Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-14508
Critical · 9.1
CWE-416 Oct 8, 2026
IBM DataPower Gateway Use After Free
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.
CVE-2026-107167
Medium · 6.2
CWE-416 Oct 7, 2026
M17n-lib: heap use-after-free write in re_init_ic()
A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This issue can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.
CVE-2026-107183
High · 8.1
CWE-416 Oct 7, 2026
llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.
CVE-2026-55330
Critical · 9.8
CWE-416 Oct 6, 2026
Use After Free in Google Android
In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-106423
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106421
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106419
Critical · 9.6
CWE-416 Oct 6, 2026
Google Chrome on Android: Use After Free in ANGLE Graphics Library (CVE-2026-106419)
Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106411
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106393
High · 8.3
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106383
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106382
Critical · 9.6
CWE-416 Oct 6, 2026
Google Chrome Chromecast Use-After-Free Vulnerability
Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-106373
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106358
Critical · 9.6
CWE-416 Oct 6, 2026
Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-106357
High · 8.8
CWE-416 Oct 6, 2026
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106349
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106347
High · 8.8
CWE-416 Oct 6, 2026
Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-106335
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106318
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106315
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106298
Critical · 9.6
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106291
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106283
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106281
Critical · 9.6
CWE-416 Oct 6, 2026
Google Chrome Use-After-Free in Tint Component (CVE-2026-106281)
Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106278
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106269
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)