Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
1475 CVEsRSS
CVE-2026-114617Medium· 4.2⚖ disputedAuthlib: ID token can disable its own nonce validation via the nonce_supported claim
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-115897Low· 2.1⚖ disputedSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-in…
CVE-2026-98870Medium· 6.5⚖ disputedkernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active s…
CVE-2026-55889Medium· 5.3⚖ disputedxdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation (CVE-2026-55889)
A flaw was found in xdg-desktop-portal. The service uses a predictable pseudorandom number generator (PRNG) to generate authorization tokens that manage access to shared system resources. By requesting enough tokens to determine the intern…
CVE-2026-91403Critical· 9.1PoC⚖ disputedVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21…
CVE-2026-114127Medium· 5.4⚖ disputedastro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
A flaw was found in Astro. Its server-side View Transition stylesheet generator fails to properly sanitize animation properties when creating transition styles. A remote attacker able to supply input to these properties can inject arbitrar…
CVE-2026-113310Medium· 6.5⚖ disputedOut of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113295High· 8.8⚖ disputedchromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-113295)
An out of bounds read flaw was found in the ANGLE component of the Chromium browser. Upstream bug(s): https://issues.chromium.org/issues/568897206
CVE-2026-113102Medium· 6.5⚖ disputedOut of bounds read in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113035Medium· 6.5⚖ disputedOut of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
Out of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113070Medium· 6.5⚖ disputedOut of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113045Medium· 6.5⚖ disputedOut of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113010Medium· 6.5PoC⚖ disputedOut of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113329Medium· 6.5⚖ disputedOut of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113277Medium· 6.5⚖ disputedOut of bounds read in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113054Medium· 6.5⚖ disputedOut of bounds read in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113151Medium· 6.5⚖ disputedOut of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113050Medium· 6.5⚖ disputedOut of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Out of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113201Medium· 6.5⚖ disputedMemory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-101356Medium· 5.3⚖ disputedtomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing (CVE-2026-101356)
A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vul…
CVE-2026-103119Medium· 4.8⚖ disputedtomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes (CVE-2026-103119)
A flaw was found in Apache Tomcat. During large non-blocking write operations, a buffer under-read can cause an HTTP response body to be split between the current request and the subsequent request handled on the same connection. A remote …
CVE-2025-52290Medium· 5.5⚖ disputedffmpeg: ffmpeg: Denial of Service via crafted media file (CVE-2025-52290)
A flaw was found in ffmpeg. An attacker could exploit this vulnerability by providing a crafted media file to be processed by the application. This issue triggers a NULL pointer dereference in the avpriv_h264_has_num_reorder_frames functio…
CVE-2026-111755Medium· 5.9PoC⚖ disputedfollow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering (CVE-2026…
A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containi…
CVE-2026-98441Medium· 4.7⚖ disputedkernel: net/sched: act_ct: avoid modifying shared unconfirmed ct entry (CVE-2026-98441)
A flaw was found in the Linux kernel's traffic control conntrack action module (act_ct). An attacker capable of sending network traffic through affected packet filters could trigger a Denial of Service (DoS) or kernel memory corruption. Th…
CVE-2026-98443Medium· 4.4⚖ disputedkernel: xfs: fix cursor and pointer handling when recovering iunlink buckets (CVE-2026-98443)
A flaw was found in the Linux kernel's XFS file system. Improper pointer handling during the recovery of unlinked files can cause a use-after-free condition, where the operating system attempts to access memory after it has already been fr…
CVE-2026-98451Low· 3.3⚖ disputedkernel: smb: client: use finish_no_open() for non-regular inodes (CVE-2026-98451)
A flaw was found in the Linux kernel's SMB client. A local user can trigger this issue by opening an existing symbolic link or non-regular file on an SMB mount using file creation flags. Because the client improperly handles non-regular fi…
CVE-2026-98456Medium· 4.1⚖ disputedkernel: Bluetooth: mgmt: fix race in read_unconf_index_list() (CVE-2026-98456)
A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the read_unconf_index_list() function allows a local user to cause an out-of-bounds write during asynchronous controller setup. This issue occurs when device s…
CVE-2026-98464Medium· 5.6⚖ disputedkernel: RISC-V: KVM: Synchronize hrtimer callback during teardown (CVE-2026-98464)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for the RISC-V architecture. This vulnerability can lead to a Denial of Service (DoS) or host system crash due to a use-after-free memory issue during…
CVE-2026-98490High· 7.5⚖ disputedkernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc (CVE-2026-98490)
A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations lis…
CVE-2026-98487Medium· 5.5⚖ disputedkernel: net: bridge: mdb: restart port group walk after deletion (CVE-2026-98487)
A flaw was found in the Linux kernel's network bridge subsystem. When deleting multicast database (MDB) port groups, the kernel can maintain a stale reference to memory that has already been freed during recursive group removal, resulting …