VulnSea

CWE-416

CVEs classified under CWE-416, newest first.

1092 CVEsRSS

CVE-2026-85197High· 7.6PoC
3w ago

A flaw was found in libsoup

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using …

▾ MidnightRed Hat · libsoup3EPSS 0.27%via NVD
CVE-2026-45200High· 7.8
3w ago

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a spec…

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a spec…

▾ TwilightImagination Technologies · Graphics DDKEPSS 0.16%via NVD
CVE-2026-85042Critical· 9.6
3w ago

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

▾ Midnightgoogle · chromeEPSS 0.46%via NVD
CVE-2026-85049High· 8.8
3w ago

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

▾ Twilightgoogle · chromeEPSS 0.41%via NVD
CVE-2026-85048High· 8.3PoC
3w ago

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: …

▾ Midnightgoogle · chromeEPSS 0.40%via NVD
CVE-2026-33630High· 7.5
3w ago

c-ares is an asynchronous resolver library

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channe…

▾ TwilightEPSS 0.84%via NVD
CVE-2026-84353Critical· 9.6
3w ago

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security s…

▾ Midnightgoogle · chromeEPSS 0.46%via NVD
CVE-2026-84352Critical· 9.6
3w ago

Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page

Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

▾ Midnightgoogle · chromeEPSS 0.46%via NVD
CVE-2026-84333Critical· 9.6
3w ago

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

▾ Midnightgoogle · chromeEPSS 0.46%via NVD
CVE-2026-66798Medium· 4.3
1mo ago

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

▾ SunlitMicrosoft · Microsoft Edge (Chromium-based)EPSS 0.79%via CVEORG
CVE-2026-77358None
1mo ago

cpp-httplib is a C++ header-only HTTP/HTTPS library

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClien…

▾ SunlitEPSS 0.45%via NVD
CVE-2026-55406Medium
1mo ago

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

▾ Sunlitbuffa · buffaEPSS 0.19%via GHSA
CVE-2026-58091High· 7.8
1mo ago

The implementation of this ioctl attempts to acquire locks on all channels in a sync group

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structu…

▾ Twilightfreebsd · freebsdEPSS 0.15%via NVD
CVE-2026-58090High· 7.8
1mo ago

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive so…

▾ Twilightfreebsd · freebsdEPSS 0.15%via NVD
CVE-2026-58093High· 7.0
1mo ago

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrent…

▾ Twilightfreebsd · freebsdEPSS 0.10%via NVD
CVE-2026-59184High· 7.1
1mo ago

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dat…

▾ TwilightRed Hat · Red Hat Enterprise Linux 10EPSS 0.40%via NVD
CVE-2024-58378Critical· 9.8
1mo ago

Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader module, which underlies Nokogiri::XML::Reader

Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When u…

▾ MidnightEPSS 0.34%via NVD
CVE-2026-78376High· 8.8
1mo ago

A flaw was found in WebKitGTK

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

▾ TwilightWebKit · webkitEPSS 0.29%via NVD
CVE-2026-77587Medium· 5.9
1mo ago

Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed

Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a cli…

▾ Sunlittorproject · torEPSS 0.40%via NVD
CVE-2026-63380Medium· 4.7
1mo ago

Libevent is an event notification library

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. ev…

▾ SunlitRed Hat · Red Hat Enterprise Linux 6EPSS 0.14%via NVD
CVE-2026-76957Medium· 4.9
1mo ago

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

▾ Sunlitlibexpat_project · libexpatEPSS 0.15%via NVD
CVE-2026-76021High· 8.8
1mo ago

Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page

Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

▾ TwilightEPSS 0.41%via NVD
GHSA-mc9m-6fm9-pghcMedium
1mo ago

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

▾ Sunlitzoo-kcl · zoo-kclvia GHSA
CVE-2026-63639High· 8.8
1mo ago

Valkey is a distributed key-value database

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream co…

▾ TwilightEPSS 1.2%via NVD
CVE-2026-56684High· 7.5
1mo ago

Valkey is a distributed key-value database

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to de…

▾ TwilightEPSS 0.89%via NVD
CVE-2026-74944Critical· 9.8⚖ disputed
1mo ago

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

▾ Midnightmozilla · firefoxEPSS 0.59%via NVD
CVE-2026-74943Critical· 9.8PoC⚖ disputed
1mo ago

Use-after-free in the Graphics: ImageLib component

Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

▾ Abyssalmozilla · firefoxEPSS 0.61%via NVD
CVE-2026-74940Critical· 9.8⚖ disputed
1mo ago

Use-after-free in the Graphics: Text component

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

▾ Midnightmozilla · firefoxEPSS 0.61%via NVD
CVE-2026-74936Critical· 9.8PoC⚖ disputed
1mo ago

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

▾ Abyssalmozilla · firefoxEPSS 0.59%via NVD
CVE-2026-64715Medium· 6.5⚖ disputed
1mo ago

A use-after-free issue was addressed with improved memory management

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing ma…

▾ Sunlitapple · safariEPSS 0.39%via NVD
CWE-416 vulnerabilities (CVEs) — page 13 · VulnSea