CVE-2026-19730 | Medium | 4.2 | 2026-08-13 | The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy atte… |
CVE-2026-20712 | | | 2026-08-11 | Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System software adversary with… |
CVE-2026-68809 | Medium | 5.5 | 2026-08-11 | Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-19019 | Medium | 4.8 | 2026-08-06 | A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_session_persistence of the file executo… |
CVE-2026-63545 | Low | 2.4 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users. |
CVE-2026-67334 | Low | 3.8 | 2026-08-01 | better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configur… |
CVE-2026-42492 | High | 7.5 | 2026-07-28 | Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing. To make this more robust, a
new XEN_DOMCTL_… |
CVE-2026-7639 | High | 7.8 | 2026-07-10 | Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unp… |
CVE-2026-11576 | High | 7.5 | 2026-06-19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this… |
CVE-2026-5038 | Medium | 5.3 | 2026-06-15 | Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multip… |
CVE-2026-53867 | Medium | 4.3 | 2026-06-12 | Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned… |
CVE-2026-33232 | High | 7.5 | 2026-05-19 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vu… |
CVE-2026-0427 | | | 2026-05-15 | Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared… |
CVE-2026-34263 | Critical | 9.6 | 2026-05-12 | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary s… |
CVE-2026-43395 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
drm/xe/sync: Cleanup partially initialized sync on parse failure
xe_sync_entry_parse() ca… |
CVE-2025-66467 | High | 8.0 | 2026-05-08 | Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user cre… |
CVE-2026-35361 | Low | 3.4 | 2026-04-22 | The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails… |
CVE-2026-6830 | Low | 3.3 | 2026-04-21 | nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously a… |
CVE-2026-28268 | Critical | 9.8 | 2026-02-27 | Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechan… |
CVE-2026-3304 | High | 7.5 | 2026-02-27 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of S… |
CVE-2026-28196 | Low | 2.3 | 2026-02-25 | In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk |
CVE-2026-21438 | Medium | 5.3 | 2026-02-12 | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and… |
CVE-2025-15331 | Medium | 4.3 | 2026-02-05 | Tanium addressed an uncontrolled resource consumption vulnerability in Connect. |
CVE-2025-66675 | High | 8.2 | 2025-12-10 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0… |
CVE-2025-64775 | High | 7.5 | 2025-12-01 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0… |
CVE-2025-29934 | Medium | 5.3 | 2025-11-21 | A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data… |
CVE-2025-60730 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function |
CVE-2025-6338 | | | 2025-10-16 | There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period.
This issue… |
CVE-2025-59781 | High | 7.5 | 2025-10-15 | When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization. Not… |
CVE-2025-20293 | Medium | 5.3 | 2025-09-24 | A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthen… |
CVE-2025-55910 | Medium | 6.3 | 2025-09-19 | CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php. |
CVE-2025-0032 | High | 7.2 | 2025-09-06 | Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially res… |
CVE-2024-21977 | Low | 3.2 | 2025-09-05 | Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potentially resulting… |
CVE-2025-43711 | High | 8.1 | 2025-07-05 | Tunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by dragging a crafted… |
CVE-2025-38177 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved:
sch_hfsc: make hfsc_qlen_notify() idempotent
hfsc_qlen_notify() is not idempotent either… |
CVE-2023-29184 | Low | 3.2 | 2025-06-10 | An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM p… |
CVE-2025-37908 | High | 7.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved:
mm, slab: clean up slab->obj_exts always
When memory allocation profiling is disabled at… |
CVE-2025-31650 | High | 7.5 | 2025-04-28 | Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of th… |
CVE-2025-2260 | High | 7.5 | 2025-04-06 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before
version 6.4.3, an attacker can cause a denial of service by specially
crafted packets. T… |
CVE-2024-50385 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2024-50384 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2025-21924 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved:
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an e… |
CVE-2023-52929 | Medium | 5.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved:
nvmem: core: fix cleanup after dev_set_name()
If dev_set_name() fails, we leak nvmem->wp_… |
CVE-2024-36353 | Medium | 6.5 | 2025-03-02 | Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentially leading to loss… |
CVE-2024-57976 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved:
btrfs: do proper folio cleanup when cow_file_range() failed
[BUG]
When testing with COW f… |
CVE-2024-57975 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved:
btrfs: do proper folio cleanup when run_delalloc_nocow() failed
[BUG]
With CONFIG_DEBUG_V… |
CVE-2025-0726 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before
version 6.4.2, an attacker can cause a denial of service by specially
crafted packets. T… |
CVE-2024-53881 | Medium | 5.5 | 2025-01-28 | NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which may lead to denial… |
CVE-2024-53869 | Medium | 5.5 | 2025-01-28 | NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability m… |
CVE-2025-0473 | Medium | 6.5 | 2025-01-16 | Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exi… |
CVE-2025-21609 | Critical | 9.1 | 2025-01-03 | SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnera… |
CVE-2024-28265 | Critical | 9.1 | 2024-11-01 | IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php. |
CVE-2022-49028 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
ixgbevf: Fix resource leak in ixgbevf_init_module()
ixgbevf_init_module() won't destroy t… |
CVE-2022-49012 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
afs: Fix server->active leak in afs_put_server
The atomic_read was accidentally replaced… |
CVE-2024-49851 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
tpm: Clean up TPM space after command failure
tpm_dev_transmit prepares the TPM space bef… |
CVE-2024-47731 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
The alibaba_uncore_pmu dri… |
CVE-2024-47728 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
For all non-tracing helpers… |
CVE-2024-47693 | Medium | 6.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
IB/core: Fix ib_cache_setup_one error flow cleanup
When ib_cache_update return an error… |
CVE-2024-47674 | High | 7.8 | 2024-10-15 | In the Linux kernel, the following vulnerability has been resolved:
mm: avoid leaving partial pfn mappings around in error case
As Jann points out, PFN mappi… |
CVE-2024-45027 | Medium | 5.5 | 2024-09-11 | In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup()
If xhci_mem… |
CVE-2024-44982 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
If the dpu_format_populate_la… |
CVE-2024-45445 | Medium | 4.0 | 2024-09-04 | Vulnerability of resources not being closed or released in the keystore module
Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2022-48893 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gt: Cleanup partial engine discovery failures
If we abort driver initialisation… |
CVE-2023-31356 | Medium | 4.4 | 2024-08-13 | Incomplete system memory cleanup in SEV firmware could
allow a privileged attacker to corrupt guest private memory, potentially
resulting in a loss of data int… |
CVE-2023-20518 | Low | 1.9 | 2024-08-13 | Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfil… |
CVE-2024-6300 | Low | 3.7 | 2024-06-25 | Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction |
CVE-2024-38275 | High | 7.5 | 2024-06-18 | The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally se… |
CVE-2024-36952 | Medium | 4.7 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
There are cas… |
CVE-2021-47365 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved:
afs: Fix page leak
There's a loop in afs_extend_writeback() that adds extra pages to a wr… |
CVE-2024-35959 | Medium | 5.5 | 2024-05-20 | In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix mlx5e_priv_init() cleanup flow
When mlx5e_priv_init() fails, the cleanup f… |
CVE-2023-45846 | Medium | 5.5 | 2024-05-16 | Incomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of service via local a… |
CVE-2024-4767 | Medium | 4.3 | 2024-05-14 | If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disa… |
CVE-2024-26841 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Update cpu_sibling_map when disabling nonboot CPUs
Update cpu_sibling_map when… |
CVE-2024-26832 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved:
mm: zswap: fix missing folio cleanup in writeback race path
In zswap_writeback_entry(), a… |
CVE-2024-26825 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
rx_data_reassembly skb is sto… |
CVE-2024-26803 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved:
net: veth: clear GRO when clearing XDP even when down
veth sets NETIF_F_GRO automatically… |
CVE-2024-26756 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved:
md: Don't register sync_thread for reshape directly
Currently, if reshape is interrupted… |
CVE-2024-26687 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved:
xen/events: close evtchn after mapping cleanup
shutdown_pirq and startup_pirq are not tak… |
CVE-2024-26667 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup
The commit 8b45a26f… |
CVE-2024-20303 | High | 7.4 | 2024-03-27 | A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjace… |
CVE-2021-47178 | High | 7.5 | 2024-03-25 | In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Avoid smp_processor_id() in preemptible code
The BUG message "BUG: us… |
CVE-2021-47143 | Medium | 5.5 | 2024-03-25 | In the Linux kernel, the following vulnerability has been resolved:
net/smc: remove device from smcd_dev_list after failed device_add()
If the device_add() f… |
CVE-2023-52617 | Medium | 4.4 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved:
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
A PCI device hot remo… |
CVE-2021-47110 | High | 7.1 | 2024-03-15 | In the Linux kernel, the following vulnerability has been resolved:
x86/kvm: Disable kvmclock on all CPUs on shutdown
Currenly, we disable kvmclock from mach… |
CVE-2024-2403 | Medium | 5.9 | 2024-03-13 |
Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and
earlier on Windows allows an attacker that compromis… |
CVE-2024-23672 | Medium | 6.3 | 2024-03-13 | Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to in… |
CVE-2024-26005 | Medium | 4.8 | 2024-03-12 | An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS. |
CVE-2024-1048 | Low | 3.3 | 2024-02-06 | A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grub… |
CVE-2024-21617 | Medium | 6.5 | 2024-01-12 |
An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cau… |
CVE-2023-41835 | High | 7.5 | 2023-12-05 | When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even… |
CVE-2022-46298 | Low | 1.9 | 2023-11-14 | Incomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. |
CVE-2022-43477 | Low | 3.3 | 2023-11-14 | Incomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2021-46766 | Low | 2.5 | 2023-11-14 | Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of… |
CVE-2023-42795 | Medium | 5.3 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 th… |
CVE-2023-42794 | Medium | 5.9 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat.
The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 throug… |
CVE-2023-35945 | High | 7.5 | 2023-07-13 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_S… |
CVE-2023-36468 | Critical | 9.9 | 2023-06-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrad… |
CVE-2023-2400 | Low | 2.7 | 2023-06-20 | Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of delete… |
CVE-2022-40974 | Low | 1.8 | 2023-05-10 | Incomplete cleanup in the Intel(R) IPP Cryptography software before version 2021.6 may allow a privileged user to potentially enable information disclosure via… |
CVE-2023-20862 | Medium | 6.3 | 2023-04-19 | In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean… |