CVE-2026-101100 | Medium | 5.4 | 2026-09-28 | A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/p… |
CVE-2026-78437 | High | 7.3 | 2026-09-23 | Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.
… |
CVE-2026-91730 | Low | 3.1 | 2026-09-15 | Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
CVE-2026-75945 | Low | 2.6 | 2026-09-14 | A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. |
CVE-2026-75944 | Low | 2.6 | 2026-09-14 | A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale… |
CVE-2026-75943 | Low | 2.6 | 2026-09-14 | A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to… |
CVE-2026-88932 | Medium | 5.3 | 2026-09-14 | multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-uplo… |
CVE-2026-87776 | High | 7.5 | 2026-09-11 | compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still… |
CVE-2026-87549 | Medium | 6.5 | 2026-09-09 | Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restric… |
CVE-2026-87446 | Medium | 6.5 | 2026-09-09 | Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restri… |
CVE-2026-87436 | Medium | 6.5 | 2026-09-09 | Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a… |
CVE-2026-85043 | Critical | 9.1 | 2026-09-03 | Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffi… |
CVE-2026-78600 | Low | 3.5 | 2026-09-02 | Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials p… |
CVE-2026-77037 | High | 7.5 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream… |
CVE-2026-82237 | Low | 3.1 | 2026-08-28 | filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by pa… |
CVE-2026-82236 | Low | 3.1 | 2026-08-28 | File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can… |
CVE-2026-79265 | Medium | 5.3 | 2026-08-25 | Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
CVE-2026-78947 | Medium | 6.5 | 2026-08-25 | Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via… |
CVE-2026-78903 | Low | 3.1 | 2026-08-25 | Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site i… |
CVE-2026-72714 | Medium | 6.3 | 2026-08-24 | Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Unive… |
CVE-2026-77761 | | | 2026-08-21 | A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP ev… |
CVE-2026-67442 | Low | 2.0 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/use… |
CVE-2026-52736 | | | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body agains… |
CVE-2026-52733 | Medium | 6.5 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment… |
CVE-2026-9693 | Low | 3.5 | 2026-08-17 | Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, wh… |
CVE-2026-19474 | High | 7.5 | 2026-08-15 | @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave com… |
CVE-2026-19730 | Medium | 4.2 | 2026-08-13 | The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy atte… |
CVE-2026-20712 | | | 2026-08-11 | Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System software adversary with… |
CVE-2026-68809 | Medium | 5.5 | 2026-08-11 | Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-19019 | Medium | 4.8 | 2026-08-06 | A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_session_persistence of the file executo… |
CVE-2026-63545 | Low | 2.4 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users. |
CVE-2026-67334 | Low | 3.8 | 2026-08-01 | better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configur… |
CVE-2026-42492 | High | 7.5 | 2026-07-28 | Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing. To make this more robust, a
new XEN_DOMCTL_… |
CVE-2026-7639 | High | 7.8 | 2026-07-10 | Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unp… |
CVE-2026-11576 | High | 7.5 | 2026-06-19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this… |
CVE-2026-5038 | Medium | 5.3 | 2026-06-15 | Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multip… |
CVE-2026-53867 | Medium | 4.3 | 2026-06-12 | Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned… |
CVE-2026-33232 | High | 7.5 | 2026-05-19 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vu… |
CVE-2026-0427 | | | 2026-05-15 | Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared… |
CVE-2026-34263 | Critical | 9.6 | 2026-05-12 | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary s… |
CVE-2026-43395 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
drm/xe/sync: Cleanup partially initialized sync on parse failure
xe_sync_entry_parse() ca… |
CVE-2025-66467 | High | 8.0 | 2026-05-08 | Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user cre… |
CVE-2026-35361 | Low | 3.4 | 2026-04-22 | The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails… |
CVE-2026-6830 | Low | 3.3 | 2026-04-21 | nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously a… |
CVE-2026-28268 | Critical | 9.8 | 2026-02-27 | Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechan… |
CVE-2026-3304 | High | 7.5 | 2026-02-27 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of S… |
CVE-2026-28196 | Low | 2.3 | 2026-02-25 | In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk |
CVE-2026-21438 | Medium | 5.3 | 2026-02-12 | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and… |
CVE-2025-15331 | Medium | 4.3 | 2026-02-05 | Tanium addressed an uncontrolled resource consumption vulnerability in Connect. |
CVE-2025-66675 | High | 8.2 | 2025-12-10 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0… |
CVE-2025-64775 | High | 7.5 | 2025-12-01 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0… |
CVE-2025-29934 | Medium | 5.3 | 2025-11-21 | A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data… |
CVE-2025-60730 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function |
CVE-2025-6338 | | | 2025-10-16 | There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period.
This issue… |
CVE-2025-59781 | High | 7.5 | 2025-10-15 | When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization. Not… |
CVE-2025-20293 | Medium | 5.3 | 2025-09-24 | A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthen… |
CVE-2025-55910 | Medium | 6.3 | 2025-09-19 | CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php. |
CVE-2025-0032 | High | 7.2 | 2025-09-06 | Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially res… |
CVE-2024-21977 | Low | 3.2 | 2025-09-05 | Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potentially resulting… |
CVE-2025-43711 | High | 8.1 | 2025-07-05 | Tunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by dragging a crafted… |
CVE-2025-38177 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved:
sch_hfsc: make hfsc_qlen_notify() idempotent
hfsc_qlen_notify() is not idempotent either… |
CVE-2023-29184 | Low | 3.2 | 2025-06-10 | An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM p… |
CVE-2025-37908 | High | 7.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved:
mm, slab: clean up slab->obj_exts always
When memory allocation profiling is disabled at… |
CVE-2025-31650 | High | 7.5 | 2025-04-28 | Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of th… |
CVE-2025-2260 | High | 7.5 | 2025-04-06 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before
version 6.4.3, an attacker can cause a denial of service by specially
crafted packets. T… |
CVE-2024-50385 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2024-50384 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2025-21924 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved:
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an e… |
CVE-2023-52929 | Medium | 5.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved:
nvmem: core: fix cleanup after dev_set_name()
If dev_set_name() fails, we leak nvmem->wp_… |
CVE-2024-36353 | Medium | 6.5 | 2025-03-02 | Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentially leading to loss… |
CVE-2024-57976 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved:
btrfs: do proper folio cleanup when cow_file_range() failed
[BUG]
When testing with COW f… |
CVE-2024-57975 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved:
btrfs: do proper folio cleanup when run_delalloc_nocow() failed
[BUG]
With CONFIG_DEBUG_V… |
CVE-2025-0726 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before
version 6.4.2, an attacker can cause a denial of service by specially
crafted packets. T… |
CVE-2024-53881 | Medium | 5.5 | 2025-01-28 | NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which may lead to denial… |
CVE-2024-53869 | Medium | 5.5 | 2025-01-28 | NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability m… |
CVE-2025-0473 | Medium | 6.5 | 2025-01-16 | Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exi… |
CVE-2025-21609 | Critical | 9.1 | 2025-01-03 | SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnera… |
CVE-2024-28265 | Critical | 9.1 | 2024-11-01 | IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php. |
CVE-2022-49028 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
ixgbevf: Fix resource leak in ixgbevf_init_module()
ixgbevf_init_module() won't destroy t… |
CVE-2022-49012 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
afs: Fix server->active leak in afs_put_server
The atomic_read was accidentally replaced… |
CVE-2024-49851 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
tpm: Clean up TPM space after command failure
tpm_dev_transmit prepares the TPM space bef… |
CVE-2024-47731 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
The alibaba_uncore_pmu dri… |
CVE-2024-47728 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
For all non-tracing helpers… |
CVE-2024-47693 | Medium | 6.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
IB/core: Fix ib_cache_setup_one error flow cleanup
When ib_cache_update return an error… |
CVE-2024-47674 | High | 7.8 | 2024-10-15 | In the Linux kernel, the following vulnerability has been resolved:
mm: avoid leaving partial pfn mappings around in error case
As Jann points out, PFN mappi… |
CVE-2024-45027 | Medium | 5.5 | 2024-09-11 | In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup()
If xhci_mem… |
CVE-2024-44982 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
If the dpu_format_populate_la… |
CVE-2024-45445 | Medium | 4.0 | 2024-09-04 | Vulnerability of resources not being closed or released in the keystore module
Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2022-48893 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gt: Cleanup partial engine discovery failures
If we abort driver initialisation… |
CVE-2023-31356 | Medium | 4.4 | 2024-08-13 | Incomplete system memory cleanup in SEV firmware could
allow a privileged attacker to corrupt guest private memory, potentially
resulting in a loss of data int… |
CVE-2023-20518 | Low | 1.9 | 2024-08-13 | Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfil… |
CVE-2024-6300 | Low | 3.7 | 2024-06-25 | Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction |
CVE-2024-38275 | High | 7.5 | 2024-06-18 | The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally se… |
CVE-2024-36952 | Medium | 4.7 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
There are cas… |
CVE-2021-47365 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved:
afs: Fix page leak
There's a loop in afs_extend_writeback() that adds extra pages to a wr… |
CVE-2024-35959 | Medium | 5.5 | 2024-05-20 | In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix mlx5e_priv_init() cleanup flow
When mlx5e_priv_init() fails, the cleanup f… |
CVE-2023-45846 | Medium | 5.5 | 2024-05-16 | Incomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of service via local a… |
CVE-2024-4767 | Medium | 4.3 | 2024-05-14 | If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disa… |
CVE-2024-26841 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Update cpu_sibling_map when disabling nonboot CPUs
Update cpu_sibling_map when… |
CVE-2024-26832 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved:
mm: zswap: fix missing folio cleanup in writeback race path
In zswap_writeback_entry(), a… |