WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-908✕
Overview 602 matches · 1 in Waratek scope · 0 protected · 4 exploited · 2 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
602matches 1in Waratek scope0.2% 0protected0.0% 4exploited0.7% 2CISA KEV0.3% 2public PoC0.3% 1EPSS ≥ 0.50.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 0.2% Outside Waratek scope 6 1.0% Not applicable 595 98.8% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 602 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 602 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 0.7% Working exploit published 1 0.2% Proof of concept only 16 2.7% Forecast only 1 0.2% No public exploit 580 96.3%
split by peak 246 / year
Not applicable: 595Outside Waratek scope: 6No exploit published: 1 Medium: 602 not blocked: 602 No public exploit: 580Forecast only: 1Proof of concept only: 16Working exploit published: 1Exploited: 4
20162 Not applicable2 Medium2 not blocked2 No public exploit2 20173 Not applicable3 Medium3 not blocked3 Working exploit published1 No public exploit2 201810 Not applicable10 Medium10 not blocked10 Exploited1 No public exploit9 201952 Outside Waratek scope3 Not applicable49 Medium52 not blocked52 No public exploit52 202033 Outside Waratek scope2 Not applicable31 Medium33 not blocked33 Forecast only1 No public exploit32 202117 Outside Waratek scope1 Not applicable16 Medium17 not blocked17 Proof of concept only1 No public exploit16 202225 No exploit published1 Not applicable24 Medium25 not blocked25 Proof of concept only1 No public exploit24 202321 Not applicable21 Medium21 not blocked21 Exploited1 Proof of concept only5 No public exploit15 202491 Not applicable91 Medium91 not blocked91 Exploited2 No public exploit89 2025102 Not applicable102 Medium102 not blocked102 No public exploit102 2026246 Not applicable246 Medium246 not blocked246 Proof of concept only9 No public exploit237
20162017201820192020202120222023202420252026
602 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 7 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-62977 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0.
CVE-2026-126914 Medium 2026-11-11 Not applicable No public exploit Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126898 Medium 2026-11-11 Not applicable No public exploit Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126870 Medium 2026-11-11 Not applicable No public exploit Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126858 Medium 2026-11-11 Not applicable No public exploit Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-96156 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally.
CVE-2026-96150 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally.
CVE-2026-96144 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
CVE-2026-96048 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
CVE-2026-96022 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Text Services Framework allows an authorized attacker to disclose information locally.
CVE-2026-95893 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
CVE-2026-94517 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
CVE-2026-88247 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.
CVE-2026-88217 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
CVE-2026-68783 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67382 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-60059 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in the MigTD memory for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure. Network adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-125345 Medium 2026-11-10 Not applicable No public exploit Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-125342 Medium 2026-11-10 Not applicable No public exploit Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-122297 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
CVE-2026-119887 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network.
CVE-2026-119825 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
CVE-2026-119383 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.
CVE-2026-118214 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Advanced Rasterization Platform allows an authorized attacker to disclose information locally.
CVE-2026-118104 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-116721 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-114150 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.
CVE-2026-109796 Medium 2026-11-10 Not applicable No public exploit SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.
CVE-2026-105537 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Mailslot File System allows an authorized attacker to disclose information locally.
CVE-2026-125268 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.
CVE-2026-125266 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.
CVE-2026-125243 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.
CVE-2026-125217 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized heap data from frame_buffer to leak into output packets.
CVE-2026-125192 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames.
CVE-2026-125190 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.
CVE-2026-125184 Medium 2026-11-09 Not applicable No public exploit FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CSCD stream whose LZO or zlib frames decompress to fewer bytes than the frame size, recovering heap contents from the decoded or re-encoded output.
CVE-2026-125179 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqa_decode_frame() to render frames from leftover heap bytes visible in decoded output.
CVE-2026-125177 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame exposes leftover heap memory to viewers of the output.
CVE-2026-125176 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory into decoded output frames.
CVE-2026-125175 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output.
CVE-2026-125170 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized stack bytes.
CVE-2026-125103 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized heap bytes into decoded audio output.
CVE-2026-125102 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio.
CVE-2026-125101 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output.
CVE-2026-125099 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.
CVE-2026-125098 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames.
CVE-2026-125097 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output.
CVE-2026-125096 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq_decode_op1() copies an uninitialized 64-byte stack block into decoded frames, exposing stack memory in visible output.
CVE-2026-125095 Medium 2026-11-09 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.
CVE-2026-16682 Medium 2026-11-08 Not applicable No public exploit IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources.
CVE-2026-121213 Medium 2026-11-03 Not applicable No public exploit Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121176 Medium 2026-11-03 Not applicable No public exploit Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121072 Medium 2026-11-03 Not applicable No public exploit Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121033 Medium 2026-11-03 Not applicable No public exploit Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-120684 Medium 2026-11-03 Not applicable No public exploit A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.
CVE-2026-120247 Medium 2026-11-01 Not applicable No public exploit FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.
CVE-2026-120245 Medium 2026-11-01 Not applicable No public exploit FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture.
CVE-2026-120244 Medium 2026-11-01 Not applicable No public exploit FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompressed PCX image to leak heap memory contents through the decoded pixels.
CVE-2026-119602 Medium 2026-10-30 Not applicable No public exploit libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.
CVE-2026-119375 Medium 2026-10-30 Not applicable No public exploit SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
CVE-2026-118322 Medium 2026-10-27 Not applicable No public exploit Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-117863 Medium 2026-10-27 Not applicable No public exploit Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-116739 Medium 2026-10-26 Not applicable Proof of concept only VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
CVE-2026-113910 Medium 2026-10-26 Not applicable No public exploit A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to disclose kernel memory.
CVE-2026-112632 Medium 2026-10-26 Not applicable No public exploit An uninitialized memory issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVE-2026-112571 Medium 2026-10-26 Not applicable No public exploit A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVE-2026-114651 Medium 2026-10-22 Not applicable Proof of concept only A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.
CVE-2026-114501 Medium 2026-10-21 Not applicable Proof of concept only Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.
CVE-2026-113340 Medium 2026-10-20 Not applicable No public exploit Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113322 Medium 2026-10-20 Not applicable No public exploit Uninitialized resource in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113304 Medium 2026-10-20 Not applicable No public exploit Uninitialized resource in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113157 Medium 2026-10-20 Not applicable No public exploit Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-109438 Medium 2026-10-14 Not applicable No public exploit 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.
CVE-2026-104086 Medium 2026-10-14 Not applicable No public exploit 7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.
CVE-2026-96850 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.
CVE-2026-96849 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
CVE-2026-96247 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
CVE-2026-96206 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
CVE-2026-85320 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
CVE-2026-83925 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-83755 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
CVE-2026-83723 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
CVE-2026-83714 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.
CVE-2026-83695 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
CVE-2026-70293 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
CVE-2026-70284 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
CVE-2026-70090 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.
CVE-2026-105731 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
CVE-2026-102187 Medium 2026-10-13 Not applicable No public exploit Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-109273 Medium 2026-10-12 Not applicable No public exploit ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.
CVE-2026-107676 Medium 2026-10-08 Not applicable No public exploit FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
CVE-2026-104074 Medium 2026-10-07 Not applicable No public exploit Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which fails to zero-initialize the avalue buffer before computing its length with strlen() and copying leaked stack bytes into the ERROR-CODE reason phrase, exposing pointer fragments that weaken ASLR and enable precise version fingerprinting.
CVE-2026-106395 Medium 2026-10-06 Not applicable No public exploit Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106386 Medium 2026-10-06 Not applicable Proof of concept only Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106379 Medium 2026-10-06 Not applicable No public exploit Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106376 Medium 2026-10-06 Not applicable No public exploit Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106370 Medium 2026-10-06 Not applicable No public exploit Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106290 Medium 2026-10-06 Not applicable No public exploit Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106275 Medium 2026-10-06 Not applicable No public exploit Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106273 Medium 2026-10-06 Not applicable No public exploit Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
‹ prev page 1 of 7 next ›