The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-0163

In multiple functions of vpuioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-52864

In multiple functions of vpuioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0163

In multiple functions of vpuioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0163

CVE-2026-0163 concerns the Android Video Processing Unit (VPU) driver, where multiple functions in vpu_ioctl.c have a use-after-free defect. This leads to remote elevation of privilege with no additional execution privileges required and no user interaction needed. The issue is categorized in the...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-18785 o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free

A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UAClientgetRemoteDataTypes of the file examples/customdatatype/clienttypescustom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the loc...

EUVD-2026-52792

A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UAClientgetRemoteDataTypes of the file examples/customdatatype/clienttypescustom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the loc...

CVE-2026-18785

A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UAClientgetRemoteDataTypes of the file examples/customdatatype/clienttypescustom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the loc...

CVE-2026-18785

The CVE-2026-18785 issue affects the open62541 project, specifically the UA_Client_getRemoteDataTypes function in examples/custom_datatype/client_types_custom.c. A manipulation can lead to a use-after-free condition, with exploitation possible on the local host. Public disclosure of the exploit i...

EUVD-2026-52763

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

CVE-2026-56848 affects Node.js 22.x/24.x/26.x. The vulnerability arises from a heap-use-after-free caused by re-entrant nghttp2_session_mem_send() during nghttp2_session_mem_recv(). OSV/OpenSUSE entries show fixes: nodejs26-26.5.1-1.1 and corepack24-24.18.1-1.1 in GA media, with additional OSV De...

CVE-2026-11368

The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

Web Directory Free < 1.7.3 - Local File Inclusion

The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include, which could lead to Local File Inclusion issues. id: CVE-2024-3673 info: name: Web Directory Free 1.7.3 - Local File Inclusion author: s4e-io severity: critical description: | The Web...

WordPress Title Experiments Free <9.0.1 - SQL Injection

WordPress Title Experiments Free plugin before 9.0.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via the wpextitles AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive...

JustRows WordPress - Cross-Site Scripting

JustRows free WordPress plugin v0.2 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

Guten Free Options - Cross Site Scripting

Guten Free Options WordPress plugin = 0.9.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click malicious link. id: CVE-2024-13492 info: name: Guten Free...

WordPress WP Video Gallery <=1.7.1 - SQL Injection

WordPress WP Video Gallery plugin through 1.7.1 contains a SQL injection vulnerability. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

CVE-2026-11368 Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer

The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...