169796 matches found
CVE-2026-109254
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining playthread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to...
kernel: udp: fix potential use-after-free in tunnel segmentation
A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...
CVE-2026-52943
How to use this repo This is a Linux Kernel Local Privilege Escalation PoC code for a use-after-free in skbuff.c : https://github.com/torvalds/linux/commit/98d0912e9f841e5529a5b89a972805f34cb1c69d vidieo1.webm here is the writeup link: https://hackmd.io/@mlc0cVjxSwqv0OoxsUYccw/Bk99YYTyzx you need...
CVE-2026-23111
🐧 CVE-2026-23111 - Linux Kernel nftables Use-After-Free Vulnerability ⚠️ Use-After-Free in Linux Kernel nftables 📖 Overview CVE-2026-23111 is a high-severity Use-After-Free UAF vulnerability affecting the Linux kernel's netfilter/nftables subsystem. The flaw originates from incorrect handling of...
CVE-2026-85965
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are affected by a Use-after-free memory-safety defect within the JavaScript engine integration . This vulnerability could lead to memory corruption , controlled process failure , or server instability . No specific explo...
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
A flaw was found in the Linux kernel. A race condition exists in the xfrm policy handling, specifically within the xfrmpolicybyselctx function. This flaw allows for a use-after-free vulnerability, where memory is accessed after it has been released. This can lead to system instability or a denial...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
kernel: xfrm: input: hold netns during deferred transport reinjection
A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment
A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition t...
kernel: udp: fix potential use-after-free in tunnel segmentation
A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...
dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free
A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...
flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...
Important: Red Hat Security Advisory: flatpak-builder security update
An update for flatpak-builder is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
CVE-2026-53359
🚨 CVE-2026-53359 — Januscape Linux KVM Shadow Paging Use-After-Free Guest-to-Host Escape Januscape is a Linux Kernel KVM vulnerability caused by a Use-After-Free UAF condition in the x86 Shadow MMU. Under vulnerable configurations, a malicious guest can corrupt host memory, leading to host crashe...
Android-CVE-2026-43499
CVE-2026-43499 Detector Android app that detects the kernel vulnerability CVE-2026-43499 — a use-after-free in rtmutex triggered via futexrequeue. Vulnerability | ---|--- CVE| CVE-2026-43499 Type| Use-after-free Component| kernel/locking/rtmutex.c Trigger| futexrequeue → proxy-lock rollback in...
EUVD-2026-97645
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create,...
CVE-2026-109343 SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create,...
CVE-2026-109343
SurrealDB versions prior to 3.3.0 are vulnerable to a cross-tenant access flaw. The issue stems from the SurrealQL USE statement , which allows a session to switch to any namespace or database without verifying if the caller's authenticated level covers that specific scope. Consequently, authenti...
EUVD-2026-97636
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...
CVE-2026-109334 SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...