CWE-908
CVEs classified under CWE-908, newest first.
321 CVEsRSS
CVE-2026-113315High· 8.8Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113234High· 8.8Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113252Critical· 9.6Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security sever…
CVE-2026-113324High· 8.8Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113285High· 8.8Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113210High· 8.8Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113332High· 8.8Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113031High· 8.8Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page
Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium se…
CVE-2026-113123High· 8.8Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113304Medium· 6.5Uninitialized resource in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113267High· 8.8Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113340Medium· 6.5Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113200High· 8.8Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113143Medium· 4.3Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113157Medium· 6.5Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113140High· 8.8Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-112897High· 7.5PoCPillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-98743Medium· 5.5kernel: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (CVE-2026-98743)
A flaw was found in the Linux kernel's rt1017 SDCA audio codec driver. The driver fails to initialize stream configuration data before passing it to the sound subsystem, leaving configuration fields populated with uninitialized memory. A l…
CVE-2026-98744Medium· 5.5kernel: ASoC: codecs: max98363: fix uninitialized stream_config->type (CVE-2026-98744)
A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows unin…
CVE-2026-98755Low· 3.3tty: vcc: zero-initialize control packet in vcc_send_ctl()
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl() The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitiali…
CVE-2026-98771Low· 3.3usb: storage: sierra_ms: reject short SWoC info transfers
In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra_ms: reject short SWoC info transfers sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), bu…
CVE-2026-98843Medium· 4.4kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data (CVE-2026-98843)
A flaw was found in the Linux kernel's Network Filesystem (netfs) subsystem. When reading data gaps around modified memory regions during streaming write operations, truncated or incomplete read responses from a remote server fail to clear…
CVE-2026-98844Low· 3.3kernel: netfs: clear post-EOF pagecache when extending a file via write (CVE-2026-98844)
A flaw was found in the Linux kernel's network filesystem (netfs) subsystem. When a file is extended through write operations after previous writes were performed via memory mapping, the system fails to clear stale cache data located beyon…
CVE-2026-98860Low· 1.9kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (CVE-2026-98860)
A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem. This flaw can lead to information disclosure when hardware communication errors occur. Due to an improper integer comparison in the Berkeley Packet Filter (BPF)…
CVE-2026-98551Low· 3.3kernel: perf/core: Fill branch entries with a single assignment (CVE-2026-98551)
A flaw was found in the Linux kernel's Performance Events (perf) subsystem on ARM64 architectures. This flaw allows a local user to cause an information disclosure of sensitive kernel memory. The issue occurs because certain branch trackin…
CVE-2026-98584Low· 3.3kernel: net/sched: fix potential stack infoleak in em_text_dump() (CVE-2026-98584)
A flaw was found in the Linux kernel's network traffic control subsystem. A local user can exploit this vulnerability to cause an information disclosure of kernel stack data. When dumping text search filter configurations, the kernel fails…
CVE-2026-109438Medium· 5.33proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-…
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-…
CVE-2026-97629Medium· 6.5PoCDescription When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticate…
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticate…
CVE-2026-98413Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return …
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return …
CVE-2026-98387Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipher_walk return code handling in aes_s390 The return codes from skcipher_walk_virt() were not properly checked before entering the processing loo…
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipher_walk return code handling in aes_s390 The return codes from skcipher_walk_virt() were not properly checked before entering the processing loo…