Export limit exceeded: 10438 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10438 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-64016 | 1 Linux | 1 Linux Kernel | 2026-10-13 | 9.8 Critical |
| In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp) and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp). In this case fp and dh_info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table. Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep using the durable-only put path. | ||||
| CVE-2026-64010 | 1 Linux | 1 Linux Kernel | 2026-10-13 | 8.8 High |
| In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet (CC) can be processed concurrently with socket release. This can lead to a use-after-free of the socket object. When nfc_llcp_recv_cc() moves the socket from the connecting_sockets list to the sockets list, it does so without holding the socket lock. If llcp_sock_release() is executing concurrently, it might have already unlinked the socket and dropped its references, which can result in nfc_llcp_recv_cc() linking a freed socket into the live list. Fix this by holding lock_sock() during the state transition and list movement in nfc_llcp_recv_cc(). After acquiring the lock, check if the socket is still hashed to ensure it hasn't already been unlinked and marked for destruction by the release path. This aligns the locking pattern with recv_hdlc() and recv_disc(). | ||||
| CVE-2026-64011 | 1 Linux | 1 Linux Kernel | 2026-10-13 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by checking the socket state and unlinking from the correct list. | ||||
| CVE-2025-7425 | 1 Redhat | 17 Cert Manager, Discovery, Enterprise Linux and 14 more | 2026-10-12 | 7.8 High |
| A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption. | ||||
| CVE-2026-21120 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege. | ||||
| CVE-2025-11234 | 1 Redhat | 7 Enterprise Linux, Openshift, Rhel Aus and 4 more | 2026-10-09 | 7.5 High |
| A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication. | ||||
| CVE-2026-20542 | 1 Mediatek | 39 Mediatek Chipset, Mt2718, Mt2718 Firmware and 36 more | 2026-10-09 | 6.7 Medium |
| In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11076799; Issue ID: MSV-8143. | ||||
| CVE-2026-20537 | 2 Mediatek, Mediatek, Inc. | 23 Mt6878, Mt6878 Firmware, Mt6881 and 20 more | 2026-10-09 | 6.7 Medium |
| In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11185225; Issue ID: MSV-9024. | ||||
| CVE-2026-20531 | 2 Mediatek, Mediatek, Inc. | 13 Mt6899, Mt6899 Firmware, Mt6993 and 10 more | 2026-10-09 | 8.4 High |
| In apu, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249016; Issue ID: MSV-9169. | ||||
| CVE-2026-20536 | 2 Mediatek, Mediatek, Inc. | 27 Mt6878, Mt6878 Firmware, Mt6881 and 24 more | 2026-10-09 | 6.7 Medium |
| In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11242428; Issue ID: MSV-9038. | ||||
| CVE-2022-2946 | 3 Debian, Fedoraproject, Vim | 3 Debian Linux, Fedora, Vim | 2026-10-09 | 7.8 High |
| Use After Free in GitHub repository vim/vim prior to 9.0.0246. | ||||
| CVE-2026-57559 | 1 Qualcomm | 45 Cologne, Cologne Firmware, Fastconnect 6700 and 42 more | 2026-10-09 | 7.8 High |
| Memory corruption while processing service requests. | ||||
| CVE-2026-57555 | 1 Qualcomm | 45 Cologne, Cologne Firmware, Fastconnect 6700 and 42 more | 2026-10-09 | 7.8 High |
| Memory Corruption when executing system service routines due to improper handling of user input buffers. | ||||
| CVE-2026-57554 | 1 Qualcomm | 437 Ar8031, Ar8031 Firmware, Ar8035 and 434 more | 2026-10-09 | 7.8 High |
| Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations. | ||||
| CVE-2026-57537 | 1 Qualcomm | 145 Congo, Congo Firmware, Fastconnect 6200 and 142 more | 2026-10-09 | 7.8 High |
| Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization. | ||||
| CVE-2026-25291 | 1 Qualcomm | 227 Cq8845s, Cq8845s Firmware, Cq8850ns and 224 more | 2026-10-09 | 7.8 High |
| Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms. | ||||
| CVE-2026-25274 | 1 Qualcomm | 91 Aqt1000, Aqt1000 Firmware, Cologne and 88 more | 2026-10-09 | 6.7 Medium |
| Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization. | ||||
| CVE-2018-7162 | 1 Nodejs | 1 Node.js | 2026-10-08 | 7.5 High |
| All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. | ||||
| CVE-2022-2345 | 2 Fedoraproject, Vim | 2 Fedora, Vim | 2026-10-08 | 7.8 High |
| Use After Free in GitHub repository vim/vim prior to 9.0.0046. | ||||
| CVE-2022-27867 | 1 Autodesk | 1 Autocad | 2026-10-08 | 7.8 High |
| A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. | ||||