CVE & Exploit Intelligence Database

CVE-2026-26134 7.8 HIGH EPSS 0.00

Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-26132 7.8 HIGH EPSS 0.00

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-26107 7.8 HIGH EPSS 0.00

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CWE-416 Mar 10, 2026

CVE-2026-25189 7.8 HIGH EPSS 0.00

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-25178 7.0 HIGH EPSS 0.00

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-25171 7.0 HIGH EPSS 0.00

Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-25170 7.0 HIGH EPSS 0.00

Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-25167 7.4 HIGH EPSS 0.00

Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-24295 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-24292 7.8 HIGH EPSS 0.00

Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-24289 7.8 HIGH EPSS 0.00

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-24285 7.0 HIGH EPSS 0.00

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-23671 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to elevate privileges locally.

CWE-362 Mar 10, 2026

CVE-2026-23669 8.8 HIGH EPSS 0.00

Use after free in Windows Print Spooler Components allows an authorized attacker to execute code over a network.

CWE-416 Mar 10, 2026

CVE-2026-23667 7.0 HIGH EPSS 0.00

Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally.

CWE-416 Mar 10, 2026

CVE-2026-28688 4.0 MEDIUM EPSS 0.00

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

CWE-416 Mar 10, 2026

CVE-2026-28687 5.3 MEDIUM EPSS 0.00

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

CWE-416 Mar 10, 2026

CVE-2026-28799 7.5 HIGH 1 Writeup EPSS 0.00

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscription (SUBSCRIBE with Expires=0). This issue has been patched in version 2.17.

CWE-416 Mar 06, 2026

CVE-2025-13350 EPSS 0.00

Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When orphaned MSG_OOB sockets hit unix_gc(), the garbage collector still calls kfree_skb() as if OOB SKBs held two references; on Ubuntu Linux 6.8 (Noble Numbat) kernel tree, they have only the queue reference, so the buffer is freed while still reachable and subsequent queue walks dereference freed memory, yielding a reliable local privilege escalation (LPE) caused by a use-after-free (UAF). Ubuntu builds that have already taken the new GC stack from commit 4090fa373f0e, and mainline Linux kernels shipping that infrastructure are unaffected because they no longer execute the legacy collector path. This issue affects Ubuntu Linux from 6.8.0-56.58 before 6.8.0-84.84.

CWE-416 Mar 05, 2026

CVE-2026-22040 5.3 MEDIUM EPSS 0.00

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter, it is possible to reliably trigger heap memory corruption in the Broker process, causing it to exit immediately with SIGABRT due to free(): invalid pointer. As of time of publication, no known patched versions are available.

CWE-416 Mar 04, 2026