Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
1480 CVEsRSS
CVE-2026-110141Low· 3.1⚖ disputedObservable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page
Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-110249Medium· 5.3⚖ disputedA malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability …
CVE-2026-93294Medium· 6.3⚖ disputedA user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy)
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Az…
CVE-2026-109740High· 8.8⚖ disputedSandbox escape due to incorrect boundary conditions in the Widget: Win32 component
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109732Medium· 5.4⚖ disputedUse-after-free in the DOM: Streams component
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109729Medium· 5.4⚖ disputedUse-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109727Medium· 5.4⚖ disputedUse-after-free in the Audio/Video component
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109726Medium· 5.4⚖ disputedUse-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109719Medium· 4.2⚖ disputedRace condition, use-after-free in the Graphics: CanvasWebGL component
Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109717Medium· 5.4⚖ disputedUse-after-free in the DOM: Bindings (WebIDL) component
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109714Medium· 5.4⚖ disputedIncorrect boundary conditions in the Layout component
Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109707Critical· 9.6⚖ disputedSandbox escape due to use-after-free in the Networking component
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109706Medium· 5.4⚖ disputedUse-after-free in the Storage: IndexedDB component
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109705Critical· 9.6⚖ disputedSandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109295Medium· 6.5PoC⚖ disputedOpen WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_…
CVE-2026-102554High· 8.2PoC⚖ disputedAllocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing Compac…
CVE-2026-98383High· 7.0⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_da…
In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_da…
CVE-2026-98382High· 7.0⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices __bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices __bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only progr…
CVE-2026-98381High· 7.0⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog
In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the progr…
CVE-2026-98376High· 7.0⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not com…
In the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not com…
CVE-2026-78663Critical· 9.1⚖ disputedThe HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered da…
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered da…
CVE-2026-56857Critical· 9.8⚖ disputedOn Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to o…
CVE-2026-88648High· 7.4⚖ disputedIncomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.
Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.
CVE-2026-67693High· 7.5⚖ disputedAn issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
CVE-2026-95210Critical· 9.1PoC⚖ disputedImproper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.
CVE-2026-107293Medium· 5.3⚖ disputedPydantic AI is a Python agent framework for building applications and workflows with Generative AI
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can exp…
CVE-2026-88647Critical· 9.1PoC⚖ disputedA hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.
CVE-2026-107291Medium· 4.3⚖ disputedPydantic AI is a Python agent framework for building applications and workflows with Generative AI
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can sti…
CVE-2026-107289Medium· 6.8⚖ disputedPydantic AI is a Python agent framework for building applications and workflows with Generative AI
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force…
CVE-2026-105400Medium· 5.3⚖ disputedRejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.