CVE-2026-16868 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing. |
CVE-2026-70459 | Medium | 5.3 | 2026-08-13 | rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by send… |
CVE-2026-0301 | | | 2026-08-13 | An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access… |
CVE-2026-70317 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-68799 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-62740 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally. |
CVE-2026-62709 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
CVE-2026-59137 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
CVE-2026-59136 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally. |
CVE-2026-58247 | Medium | 5.3 | 2026-08-11 | SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data… |
CVE-2026-11809 | Low | 3.7 | 2026-08-10 | The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe resp… |
CVE-2026-6368 | | | 2026-08-10 | Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, whic… |
CVE-2026-70631 | Medium | 5.5 | 2026-08-06 | FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/t… |
CVE-2026-70630 | Medium | 5.5 | 2026-08-06 | FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/s… |
CVE-2026-70629 | Medium | 5.5 | 2026-08-06 | FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) t… |
CVE-2026-68744 | Low | 3.3 | 2026-08-04 | A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink… |
CVE-2026-66038 | Medium | 6.5 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose u… |
CVE-2026-66034 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-lengt… |
CVE-2026-64220 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved:
device property: set fwnode->secondary to NULL in fwnode_init()
If a firmware node is all… |
CVE-2026-47247 | High | 7.5 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel val… |
CVE-2026-16386 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16385 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16384 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-64130 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free
__GFP_… |
CVE-2026-53379 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov8856: free control handler on error in ov8856_init_controls()
The control h… |
CVE-2026-60005 | High | 8.2 | 2026-07-15 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured o… |
CVE-2026-58546 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58535 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58533 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-57982 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network. |
CVE-2026-57084 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally. |
CVE-2026-57083 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally. |
CVE-2026-56190 | Critical | 9.8 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. |
CVE-2026-55949 | High | 7.8 | 2026-07-14 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-55042 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-50690 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
CVE-2026-50497 | Medium | 6.5 | 2026-07-14 | Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50455 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. |
CVE-2026-50376 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-55003 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-54997 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
CVE-2026-49801 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
CVE-2026-49165 | High | 7.1 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally. |
CVE-2026-40422 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-56085 | Low | 3.3 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-53467 | Medium | 5.3 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contai… |
CVE-2026-6686 | Medium | 4.6 | 2026-07-01 | FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This… |
CVE-2026-53347 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix driver removal with disabled KMS
DRM atomic and modesetting aren't initia… |
CVE-2026-53344 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved:
pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
Regmap initializa… |
CVE-2026-54500 | Medium | 5.3 | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized sta… |
CVE-2026-58051 | Medium | 6.5 | 2026-06-28 | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure re… |
CVE-2026-53311 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved:
fuse: fix uninit-value in fuse_dentry_revalidate()
fuse_dentry_revalidate() may be called… |
CVE-2026-53243 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()
There is an bu… |
CVE-2026-53225 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
__sctp_rcv_asconf_lookup() in net/sc… |
CVE-2026-53218 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
nft_exthdr_init() passes… |
CVE-2026-53170 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
accel/ethosu: reject DMA commands with uninitialized length
cmd_state_init() initializes… |
CVE-2026-53167 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
FUSE_NOTIFY_RETRIEVE must be limited… |
CVE-2026-53142 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved:
drm/xe/display: fix oops in suspend/shutdown without display
The xe driver keeps track of… |
CVE-2026-53082 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
sixpack_receive_buf() does… |
CVE-2026-53029 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: prevent uninitialized lcn caused by zero len
syzbot reported a uninit-value in… |
CVE-2026-52989 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
Currently, when nv… |
CVE-2026-52985 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved:
netdevsim: zero initialize struct iphdr in dummy sk_buff
Syzbot reports a KMSAN uninit-va… |
CVE-2026-56968 | Low | 3.7 | 2026-06-23 | GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a craf… |
CVE-2026-11576 | High | 7.5 | 2026-06-19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this… |
CVE-2026-42969 | Medium | 5.5 | 2026-06-09 | Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally. |
CVE-2026-48104 | Medium | 4.2 | 2026-06-05 | 7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused b… |
CVE-2026-48101 | Medium | 6.5 | 2026-06-05 | 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI cap… |
CVE-2026-11089 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sen… |
CVE-2026-26825 | Medium | 5.3 | 2026-06-03 | A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is trig… |
CVE-2026-46257 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved:
clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 pl… |
CVE-2026-46186 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: virtio_bt: validate rx pkt_type header length
virtbt_rx_handle() reads the lea… |
CVE-2026-46169 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
hfsplus: fix uninit-value by validating catalog record size
Syzbot reported a KMSAN unini… |
CVE-2026-46167 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
Just like in a previous pro… |
CVE-2026-46139 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
smb: client: use kzalloc to zero-initialize security descriptor buffer
Commit 62e7dd0a39c… |
CVE-2026-46132 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved:
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
rtnl_f… |
CVE-2026-47272 | High | 7.1 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified t… |
CVE-2026-45886 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix bpf_xdp_store_bytes proto for read-only arg
While making some maps in Cilium rea… |
CVE-2025-71311 | High | 8.2 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Initialize new folios before use
KMSAN reports an uninitialized value in longes… |
CVE-2026-32814 | Medium | 6.5 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the defau… |
CVE-2026-45736 | Medium | 4.4 | 2026-05-15 | ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory discl… |
CVE-2025-48513 | | | 2026-05-15 | Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memory resulting in los… |
CVE-2026-40364 | High | 8.4 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-43474 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
fs: init flags_valid before calling vfs_fileattr_get
syzbot reported a uninit-value bug i… |
CVE-2026-43472 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
unshare: fix unshare_fs() handling
There's an unpleasant corner case in unshare(2), when… |
CVE-2026-43456 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
bonding: fix type confusion in bond_setup_by_slave()
kernel BUG at net/core/skbuff.c:2306… |
CVE-2026-43405 | High | 7.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
libceph: Use u32 for non-negative values in ceph_monmap_decode()
This patch fixes unneces… |
CVE-2026-43349 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
syzbot reported a… |
CVE-2026-43291 | High | 8.3 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
net: nfc: nci: Fix parameter validation for packet data
Since commit 9c328f54741b ("net… |
CVE-2026-43288 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved:
ext4: move ext4_percpu_param_init() before ext4_mb_init()
When running `kvm-xfstests -c e… |
CVE-2026-43221 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
ipmi: ipmb: initialise event handler read bytes
IPMB doesn't use i2c reads, but the handl… |
CVE-2026-43160 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
mfd: macsmc: Initialize mutex
Initialize struct apple_smc's mutex in apple_smc_probe(). U… |
CVE-2026-43139 | High | 8.6 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved:
xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
xfrm6_get_saddr() does not check the… |
CVE-2026-43036 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
net: use skb_header_pointer() for TCPv4 GSO frag_off check
Syzbot reported a KMSAN uninit… |
CVE-2026-43035 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an i… |
CVE-2026-31693 | High | 7.8 | 2026-04-30 | In the Linux kernel, the following vulnerability has been resolved:
cifs: some missing initializations on replay
In several places in the code, we have a lab… |
CVE-2026-7141 | Medium | 5.6 | 2026-04-27 | A vulnerability was found in vllm up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the componen… |
CVE-2026-31626 | High | 7.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
Initialize le_tmp64 to zero i… |
CVE-2026-31621 | Medium | 5.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved:
bnge: return after auxiliary_device_uninit() in error path
When auxiliary_device_add() fa… |
CVE-2026-31492 | Medium | 5.5 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Initialize free_qp completion before using it
In irdma_create_qp, if ib_copy_… |
CVE-2026-6749 | High | 7.5 | 2026-04-21 | Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefo… |