Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
1475 CVEsRSS
CVE-2026-98501Medium· 5.1⚖ disputedkernel: HID: alps: fix use-after-free on input2 registration failure (CVE-2026-98501)
A flaw was found in the Linux kernel's Alps Human Interface Device (HID) driver. If registration of an input device fails during configuration, the driver frees the device memory while communication channels are already active, leaving a d…
CVE-2026-98507Medium· 4.7⚖ disputedkernel: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish (CVE-2026-98507)
A flaw was found in the Linux kernel's memory management subsystem. Due to a missing synchronization barrier when preparing anonymous virtual memory areas, concurrent memory operations can be reordered. A local attacker can exploit this ra…
CVE-2026-98510Medium· 4.7⚖ disputedkernel: drm/xe/vm: nuke PTs only after unlinking contested VMAs (CVE-2026-98510)
A flaw was found in the Linux kernel's Intel Xe graphics driver. When closing a GPU virtual memory space, page tables were destroyed before contested virtual memory areas were properly unlinked from shared buffer objects. A concurrent thre…
CVE-2026-98517Medium· 5.5⚖ disputedkernel: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (CVE-2026-98517)
A flaw was found in the Linux kernel's Nouveau graphics driver. When handling buffer objects in system memory, the driver improperly accesses memory past the allocated resource boundary. A local attacker could exploit this flaw to cause a …
CVE-2026-98515Medium· 4.7⚖ disputedkernel: drm/nouveau: fix double-free in nvif_vmm_dtor (CVE-2026-98515)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by crashing the system or potentially escalate privileges. During device initialization failures,…
CVE-2026-98520Medium· 4.7⚖ disputedkernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping (CVE-2026-98520)
A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent…
CVE-2026-98543Medium· 4.1⚖ disputedkernel: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir (CVE-2026-98543)
A flaw was found in the Linux kernel. A local privileged user could cause a Denial of Service (DoS) or file system corruption due to improper locking in the BPF (Berkeley Packet Filter) subsystem. When attaching sleepable BPF programs to c…
CVE-2026-98549Medium· 4.8⚖ disputedkernel: tcp: prevent collapsing skbs across boundary in rtx queue (CVE-2026-98549)
A flaw was found in the Linux kernel's TCP subsystem. When a TCP connection transitions to hardware-assisted encryption, data packets queued after the transition can be improperly merged with unencrypted packets in the retransmission queue…
CVE-2026-98548High· 7.5⚖ disputedkernel: sctp: discard the rest of the packet on a stale-cookie error (CVE-2026-98548)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service (DoS) or memory corruption by sending specially crafted pa…
CVE-2026-98555Medium· 4.7⚖ disputedkernel: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (CVE-2026-98555)
A flaw was found in the Linux kernel's Logical Link Control (LLC) subsystem. When an error occurs during network packet header initialization, the kernel mistakenly frees the incorrect memory buffer, resulting in a use-after-free condition…
CVE-2026-110755High· 7.5⚖ disputedText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR…
CVE-2026-110753Critical· 9.8⚖ disputedText::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar witho…
CVE-2026-110759Critical· 9.8⚖ disputedText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the i…
CVE-2026-110756Critical· 9.8⚖ disputedText::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that…
CVE-2026-110757Critical· 9.8⚖ disputedText::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric fla…
CVE-2026-46472Low· 3.3⚖ disputedgstreamer1-plugins-good: gstreamer1-plugins-good: Information disclosure via out-of-bounds read in qtdemux_parse_chnl (CVE-2026-46472)
A flaw was found in gstreamer1-plugins-good. When processing a crafted MP4 media file, the isomp4 plugin's qtdemux_parse_chnl function can read past the boundary of a global array. A remote attacker could exploit this vulnerability by enti…
CVE-2026-88753High· 7.5PoC⚖ disputedA Regular-Expression Denial of Service (ReDoS) in the Markdown2
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.
CVE-2026-98432Medium· 5.9⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without…
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without…
CVE-2026-76184High· 8.2PoC⚖ disputedIn Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normal…
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normal…
CVE-2026-110868High· 8.5⚖ disputedRenovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an in…
CVE-2026-94200High· 8.2⚖ disputedImproper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application …
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application …
CVE-2026-100169High· 7.6⚖ disputedImproper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, b…
Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, b…
CVE-2026-98401High· 7.0⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale transport_header offset af…
In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale transport_header offset af…
CVE-2026-110170Medium· 4.3⚖ disputedUse after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110160Medium· 4.2⚖ disputedMissing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page…
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page…
CVE-2026-110150Medium· 5.5⚖ disputedPrivilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program
Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: High)
CVE-2026-110146Medium· 6.5⚖ disputedInformation leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110143Medium· 4.3⚖ disputedUse of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file
Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)
CVE-2026-110142Critical· 9.6⚖ disputedUse after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-110141Low· 3.1⚖ disputedObservable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page
Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)