018-10902 | 4 Canonical, Debian, Linux and 1 more | 6 Ubuntu Linux, Debian Linux, Linux Kernel and 3 more | 2026-07-07 | 4.6 MEDIUM | 7.8 HIGH |
| It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation. | |||||
| CVE-2026-57981 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 8.8 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-9080 | 1 Haxx | 1 Curl | 2026-07-07 | N/A | 7.3 HIGH |
| Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. | |||||
| CVE-2026-57986 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 7.5 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-57992 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 7.5 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-58287 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 8.3 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-58294 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 7.5 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-58288 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 8.3 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-58276 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 7.5 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-13368 | 2026-07-07 | N/A | N/A | ||
| WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2. | |||||