CVE-2026-109438 | Medium | 5.3 | 2026-10-14 | 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers… |
CVE-2026-97629 | Medium | 6.5 | 2026-10-14 | Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
shared:name:size
without an explicit ssl_session_ticket_key file direc… |
CVE-2026-104086 | Medium | 5.5 | 2026-10-14 | 7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to… |
CVE-2026-97011 | High | 8.8 | 2026-10-13 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
CVE-2026-96850 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally. |
CVE-2026-96849 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. |
CVE-2026-96247 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. |
CVE-2026-96206 | Medium | 6.5 | 2026-10-13 | Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally. |
CVE-2026-88150 | High | 8.8 | 2026-10-13 | Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
CVE-2026-85843 | High | 7.8 | 2026-10-13 | Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-85322 | High | 7.5 | 2026-10-13 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-85320 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally. |
CVE-2026-83925 | Medium | 4.7 | 2026-10-13 | Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-83755 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-83723 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
CVE-2026-83714 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally. |
CVE-2026-83695 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
CVE-2026-83669 | High | 7.8 | 2026-10-13 | Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
CVE-2026-83515 | Medium | 6.5 | 2026-10-13 | Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70293 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
CVE-2026-70284 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
CVE-2026-70090 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally. |
CVE-2026-105731 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally. |
CVE-2026-102187 | Medium | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-109273 | Medium | 5.3 | 2026-10-12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one b… |
CVE-2026-109242 | High | 7.1 | 2026-10-12 | FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated… |
CVE-2026-107676 | Low | 3.3 | 2026-10-08 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitiali… |
CVE-2026-104074 | Medium | 5.3 | 2026-10-07 | Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a… |
CVE-2026-106395 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-106386 | Medium | 6.5 | 2026-10-06 | Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page… |
CVE-2026-106379 | Medium | 4.3 | 2026-10-06 | Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-106376 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafte… |
CVE-2026-106370 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-106290 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-106275 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-106273 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outsi… |
CVE-2026-106261 | Medium | 6.5 | 2026-10-06 | Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (C… |
CVE-2026-106258 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafte… |
CVE-2026-106245 | Medium | 4.3 | 2026-10-06 | Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromiu… |
CVE-2026-106231 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTM… |
CVE-2026-106223 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-106215 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafte… |
CVE-2026-106202 | Medium | 4.7 | 2026-10-06 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafte… |
CVE-2026-106184 | Medium | 4.3 | 2026-10-06 | Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromiu… |
CVE-2026-92834 | | | 2026-10-02 | Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server.
This issue affects Apache Thrift: before 0.2… |
CVE-2026-85483 | | | 2026-10-02 | Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.25.0.
… |
CVE-2026-47600 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operate on an improperly i… |
CVE-2026-47555 | Medium | 5.5 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kernel memory to be co… |
CVE-2026-102325 | Medium | 4.3 | 2026-09-29 | Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-102319 | Low | 3.4 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside… |
CVE-2026-102315 | Low | 3.4 | 2026-09-29 | Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to rea… |
CVE-2026-102313 | Medium | 4.7 | 2026-09-29 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafte… |
CVE-2026-102311 | Low | 3.4 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-102307 | Medium | 4.7 | 2026-09-29 | Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-102303 | Medium | 4.3 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML pa… |
CVE-2026-102300 | Medium | 4.3 | 2026-09-29 | Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-95359 | Low | 3.4 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-95324 | Low | 3.4 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside… |
CVE-2026-95293 | Medium | 4.7 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Ch… |
CVE-2026-102635 | Low | 3.7 | 2026-09-29 | ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gi… |
CVE-2026-94056 | High | 7.5 | 2026-09-19 | Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory. |
CVE-2026-93018 | Medium | 5.5 | 2026-09-18 | Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin… |
CVE-2026-54634 | High | 7.3 | 2026-09-17 | Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reach… |
CVE-2026-54604 | | | 2026-09-17 | OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/open… |
CVE-2026-91740 | Medium | 4.3 | 2026-09-15 | Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-91720 | Medium | 4.7 | 2026-09-15 | Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (… |
CVE-2026-91946 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize pad… |
CVE-2026-84622 | Medium | 6.2 | 2026-09-14 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden… |
CVE-2026-15710 | | | 2026-09-11 | An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal comm… |
CVE-2026-87647 | Low | 3.4 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside… |
CVE-2026-87642 | Medium | 4.3 | 2026-09-09 | Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-87576 | Low | 3.4 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-87555 | Medium | 4.7 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-87497 | Medium | 4.3 | 2026-09-09 | Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (… |
CVE-2026-87456 | Low | 3.4 | 2026-09-09 | Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outsi… |
CVE-2026-85880 | High | 7.8 | 2026-09-08 | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. |
CVE-2026-81958 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-81391 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-80091 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network. |
CVE-2026-78519 | High | 8.8 | 2026-09-08 | Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-72989 | High | 7.5 | 2026-09-08 | Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network. |
CVE-2026-72945 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally. |
CVE-2026-70290 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
CVE-2026-69853 | Medium | 4.7 | 2026-09-08 | Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-69770 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally. |
CVE-2026-69672 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally. |
CVE-2026-69485 | High | 8.8 | 2026-09-08 | Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
CVE-2026-69358 | High | 7.1 | 2026-09-08 | Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
CVE-2026-69349 | Medium | 5.7 | 2026-09-08 | Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network. |
CVE-2026-69288 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
CVE-2026-68873 | Medium | 5.5 | 2026-09-08 | Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information local… |
CVE-2026-68852 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally. |
CVE-2026-68776 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67648 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67386 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-85089 | Medium | 6.5 | 2026-09-03 | FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in… |
CVE-2026-84326 | High | 8.8 | 2026-09-02 | Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
CVE-2026-84267 | Medium | 4.3 | 2026-09-01 | A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length… |
CVE-2026-79285 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML… |
CVE-2026-79270 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (… |