Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.EPSS 0.3%Jul 14, 2026
- High7.0Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.EPSS 0.3%Jul 14, 2026
- High7.8Use after free in Windows Application Model allows an authorized attacker to elevate privileges locally.EPSS 0.3%Jul 14, 2026
- High7.0Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.EPSS 0.3%Jul 14, 2026
- High7.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.EPSS 0.2%Jul 14, 2026
- High7.8Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated…Jul 12, 2026
- Medium6.1In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without…Jul 12, 2026
- Medium5.9The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP socket file descriptor directly from the calling thread immediatel…Jun 30, 2026
- High7.4Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo_state a…Jun 28, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTE…EPSS 0.2%Jun 25, 2026
- High8.0In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channel() scans…EPSS 0.3%Jun 25, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning…EPSS 0.1%Jun 25, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata…EPSS 0.2%Jun 25, 2026
- High8.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock…EPSS 0.4%Jun 25, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g.EPSS 0.1%Jun 25, 2026
- High8.8ipv6: mcast: Fix use-after-free when processing MLD queriesEPSS 0.3%Jun 25, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundl…EPSS 0.2%Jun 24, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_f…EPSS 0.1%Jun 24, 2026
- Critical9.8In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic si…EPSS 0.4%Jun 24, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the…EPSS 0.1%Jun 24, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and ps…EPSS 0.2%Jun 24, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from th…EPSS 0.2%Jun 24, 2026
- High7.1Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent stat…Jun 16, 2026
- Medium4.8In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and then, o…Jun 16, 2026
- High7.5subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data().Jun 16, 2026