CVE-2026-7639None▾ SunlitSoftware installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
0.1% → 0.2%
Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code.
Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-11576High· 7.5The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file …
CVE-2026-116132NoneHTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk
CVE-2026-77761NoneA parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reus…
CVE-2026-115478High· 7.1obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
CVE-2026-113658High· 7.5ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
CVE-2026-88041Lowtomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup (CVE-2026-88041)