| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network. |
| Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0). |
| A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x. |
| A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption. |
| Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network. |
| Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run. |
| No cwe for this issue in Windows Active Directory allows an authorized attacker to deny service over a network. |
| Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows NTFS allows an unauthorized attacker to execute code over a network. |
| Use of out-of-range pointer offset in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows System Events Broker allows an authorized attacker to disclose information locally. |
| Untrusted pointer dereference in Windows Encrypting File System (EFS) allows an authorized attacker to deny service locally. |
