Total
882 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-81950 | 1 Microsoft | 7 365 Apps, Excel, Microsoft 365 and 4 more | 2026-09-09 | N/A | 7.8 HIGH |
| Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-53322 | 1 Linux | 1 Linux Kernel | 2026-09-09 | N/A | 8.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible. This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by a different driver. | |||||
| CVE-2026-53009 | 2 Linux, Redhat | 2 Linux Kernel, Enterprise Linux | 2026-09-09 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel drivers and did not find any. | |||||
| CVE-2026-46189 | 1 Linux | 1 Linux Kernel | 2026-09-09 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free. | |||||
| CVE-2026-80080 | 1 Microsoft | 6 365 Apps, Microsoft 365, Office 2019 and 3 more | 2026-09-09 | N/A | 8.8 HIGH |
| Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-72958 | 2026-09-09 | N/A | 8.2 HIGH | ||
| Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-71353 | 2026-09-09 | N/A | 7.0 HIGH | ||
| Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-71351 | 2026-09-09 | N/A | 7.0 HIGH | ||
| Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-70562 | 2026-09-09 | N/A | 7.0 HIGH | ||
| Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69725 | 2026-09-09 | N/A | 7.8 HIGH | ||
| Double free in Windows Hello allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69398 | 2026-09-09 | N/A | 7.0 HIGH | ||
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69337 | 2026-09-09 | N/A | 7.1 HIGH | ||
| Double free in Windows Registry allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69309 | 2026-09-09 | N/A | 7.0 HIGH | ||
| Double free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-55007 | 2026-09-09 | N/A | 8.1 HIGH | ||
| Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69292 | 2026-09-09 | N/A | 7.0 HIGH | ||
| Double free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-77504 | 2026-09-09 | N/A | 8.8 HIGH | ||
| Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-82325 | 2026-09-08 | N/A | N/A | ||
| A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages | |||||
| CVE-2026-20510 | 2026-09-08 | N/A | 6.7 MEDIUM | ||
| In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11134622; Issue ID: MSV-8894. | |||||
| CVE-2026-64377 | 1 Linux | 1 Linux Kernel | 2026-09-08 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to one element of this array in policy->driver_data. qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base. Remove the kfree(data) call and let devres release qcom_cpufreq.data. This issue was found by a static analysis tool I am developing. | |||||
| CVE-2026-64382 | 1 Linux | 1 Linux Kernel | 2026-09-04 | N/A | 8.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. | |||||