CVE-2026-91721

chromium-browser: chromium-browser: Use after free in Internals

Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-7406

BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Autodesk

Products

Advance Steel Autocad Autocad Architecture and 9 more

CVE-2025-31936

kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM

Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation of privilege. SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Xeon Xeon 6315p Xeon 6315p Firmware and 144 more

CVE-2026-91747

chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-91736

chromium-browser: chromium-browser: Use after free in DOM

Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-91745

chromium-browser: chromium-browser: Use after free in V8

Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-91710

chromium-browser: chromium-browser: Use after free in WebAppInstalls

Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-67378

Microsoft SQL Server Remote Code Execution Vulnerability

Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2019 (gdr) Microsoft Sql Server 2022 (gdr) Microsoft Sql Server 2025 For X64-based Systems (gdr) and 3 more

CVE-2026-90890

ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Asrock

Products

Asrock Polychrome Sync/rgb For Mb Asrock Polychrome Sync/rgb For Vga

CVE-2026-19662

qpcache NOQNAME proof use-after-free crashes recursive resolver

An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2026-84639

Uninitialized memory in MIME parsing

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Thunderbird

CVE-2026-76891

Expired Pointer Dereference in Wireshark

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-76890

Expired Pointer Dereference in Wireshark

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-26986

FreeRDP has heap-use-after-free in rail_window_free

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-13117

OpenVPN: OpenVPN: Denial of service or memory leakage via incomplete TLS guard

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Openvpn

Products

Openvpn

CVE-2026-91729

chromium-browser: Chromium: Arbitrary code execution via use-after-free in DigitalCredentials

Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-91724

chromium-browser: Chromium: Arbitrary code execution via use-after-free in Input

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-91722

chromium-browser: Google Chrome: Arbitrary Code Execution via Use-After-Free Vulnerability

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-91720

chromium-browser: chromium-browser: Uninitialized resource in ANGLE

Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-87657

chromium-browser: chromium-browser: Use after free in V8

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome