Export limit exceeded: 425899 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425899 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,177

Export CSV
CVE-2026-90793

GPAC MP4Box base_scenegraph.c gf_node_get_name use after free

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-88032

Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Java Driver Org.mongodb:mongodb-crypt Maven Package Org.mongodb:mongodb-driver-reactivestreams Maven Package
CVE-2026-61915

cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Cyrus Cyrusimap
Products
Imap Cyrus Imap
CVE-2026-18706

Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-69319

Windows USB Video Driver Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-18700

Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-23789

Double‑Free Vulnerability in Samsung Exynos 850 MFC Encoder Driver

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driver (due to improper cleanup of dma_buf references during error handling) leads to kernel memory corruption and potential arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Samsung
Products
Exynos 850 Firmware
CVE-2026-18692

Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-71332

Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability

Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 18 more
CVE-2026-77894

Windows Installer Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more