CVE-2026-94056 | High | 7.5 | 2026-09-19 | Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory. |
CVE-2026-93018 | Medium | 5.5 | 2026-09-18 | Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin… |
CVE-2026-54634 | High | 7.3 | 2026-09-17 | Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reach… |
CVE-2026-54604 | | | 2026-09-17 | OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/open… |
CVE-2026-91740 | Medium | 4.3 | 2026-09-15 | Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-91720 | Medium | 4.7 | 2026-09-15 | Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (… |
CVE-2026-91946 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize pad… |
CVE-2026-84622 | Medium | 6.2 | 2026-09-14 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden… |
CVE-2026-15710 | | | 2026-09-11 | An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal comm… |
CVE-2026-87647 | Low | 3.4 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside… |
CVE-2026-87642 | Medium | 4.3 | 2026-09-09 | Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-87576 | Low | 3.4 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-87555 | Medium | 4.7 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-87497 | Medium | 4.3 | 2026-09-09 | Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (… |
CVE-2026-87456 | Low | 3.4 | 2026-09-09 | Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outsi… |
CVE-2026-85880 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. |
CVE-2026-81958 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-81391 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-80091 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network. |
CVE-2026-78519 | High | 8.8 | 2026-09-08 | Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-72989 | High | 7.5 | 2026-09-08 | Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72945 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally. |
CVE-2026-70290 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
CVE-2026-69853 | Medium | 4.7 | 2026-09-08 | Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-69770 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally. |
CVE-2026-69672 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally. |
CVE-2026-69485 | High | 8.8 | 2026-09-08 | Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
CVE-2026-69358 | High | 7.1 | 2026-09-08 | Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
CVE-2026-69349 | Medium | 5.7 | 2026-09-08 | Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network. |
CVE-2026-69288 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
CVE-2026-68873 | Medium | 5.5 | 2026-09-08 | Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information local… |
CVE-2026-68852 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally. |
CVE-2026-68776 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67648 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67386 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-85089 | Medium | 6.5 | 2026-09-03 | FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in… |
CVE-2026-84326 | High | 8.8 | 2026-09-02 | Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
CVE-2026-84267 | Medium | 4.3 | 2026-09-01 | A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length… |
CVE-2026-79285 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML… |
CVE-2026-79270 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (… |
CVE-2026-79269 | Medium | 4.3 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML pa… |
CVE-2026-79229 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outsi… |
CVE-2026-79221 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HT… |
CVE-2026-79120 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML pa… |
CVE-2026-79118 | Medium | 4.3 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromiu… |
CVE-2026-79040 | Medium | 4.3 | 2026-08-25 | Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-79007 | Low | 3.1 | 2026-08-25 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read me… |
CVE-2026-78986 | Low | 3.1 | 2026-08-25 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain… |
CVE-2026-78984 | Low | 3.4 | 2026-08-25 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read me… |
CVE-2026-78977 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via… |
CVE-2026-78969 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in Video in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (C… |
CVE-2026-78965 | Medium | 4.3 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromiu… |
CVE-2026-78962 | Medium | 4.3 | 2026-08-25 | Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origi… |
CVE-2026-78958 | Low | 3.1 | 2026-08-25 | Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain… |
CVE-2026-78914 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HT… |
CVE-2026-62986 | Medium | 4.3 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through… |
CVE-2026-19448 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitatio… |
CVE-2026-63381 | | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference proces… |
CVE-2026-16827 | Medium | 5.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer. |
CVE-2026-58084 | Medium | 5.5 | 2026-08-19 | To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI… |
CVE-2026-49425 | Medium | 5.5 | 2026-08-19 | The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct.
An unprivileged… |
CVE-2026-49424 | Medium | 5.5 | 2026-08-19 | The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct.
An unp… |
CVE-2026-49423 | Low | 3.3 | 2026-08-19 | When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including… |
CVE-2026-62377 | Medium | 4.3 | 2026-08-18 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leav… |
CVE-2026-76042 | Low | 3.1 | 2026-08-18 | Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory… |
CVE-2026-16868 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing. |
CVE-2026-70459 | Medium | 5.3 | 2026-08-13 | rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by send… |
CVE-2026-0301 | High | 7.5 | 2026-08-13 | An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access… |
CVE-2026-70317 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-68799 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-62740 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally. |
CVE-2026-62709 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
CVE-2026-59137 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
CVE-2026-59136 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally. |
CVE-2026-58247 | Medium | 5.3 | 2026-08-11 | SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data… |
CVE-2026-11809 | Low | 3.7 | 2026-08-10 | The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe resp… |
CVE-2026-6368 | | | 2026-08-10 | Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, whic… |
CVE-2026-70631 | Medium | 5.5 | 2026-08-06 | FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/t… |
CVE-2026-70630 | Medium | 5.5 | 2026-08-06 | FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/s… |
CVE-2026-70629 | Medium | 5.5 | 2026-08-06 | FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) t… |
CVE-2026-68744 | Low | 3.3 | 2026-08-04 | A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink… |
CVE-2026-64413 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: zero chainstack array
sashiko reports:
looking at ebtables table
t… |
CVE-2026-64360 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
hfs_bnode_read() can return early w… |
CVE-2026-64309 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
Sashiko notes:
> if SEV initia… |
CVE-2026-66038 | Medium | 6.5 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose u… |
CVE-2026-66034 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-lengt… |
CVE-2026-64220 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
device property: set fwnode->secondary to NULL in fwnode_init()
If a firmware node is all… |
CVE-2026-47247 | High | 7.5 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel val… |
CVE-2026-16386 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16385 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16384 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-64130 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free
__GFP_… |
CVE-2026-64082 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
riscv: Fix register corruption from uninitialized cregs on error
compat_riscv_gpr_set() c… |
CVE-2026-53379 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov8856: free control handler on error in ov8856_init_controls()
The control h… |
CVE-2026-60005 | High | 8.2 | 2026-07-15 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured o… |
CVE-2026-58546 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58535 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58533 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-57982 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network. |
CVE-2026-57084 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally. |