CVE-2026-109748

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

X.Org Server XKB TextDoodad Double Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

X.Org Server Present Extension Use-After-Free Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...

CVE-2026-110172

Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110603

LASzip through 3.5.0 contains an invalid free vulnerability in laszipreadheader that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C...

CVE-2026-110149

Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Redis 8.6.2 Use-After-Free Checker

Redis versions through 8.6.2 contain a use-after-free in the unblock client flow that may lead to remote code execution. This tool queries Redis server version information and identifies versions requiring remediation...

CVE-2026-108442: Use After Free

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

UBUNTU-CVE-2026-97205

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing “include virtual” commands may trigger a Use-After-Free UAF in the NGINX worker process...

CVE-2026-110169

Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-115244

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A use after free issue exists in Microsoft Office Word. This flaw allows an unauthorized attacker to execute arbitrary code over a network. Use after free is a memory corruption...

UBUNTU-CVE-2026-110603

LASzip through 3.5.0 contains an invalid free vulnerability in laszipreadheader that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C...

CVE-2026-108438: Use After Free

Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-110148

Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

kernel security, bug fix, and enhancement update

4.18.0-553.174.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security update

5.14.0-687.58.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

MiracleLinux 9 : firefox-140.17.0-1.el9_8.ML.1 (AXSA:2026-2049:27)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2049:27 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird:...

PT-2026-115322

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description A use after free issue exists in V8, which is the open-source JavaScript and WebAssembly engine used in Google Chrome. A remote attacker can execute arbitrary code within the sandbox by...

CVE-2026-98432

ipv4: free inetopt and ireqopt after an RCU grace period...

Unity Linux 20.1070e Security Update: firefox (UTSA-2026-130347)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130347 advisory. Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15,...