CWE-672: Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
A kind of CWE-666 Operation on Resource in Wrong Phase of Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching 8.2 High
- jetbrains datalore In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new... 7.4 High
- google chrome Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker... 8.3 High
-
github.com/tinfoil-factory/netfoilGo Netfoil doesn't decrement TTL No score - outline Outline before 1.12.0 Improper Access Control via Public Document Shares 6.9 Medium
- esp32async espasyncwebserver ESPAsyncWebServer multipart parser has null-pointer write 7.5 High
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 more Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content 6.8 Medium
- openvpn ovpn-dco-win OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of... 5.7 Medium
- openwrt odhcpd odhcpd DHCPv6 IA dangling first pointer use-after-free 8.8 High
- google chrome Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a... 8.8 High
- google chrome Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- mz automation libiec61850 libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle 5.3 Medium
- gitea Gitea private repository access retained after rejected transfer 4.3 Medium
- google chrome Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote... 4.2 Medium
- google chrome Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote... 6.5 Medium
- google chrome Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote... 3.1 Low
- google chrome Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker... 4.2 Medium
- google chrome Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote... 6.5 Medium
- linux, linux kernel +1 more smb/client: invalidate fscache for fallocate range operations 5.5 Medium
- linux, linux kernel +1 more btrfs: do not force reloc root creation during qgroup_account_snapshot() 5.5 Medium
- macropay-solutions maravel-framework Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches 8.7 High
- google chrome Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed... 6.5 Medium
- nlnet labs nsd Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS 8.2 High
- google chrome Operation on a resource after expiration or release in Network in Google Chrome prior to 152.0... 4.3 Medium
- emqx EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution 6.6 Medium
- unitronix betterdesk BetterDesk has a replay behavior vulnerability when devices are deleted 7.7 High
- linux dm thin metadata: fix metadata snapshot consistency on commit failure 7.8 High
- apache cxf Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider 7.5 High
- nlnet labs unbound Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records 3.7 Low
- cyrusimap cyrus imap An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor... 3.5 Low
- forgekeep nebula-mesh nebula-mesh: Certificate revocation is never enforced at the mesh 8.1 High
- sylius Sylius: Cart FormComponent allows modification or deletion of an already-completed order 6.5 Medium
- better-auth better-auth Stale Sessions Persist After User Deletion 5.1 Medium
- microsoft edge (chromium-based), edge chromium +1 more Microsoft Edge (Chromium-based) Information Disclosure Vulnerability 6.1 Medium
- zcashfoundation zebra, zebra-state +1 more ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip 6.5 Medium
- cap-go capgo Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint 7.1 High
- tornadoweb tornado Tornado before 6.5.7 Credential Leak via Handle Reuse 8.2 High
- arista networks eos Arista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is Disabled 8.2 High
- elastic kibana Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access 5.3 Medium
- erlang otp, erlang\/otp +1 more OCSP responder certificate validity period not checked in public_key 6.3 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 more Possible arbitrary code execution during DNSSEC validation 9.1 Critical
- discourse Discourse: Cached outdated summaries can leak removed content 5.3 Medium
- mattermost, mattermost server +1 more post edit time limit is not enforced on some post update operations 3.1 Low
- chorny apache::session, apache\ +1 more Apache::Session versions through 1.94 for Perl re-creates deleted sessions 9.1 Critical
- openclaw OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation 5.9 Medium
- openclaw OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution 9.2 Critical
- mattermost, mattermost server +1 more Permalink Preview Information Disclosure After Permission Revocation 4.3 Medium
- parse-community parse-server Parse Server MFA recovery codes not consumed after use 8.2 High
- color iccdev Heap-use-after-free in CIccCmm::AddXform() 7.8 High
- linux, linux kernel, red hat enterprise linux 10 +11 more +13 more netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() 7.8 High
- Show olderLoading…