CVE-2026-74359

A flaw was found in the Linux kernel's configfs component. This vulnerability occurs because a memory pointer is not properly cleared after a failure, leading to a 'use-after-free' condition. A local attacker could exploit this by interacting with the affected directory, which could cause memory...

CVE-2026-74345

A flaw was found in the Linux kernel's Soft iWARP siw component, which handles high-performance data transfer. This vulnerability occurs when the system processes a specially crafted connection request, leading to a 'use-after-free' error. An attacker could exploit this to cause a denial of servi...

CVE-2026-64787

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process termination. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following...

CVE-2026-64783

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packag...

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent getenv operation that has already loaded a pointer to the old buffer may subsequently index...

CVE-2026-63381

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf-first,...

CVE-2026-63380

Libevent (event notification library) is vulnerable to a null pointer dereference in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. The function evws_connection_free unconditionally calls TAILQ_REMOVE on http_server->ws_s...

CVE-2026-63381

Libevent (event notification library) contains a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. The function evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf...

CVE-2026-63381 Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf-first,...

CVE-2026-63381 Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf-first,...

EUVD-2026-63504

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf-first,...

CVE-2026-74329

A flaw was found in the Linux kernel's watchdog subsystem. When a watchdog device is unregistered, its Power Management PM notifier may not be properly removed. This can lead to a stale pointer being used during a subsequent suspend/resume operation, potentially causing system instability or a...

CVE-2026-74325

A flaw was found in the wifi: mt76 driver within the Linux kernel. This vulnerability occurs because the mt76putvifphylink function improperly deallocates memory for offchannel links. An attacker could exploit this by causing the system to access memory after it has been freed, leading to a...

CVE-2026-18299

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

DEBIAN-CVE-2026-18299

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 140.14.0 ESR. MFSA 2026-74 bsc1274867 CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component. CVE-2026-74935: Privilege escalation in the DOM: Networking component...

SUSE-SU-2026:3658-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 140.14.0 ESR. - MFSA 2026-74 bsc1274867 - CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component. - CVE-2026-74935: Privilege escalation in the DOM: Networking component. -...

CVE-2026-74313

A flaw was found in the Linux kernel's vduse component. A race condition in the vdusedevopen function allows a memory object to be freed while still in use. This use-after-free vulnerability could enable a local attacker to cause a system crash denial of service or potentially execute arbitrary...

CVE-2026-74310

A flaw was found in the Linux kernel's vhost/net component. This use-after-free vulnerability occurs due to incorrect handling of zerocopy user buffers, where the system may prematurely complete buffer operations while other parts of the system still hold references to the same memory. This can...

CVE-2026-74302

A flaw was found in the Bluetooth subsystem of the Linux kernel. During the unregistration of a Bluetooth device, the system fails to properly disable timers before freeing the associated memory. This can lead to a use-after-free vulnerability, where the system attempts to access memory that has...