CVE-2026-107167

The m17n-lib library contains a heap use-after-free write vulnerability in the re_init_ic() function. A user providing specially crafted text input can trigger this condition during input-method state transitions , where the library frees an internal input context object but subsequently attempts...

CVE-2026-107167 M17n-lib: heap use-after-free write in re_init_ic()

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. Thi...

CVE-2026-107167

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. Thi...

CVE-2026-107183

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

firefox: Sandbox escape due to use-after-free in the DOM: Navigation component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Navigation component...

firefox: Sandbox escape due to use-after-free in the DOM: Security component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Security component...

firefox: Use-after-free in the Audio/Video component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

firefox: Use-after-free in the Audio/Video component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

CVE-2026-107183 llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

CVE-2026-107183

Versions of llama.cpp prior to b11393 are vulnerable to a use-after-free and double free vulnerability within the common_chat_peg_mapper::map function. An unauthenticated remote attacker can exploit this by submitting a chat_parser in a POST /completion request that emits a tool-id after a tool-c...

CVE-2026-107183 llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

CVE-2026-107183 llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

EUVD-2026-94330

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

CVE-2026-107183

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

SUSE-SU-2026:4561-1 Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes various security issues: The following security issues were fixed: - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd bsc1272391. - CVE-2026-63920: ipv6: validate extension header...

Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes various security issues: The following security issues were fixed: CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd bsc1272391. CVE-2026-63920: ipv6: validate extension header length...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

DEBIAN-CVE-2026-98374

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...