CVE-2026-43040 | High | 7.1 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prev… |
CVE-2026-40687 | Medium | 4.8 | 2026-04-30 | In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connec… |
CVE-2025-8117 | High | 7.5 | 2025-09-30 | PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality… |
CVE-2025-38601 | High | 8.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: clear initialized flag for deinit-ed srng lists
In a number of cases we see… |
CVE-2025-38532 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved:
net: libwx: properly reset Rx ring descriptor
When device reset is triggered by feature c… |
CVE-2025-54410 | Low | 3.3 | 2025-07-30 | Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstr… |
CVE-2025-54388 | Medium | 4.6 | 2025-07-30 | Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstr… |
CVE-2022-50169 | High | 7.1 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved:
wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
The simple_write_to_buffer(… |
CVE-2022-49865 | High | 7.1 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved:
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
When copying a… |
CVE-2022-49217 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved:
scsi: pm8001: Fix abort all task initialization
In pm80xx_send_abort_all(), the n_elem fi… |
CVE-2024-52870 | High | 7.1 | 2025-01-17 | Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including Chromiu… |
CVE-2024-56676 | Medium | 5.5 | 2024-12-28 | In the Linux kernel, the following vulnerability has been resolved:
thermal: testing: Initialize some variables annoteded with _free()
Variables annotated wi… |
CVE-2024-53845 | | | 2024-12-12 | ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no opt… |
CVE-2024-50076 | Medium | 6.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved:
vt: prevent kernel-infoleak in con_font_get()
font.data may not initialize all memory spa… |
CVE-2024-9780 | High | 7.8 | 2024-10-10 | ITS dissector crash in Wireshark 4.4.0 allows denial of service via packet injection or crafted capture file |
CVE-2024-8178 | High | 8.8 | 2024-09-05 | The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it.
Malicious software running in a gues… |
CVE-2024-43873 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved:
vhost/vsock: always initialize seqpacket_allow
There are two issues around seqpacket_allo… |
CVE-2024-32945 | Low | 2.6 | 2024-07-15 | Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a… |
CVE-2024-26635 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved:
llc: Drop support for ETH_P_TR_802_2.
syzbot reported an uninit-value bug below. [0]
llc… |
CVE-2024-27913 | Medium | 6.5 | 2024-02-28 | ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OS… |
CVE-2023-5138 | Medium | 6.8 | 2024-01-03 | Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B. |
CVE-2022-1016 | Medium | 5.5 | 2022-08-29 | A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with… |
CVE-2022-0175 | Medium | 5.5 | 2022-08-26 | A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resour… |
CVE-2021-0947 | High | 7.5 | 2022-08-24 | The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLServerDiscoverStreamsKM, and then copies t… |
CVE-2021-0946 | High | 7.5 | 2022-08-24 | The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer via PMR_PDumpSymbolicAddr, and then copi… |
CVE-2022-29968 | High | 7.8 | 2022-05-02 | An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private. |
CVE-2022-0382 | Medium | 5.5 | 2022-02-11 | An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or… |
CVE-2021-40403 | Medium | 6.3 | 2022-02-04 | An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked… |
CVE-2022-22704 | Critical | 9.8 | 2022-01-06 | The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd w… |
CVE-2021-39966 | High | 7.5 | 2022-01-03 | There is an Uninitialized AOD driver structure in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2019-25054 | High | 7.5 | 2021-12-27 | An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) bec… |
CVE-2021-0966 | Medium | 5.5 | 2021-12-15 | In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process… |
CVE-2021-0961 | Medium | 4.4 | 2021-12-15 | In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure wi… |
CVE-2021-22482 | Medium | 5.3 | 2021-10-28 | There is an Uninitialized variable vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause transmission of invalid data. |
CVE-2021-36513 | High | 7.5 | 2021-10-18 | An issue was discovered in function sofia_handle_sip_i_notify in sofia.c in SignalWire freeswitch before 1.10.6, may allow attackers to view sensitive informat… |
CVE-2021-26333 | Medium | 5.5 | 2021-09-21 | An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionary access control list (DACL) may allow… |
CVE-2021-29980 | High | 8.8 | 2021-08-17 | Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerabil… |
CVE-2021-3655 | Low | 3.3 | 2021-08-05 | A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uni… |
CVE-2021-36386 | High | 7.5 | 2021-07-30 | report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause… |
CVE-2021-23994 | High | 8.8 | 2021-06-24 | A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10… |
CVE-2021-34693 | Medium | 5.5 | 2021-06-14 | net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure… |
CVE-2021-0484 | Medium | 5.5 | 2021-06-11 | In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a missing bounds check. This could lead to local information disc… |
CVE-2021-22898 | Low | 3.1 | 2021-06-11 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send… |
CVE-2021-28687 | Medium | 5.5 | 2021-06-11 | HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards… |
CVE-2021-23386 | High | 7.7 | 2021-05-20 | This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can ex… |
CVE-2021-31919 | High | 7.5 | 2021-04-30 | An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized va… |
CVE-2021-28167 | Medium | 6.5 | 2021-04-21 | In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entri… |
CVE-2021-1405 | High | 7.5 | 2021-04-08 | A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote a… |
CVE-2021-29647 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory… |
CVE-2020-25579 | Medium | 5.3 | 2021-03-26 | In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was fa… |
CVE-2020-24455 | Medium | 6.7 | 2021-02-26 | Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This aff… |
CVE-2019-25016 | High | 8.8 | 2021-01-28 | In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execut… |
CVE-2020-12523 | Medium | 5.4 | 2020-12-17 | On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard… |
CVE-2020-0488 | Medium | 6.5 | 2020-12-15 | In ihevc_inter_pred_chroma_copy_ssse3 of ihevc_inter_pred_filters_ssse3_intr.c, there is a possible information disclosure due to uninitialized data. This coul… |
CVE-2020-12352 | Medium | 6.5 | 2020-11-23 | Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. |
CVE-2020-20739 | Medium | 5.3 | 2020-11-20 | im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path… |
CVE-2020-0438 | High | 7.8 | 2020-11-10 | In the AIBinder_Class constructor of ibinder.cpp, there is a possible arbitrary code execution due to uninitialized data. This could lead to local escalation o… |
CVE-2020-16932 | High | 7.8 | 2020-10-16 | <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who succe… |
CVE-2020-9227 | Medium | 5.5 | 2020-07-17 | Huawei Smart Phones Moana-AL00B with versions earlier than 10.1.0.166 have a missing initialization of resource vulnerability. An attacker tricks the user into… |
CVE-2020-1419 | Medium | 5.5 | 2020-07-14 | An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosur… |
CVE-2018-21247 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectTo… |
CVE-2020-0195 | Medium | 6.5 | 2020-06-11 | In ihevcd_iquant_itrans_recon_ctb of ihevcd_iquant_itrans_recon_ctb.c and related functions, there is a possible information disclosure due to uninitialized da… |
CVE-2020-0134 | Medium | 5.5 | 2020-06-11 | In BnDrm::onTransact of IDrm.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no… |
CVE-2020-0101 | Medium | 5.5 | 2020-05-14 | In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure w… |
CVE-2020-11741 | High | 8.8 | 2020-04-14 | An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests… |
CVE-2020-11494 | Medium | 4.4 | 2020-04-02 | An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data… |
CVE-2020-6792 | Medium | 4.3 | 2020-03-02 | When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 6… |
CVE-2019-19553 | High | 7.5 | 2019-12-05 | In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensurin… |
CVE-2019-19536 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c dri… |
CVE-2019-19535 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driv… |
CVE-2019-19534 | Low | 2.4 | 2019-12-03 | In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c d… |
CVE-2019-12410 | High | 7.5 | 2019-11-08 | While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data… |
CVE-2019-12408 | High | 7.5 | 2019-11-08 | It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized mem… |
CVE-2019-9321 | Medium | 6.5 | 2019-09-27 | In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User in… |
CVE-2019-9320 | Medium | 6.5 | 2019-09-27 | In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User in… |
CVE-2019-9319 | Medium | 6.5 | 2019-09-27 | In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User in… |
CVE-2019-9318 | Medium | 6.5 | 2019-09-27 | In libhevc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User i… |
CVE-2019-9317 | Medium | 6.5 | 2019-09-27 | In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed… |
CVE-2019-9316 | Medium | 6.5 | 2019-09-27 | In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed… |
CVE-2019-9315 | Medium | 6.5 | 2019-09-27 | In libhevc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User i… |
CVE-2019-9314 | Medium | 6.5 | 2019-09-27 | In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User in… |
CVE-2019-9313 | Medium | 6.5 | 2019-09-27 | In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed… |
CVE-2019-9247 | Medium | 6.5 | 2019-09-27 | In AAC Codec, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User… |
CVE-2019-16714 | High | 7.5 | 2019-09-23 | In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos a… |
CVE-2019-3804 | High | 7.5 | 2019-03-26 | It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated at… |
CVE-2019-9639 | High | 7.5 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process… |
CVE-2018-19519 | Medium | 5.5 | 2018-11-25 | In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization. |
CVE-2018-9511 | Medium | 5.5 | 2018-10-02 | In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to l… |
CVE-2018-14647 | High | 7.5 | 2018-09-25 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks a… |
CVE-2018-1000224 | High | 7.5 | 2018-08-20 | Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer ov… |
CVE-2018-10811 | High | 7.5 | 2018-06-19 | strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable. |
CVE-2017-0730 | Medium | 5.5 | 2017-08-09 | A denial of service vulnerability in the Android media framework (h264 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36279… |
CVE-2011-1044 | | | 2011-02-18 | The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which a… |
CVE-2010-3877 | | | 2011-01-03 | The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain po… |
CVE-2010-3876 | | | 2011-01-03 | net/packet/af_packet.c in the Linux kernel before 2.6.37-rc2 does not properly initialize certain structure members, which allows local users to obtain potenti… |
CVE-2010-4083 | | | 2010-11-30 | The copy_semid_to_user function in ipc/sem.c in the Linux kernel before 2.6.36 does not initialize a certain structure, which allows local users to obtain pote… |
CVE-2010-4082 | | | 2010-11-30 | The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure mem… |
CVE-2010-4081 | | | 2010-11-30 | The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows loc… |
CVE-2010-4078 | | | 2010-11-29 | The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel before 2.6.36-rc6 does not properly initialize a certain structure member, which a… |
CVE-2010-3297 | | | 2010-09-30 | The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows… |