Filtered by CWE-416
Total 6789 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-22893 1 Ivanti 1 Connect Secure 2025-10-30 10 Critical
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CVE-2020-3992 1 Vmware 2 Cloud Foundation, Esxi 2025-10-30 9.8 Critical
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
CVE-2021-26411 1 Microsoft 16 Edge, Internet Explorer, Windows 10 1507 and 13 more 2025-10-30 8.8 High
Internet Explorer Memory Corruption Vulnerability
CVE-2021-31166 1 Microsoft 7 Windows 10 1809, Windows 10 2004, Windows 10 20h2 and 4 more 2025-10-30 9.8 Critical
HTTP Protocol Stack Remote Code Execution Vulnerability
CVE-2023-21674 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-10-30 8.8 High
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
CVE-2021-40449 1 Microsoft 26 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 23 more 2025-10-30 7.8 High
Win32k Elevation of Privilege Vulnerability
CVE-2021-34486 1 Microsoft 11 Windows 10 1809, Windows 10 1909, Windows 10 2004 and 8 more 2025-10-30 7.8 High
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2023-36760 1 Microsoft 1 3d Viewer 2025-10-30 7.8 High
3D Viewer Remote Code Execution Vulnerability
CVE-2023-38160 1 Microsoft 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more 2025-10-30 5.5 Medium
Windows TCP/IP Information Disclosure Vulnerability
CVE-2023-36735 1 Microsoft 1 Edge Chromium 2025-10-30 9.6 Critical
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-36562 1 Microsoft 1 Edge Chromium 2025-10-30 7.1 High
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-36802 1 Microsoft 7 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 4 more 2025-10-30 7.8 High
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
CVE-2023-36804 1 Microsoft 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more 2025-10-30 7.8 High
Windows GDI Elevation of Privilege Vulnerability
CVE-2023-38139 1 Microsoft 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more 2025-10-30 7.8 High
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-38161 1 Microsoft 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more 2025-10-30 7.8 High
Windows GDI Elevation of Privilege Vulnerability
CVE-2020-35906 1 Rust-lang 1 Futures-task 2025-10-30 7.8 High
An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation.
CVE-2025-62490 2 Quickjs-ng, Quickjs Project 2 Quickjs, Quickjs 2025-10-30 8.8 High
In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the array could get resized and len1 become out of bounds. This results in a use-after-free.A second instance occurs in the same function during printing of a map or set objects. The code iterates over ms->records list, but once again, elements could be removed from the list during js_print_value call.
CVE-2025-62491 2 Quickjs-ng, Quickjs Project 2 Quickjs, Quickjs 2025-10-30 8.8 High
A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list). * The function js_std_promise_rejection_check attempts to iterate over the rejected_promise_list to report unhandled rejections using a standard list loop. * The reason for a promise rejection is processed inside the loop, including calling js_std_dump_error1(ctx, rp->reason). * If the promise rejection reason is an Error object that defines a custom property getter (e.g., via Object.defineProperty), this getter is executed during the error dumping process. * The malicious custom getter can execute JavaScript code that calls catch() on the same rejected promise being processed. * Calling catch() internally triggers js_std_promise_rejection_tracker, which then removes and frees the current promise entry (JSRejectedPromiseEntry) from the rejected_promise_list. * Since the list iteration continues using the now-freed memory pointer (el), the subsequent loop access results in a Use-After-Free condition.
CVE-2024-43556 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-10-30 7.8 High
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2021-25370 1 Samsung 1 Android 2025-10-30 6.1 Medium
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.