Overview 1,083 matches · 1 in Waratek scope · 0 protected · 11 exploited · 4 CISA KEV · 11 public PoC · 5 EPSS ≥ 0.5
1,083matches
1in Waratek scope0.1%
0protected0.0%
11exploited1.0%
4CISA KEV0.4%
11public PoC1.0%
5EPSS ≥ 0.50.5%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.1%
Outside Waratek scope
9
0.8%
Not applicable
1,073
99.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
1,083
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 383 / year
20071
Not applicable1
High1
not blocked1
Forecast only1
20086
Not applicable6
Critical1
High5
not blocked6
Exploited1
No public exploit5
20094
Not applicable4
High4
not blocked4
Exploited1
Working exploit published1
No public exploit2
20106
Not applicable6
High6
not blocked6
No public exploit6
201112
Not applicable12
High12
not blocked12
Exploited1
No public exploit11
20121
Not applicable1
Critical1
not blocked1
No public exploit1
20130
20140
20153
Not applicable3
Critical1
High2
not blocked3
No public exploit3
20162
Not applicable2
Medium2
not blocked2
No public exploit2
20174
Not applicable4
High1
Medium3
not blocked4
Working exploit published1
No public exploit3
201821
Not applicable21
Critical2
High8
Medium10
Low1
not blocked21
Exploited2
No public exploit19
201975
Outside Waratek scope4
Not applicable71
Critical8
High15
Medium52
not blocked75
No public exploit75
202056
Outside Waratek scope3
Not applicable53
Critical4
High17
Medium33
Low2
not blocked56
Exploited1
Proof of concept only1
Forecast only1
No public exploit53
202172
Outside Waratek scope1
Not applicable71
Critical29
High22
Medium17
Low4
not blocked72
Proof of concept only1
No public exploit71
202247
No exploit published1
Not applicable46
Critical2
High19
Medium25
Low1
not blocked47
Proof of concept only4
No public exploit43
202344
Not applicable44
Critical2
High21
Medium21
not blocked44
Exploited1
Proof of concept only7
Forecast only1
No public exploit35
2024186
Outside Waratek scope1
Not applicable185
Critical7
High79
Medium91
Low9
not blocked186
Exploited2
Proof of concept only2
No public exploit182
2025160
Not applicable160
Critical12
High45
Medium102
Low1
not blocked160
Exploited1
Proof of concept only2
No public exploit157
2026383
Not applicable383
Critical10
High94
Medium246
Low33
not blocked383
Exploited1
Proof of concept only19
No public exploit363
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-62977 | Medium | 2026-11-13 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0. |
| CVE-2026-19809 | Low | 2026-11-12 | Not applicable | No public exploit | The user-mode system call verifier z_vrfy_charger_get_prop() in drivers/charger/charger_handlers.c declares an uninitialized union charger_propval k_val on the kernel (privileged) stack, passes it to the charger driver back end via z_impl_charger_get_prop(), and then copies the full sizeof(union charger_propval) back into the calling user thread's buffer with k_usermode_to_copy(). That discloses kernel stack contents on two paths: On error. The copy-out ignores the driver's return code. In-tree back ends return an error without writing through the value pointer for properties they do not implement: charger_gpio_get_prop() returns -ENOTSUP unconditionally, and bq24190_get_prop() has a default: return -ENOTSUP; arm that never touches val. The whole union is then stack residue. On success. A back end writes only the one union member the requested property selects (for example sbs_charger.c writes the one-byte val->present for CHARGER_PROP_PRESENT and returns 0), yet the handler still copies the whole union, so every byte beyond that member is uninitialized. The handler is compiled only when CONFIG_USERSPACE=y and is reachable by any user-mode thread that has been granted access to a charger device object. K_SYSCALL_DRIVER_CHARGER() validates only the device object and its API pointer, not the property identifier, so an unprivileged thread can choose prop freely: an unimplemented property forces the error path, a narrow one the success path, and the call can be repeated at will. Each call discloses up to the size of the union (12 bytes on a 32-bit target, 16 bytes on 64-bit targets where the function-pointer members widen it) of supervisor-stack memory. The bytes are residue of earlier kernel-side frames on the thread's privileged stack and can contain kernel object addresses and saved return addresses, which an unprivileged thread cannot otherwise observe and which help defeat address-layout assumptions when exploiting a separate memory-safety defect. There is no integrity or availability impact. Two commits fix it, and both are needed. 5054384e983c skips the copy-out when the back end reports an error. c31cac727d02 zeroes the union before the driver call, so the bytes copied out on success are driver-written data or zeros. A tree carrying only the first still leaks on every successful call. |
| CVE-2026-126914 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126907 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126898 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126870 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126858 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126853 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126848 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126845 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126844 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-96158 | High | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96156 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally. |
| CVE-2026-96150 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally. |
| CVE-2026-96144 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| CVE-2026-96048 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| CVE-2026-96022 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Text Services Framework allows an authorized attacker to disclose information locally. |
| CVE-2026-95893 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
| CVE-2026-94517 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally. |
| CVE-2026-88247 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally. |
| CVE-2026-88217 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| CVE-2026-68783 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-67382 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-60059 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in the MigTD memory for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure. Network adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-125349 | Low | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-125345 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125342 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-124227 | High | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-124185 | High | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-122297 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally. |
| CVE-2026-119960 | High | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119933 | High | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119887 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-119825 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
| CVE-2026-119383 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack. |
| CVE-2026-118301 | High | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| CVE-2026-118214 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows Advanced Rasterization Platform allows an authorized attacker to disclose information locally. |
| CVE-2026-118104 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-116721 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-114150 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-113855 | High | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Windows DNS allows an unauthorized attacker to execute code over an adjacent network. |
| CVE-2026-109804 | High | 2026-11-10 | Not applicable | No public exploit | SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability. |
| CVE-2026-109796 | Medium | 2026-11-10 | Not applicable | No public exploit | SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability. |
| CVE-2026-105537 | Medium | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Mailslot File System allows an authorized attacker to disclose information locally. |
| CVE-2026-125268 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output. |
| CVE-2026-125266 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video. |
| CVE-2026-125243 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory. |
| CVE-2026-125217 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized heap data from frame_buffer to leak into output packets. |
| CVE-2026-125195 | Low | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process. |
| CVE-2026-125192 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames. |
| CVE-2026-125190 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames. |
| CVE-2026-125184 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CSCD stream whose LZO or zlib frames decompress to fewer bytes than the frame size, recovering heap contents from the decoded or re-encoded output. |
| CVE-2026-125179 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqa_decode_frame() to render frames from leftover heap bytes visible in decoded output. |
| CVE-2026-125177 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame exposes leftover heap memory to viewers of the output. |
| CVE-2026-125176 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory into decoded output frames. |
| CVE-2026-125175 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output. |
| CVE-2026-125170 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized stack bytes. |
| CVE-2026-125103 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized heap bytes into decoded audio output. |
| CVE-2026-125102 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio. |
| CVE-2026-125101 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output. |
| CVE-2026-125099 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents. |
| CVE-2026-125098 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames. |
| CVE-2026-125097 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output. |
| CVE-2026-125096 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq_decode_op1() copies an uninitialized 64-byte stack block into decoded frames, exposing stack memory in visible output. |
| CVE-2026-125095 | Medium | 2026-11-09 | Not applicable | No public exploit | FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents. |
| CVE-2026-16682 | Medium | 2026-11-08 | Not applicable | No public exploit | IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources. |
| CVE-2026-102664 | High | 2026-11-04 | Not applicable | No public exploit | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10. |
| CVE-2026-121227 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121213 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121207 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121176 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121173 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121143 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121095 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121072 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121033 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-120754 | Low | 2026-11-03 | Not applicable | No public exploit | HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029. |
| CVE-2026-120684 | Medium | 2026-11-03 | Not applicable | No public exploit | A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials. |
| CVE-2026-120247 | Medium | 2026-11-01 | Not applicable | No public exploit | FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents. |
| CVE-2026-120245 | Medium | 2026-11-01 | Not applicable | No public exploit | FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture. |
| CVE-2026-120244 | Medium | 2026-11-01 | Not applicable | No public exploit | FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels. |
| CVE-2026-119602 | Medium | 2026-10-30 | Not applicable | No public exploit | libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output. |
| CVE-2026-119375 | Medium | 2026-10-30 | Not applicable | No public exploit | SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers. |
| CVE-2026-119271 | High | 2026-10-30 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118354 | High | 2026-10-27 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118329 | High | 2026-10-27 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118322 | Medium | 2026-10-27 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-117863 | Medium | 2026-10-27 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-81038 | High | 2026-10-26 | Not applicable | No public exploit | The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer. The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path. On builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations. |
| CVE-2026-116739 | Medium | 2026-10-26 | Not applicable | Proof of concept only | VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments. |
| CVE-2026-113910 | Medium | 2026-10-26 | Not applicable | No public exploit | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to disclose kernel memory. |
| CVE-2026-112632 | Medium | 2026-10-26 | Not applicable | No public exploit | An uninitialized memory issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory. |
| CVE-2026-112630 | Low | 2026-10-26 | Not applicable | No public exploit | An uninitialized memory issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may result in disclosure of process memory. |
| CVE-2026-112571 | Medium | 2026-10-26 | Not applicable | No public exploit | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory. |
| CVE-2026-116180 | High | 2026-10-25 | Not applicable | No public exploit | vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests. |
| CVE-2026-115386 | Low | 2026-10-22 | Not applicable | No public exploit | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry. |
| CVE-2026-114651 | Medium | 2026-10-22 | Not applicable | Proof of concept only | A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required. |
| CVE-2026-114501 | Medium | 2026-10-21 | Not applicable | Proof of concept only | Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0. |
| CVE-2026-113340 | Medium | 2026-10-20 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113332 | High | 2026-10-20 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |