Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-40415
High · 8.1
CWE-416 May 12, 2026
Windows TCP/IP Remote Code Execution Vulnerability
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
CVE-2026-40410
High · 7.0
CWE-416 May 12, 2026
Windows SMB Client Elevation of Privilege Vulnerability
Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.
CVE-2026-40408
High · 7.8
CWE-416 May 12, 2026
Windows WAN ARP Driver Elevation of Privilege Vulnerability
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-40406
High · 7.5
CWE-416 May 12, 2026
Windows TCP/IP Information Disclosure Vulnerability
Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.
CVE-2026-40402
Critical · 9.3
CWE-416 May 12, 2026
Windows Hyper-V Elevation of Privilege Vulnerability
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
CVE-2026-40382
High · 7.8
CWE-416 May 12, 2026
Windows Telephony Service Elevation of Privilege Vulnerability
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVE-2026-40366
High · 8.4
CWE-416 May 12, 2026
Microsoft Word Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2026-40361
High · 8.4
CWE-416 May 12, 2026
Microsoft Outlook and Word Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-40359
High · 7.8
CWE-416 May 12, 2026
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-40358
High · 8.4
CWE-416 May 12, 2026
Microsoft Office Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-35416
High · 7.0
CWE-416 May 12, 2026
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-34638
High · 7.8
CWE-416 May 12, 2026
Premiere Pro | Use After Free (CWE-416)
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-34347
High · 7.0
CWE-416 May 12, 2026
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVE-2026-34340
High · 7.0
CWE-416 May 12, 2026
Windows Projected File System Elevation of Privilege Vulnerability
Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2026-34338
High · 7.8
CWE-416 May 12, 2026
Windows Telephony Service Elevation of Privilege Vulnerability
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVE-2026-34332
High · 8.0
CWE-416 May 12, 2026
Windows Kernel-Mode Driver Remote Code Execution Vulnerability
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.
CVE-2026-33840
High · 7.8
CWE-416 May 12, 2026
Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
CVE-2026-33835
High · 7.8
CWE-416 May 12, 2026
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2025-27723
Medium · 6.8
CWE-416 May 12, 2026
Use after free for some Linux kernel driver for the Intel(R) Ethernet 800 series before version 2...
Use after free for some Linux kernel driver for the Intel(R) Ethernet 800 series before version 2.3.14 within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.
CVE-2026-8390
High · 7.3
CWE-416 May 12, 2026
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.
CVE-2026-43668
High · 7.5
CWE-416 May 11, 2026
A use after free issue was addressed with improved memory management. This issue is fixed in iOS...
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-28994
Medium · 5.3
CWE-416 May 11, 2026
A use after free issue was addressed with improved memory management. This issue is fixed in iOS...
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets.
CVE-2026-28969
High · 7.5
CWE-416 May 11, 2026
A use after free issue was addressed with improved memory management. This issue is fixed in iOS...
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination.
CVE-2026-28947
High · 8.8
CWE-416 May 11, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS...
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-28946
Medium · 6.5
CWE-416 May 11, 2026
A use-after-free issue was addressed with improved memory management. This issue is fixed in...
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.