PT-2026-96788

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 @novu/js versions prior to 3.18.0 @novu/react Inbox component versions prior to 3.18.0 Description Novu's In-App Inbox and the @novu/react Inbox component fail to validate the URL scheme of notification...

CVE-2026-21219

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2026-21219 Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

...

PT-2026-2762

Name of the Vulnerable Software and Affected Versions versions prior to 2026-21219 Description A use after free issue exists in Inbox COM Objects. This allows an unauthorized attacker to execute code locally. Recommendations At the moment, there is no information about a newer version that contai...

CVE-2025-58736

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2025-58730

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2025-58731

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

EUVD-2025-34365

Concurrent execution using shared resource with improper synchronization 'race condition' in Inbox COM Objects allows an unauthorized attacker to execute code locally...

EUVD-2025-34307

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

EUVD-2025-34310

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

EUVD-2025-34311

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

EUVD-2025-34309

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

EUVD-2025-34313

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2025-59282

Concurrent execution using shared resource with improper synchronization 'race condition' in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2025-58732

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2025-58738 Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

...

CVE-2025-58736 Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

...

CVE-2025-58735 Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

...

CVE-2025-58732

CVE-2025-58732 is described as a use-after-free in Inbox COM Objects that enables local code execution. The Connected Documents provide broader Windows security updates (KBs and advisories) but do not specify a vendor/product remediation or a patch explicit to this CVE in the provided materials. ...

CVE-2025-58735

CVE-2025-58735 is a Use-after-free vulnerability in Inbox COM Objects leading to local code execution. The base CVSS v3.1 score is 7.0 (HIGH) with LOCAL attackVector, HIGH impact on confidentiality/integrity/availability, and user interaction required. Connected MSKB/NCSC entries confirm a Window...