CVE-2026-2441-PoC

CVE-2026-2441 — Chrome CSSFontFeatureValuesMap Use-After-Free CVSS 8.8 High | Actively Exploited in the Wild | Renderer RCE Sandboxed A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted...

CVE-2021-40449-NtGdiResetDC-UAF

CVE-2021-40449-NtGdiResetDC-UAF A POC for CVE-2021-40449. Only tested on 1809, the code is a bit rough, but it's a good experience for me. Instead of using the ThreadName method, user-space memory allocation is used...

CVE-2026-20687-AppleJPEGDriver-UAF

CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF deferred panic CVE-2026-20687 | Author: Johnny Franks @0xjohnny Component: Kernel Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use after free issue was addressed with improved memor...

CVE-2025-49844

CVE-2025-49844 RediShell - Lab Environment A practical lab environment for testing and understanding the critical CVE-2025-49844 RediShell vulnerability in Redis. ⚠️ WARNING This is for educational purposes only! Only use on systems you own or have explicit permission to test Never expose to the...

CVE-2026-5281-Research-Toolkit

CVE-2026-5281 Research Toolkit Chrome WebGPU Use-After-Free CWE-416 This toolkit is for security research and defensive verification around CVE-2026-5281. Patched Chrome version: 146.0.7680.178 Potentially vulnerable versions: anything below 146.0.7680.178 Files cve20265281scanner.py Unified...

CVE-2026-89777

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev-msiperm after freeing it on init failure vfiomsicaplen lazily allocates the per-device MSI permission table: vdev-msiperm = kmallocobjstruct permbits, GFPKERNELACCOUNT; if !vdev-msiperm return -ENOMEM; ret =...

CVE-2026-91721

Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-91749

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

The vulnerability of the net/sctp component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the net/sctp component in the Linux operating system is related to the dereferencing of a pointer with an expired validity period. Exploiting this vulnerability can allow an attacker to trigger a service failure...

EulerOS 2.0 SP15 : expat (EulerOS-SA-2026-3803)

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from...

CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

CVE-2026-89791

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

CVE-2026-91710

Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-90038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops...

UBUNTU-CVE-2026-89782

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16MAX entries During $LogFile replay, logreplay indexes the transaction table by the transactid taken from the log record header. checklogrec only verifies that transactid is non-zero...

MiracleLinux 9 : thunderbird-140.14.0-1.el9_8.ML.1 (AXSA:2026-1858:21)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1858:21 advisory. firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component CVE-2026-74934 firefox: thunderbird: Internally found bugs fixed i...

UBUNTU-CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

UBUNTU-CVE-2026-89788

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

UBUNTU-CVE-2026-78227

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffe...

CVE-2026-91722

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...