Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
34 matching advisories · 30 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
low2.4
CVE-2026-16662

Uninitialised bootloader stack disclosed into the measured-boot attestation record via a short EXPECTED_HASH TLV in MCUboot

boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) and then reads exactly len bytes, so a TLV shorter than IMAGE_HASH_SIZE leaves the tail of image_hash holding stale stack content. The subsequent copy into the boot record, memcpy(buf + offset, image_hash, sizeof(image_hash)), uses the fixed buffer size rather than len, so up to IMAGE_HASH_SIZE - 1 bytes of uninitialised bootloader stack are written into the measured-boot record.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

mcu-tools · mcuboot
medium5.3
CVE-2026-46676

BACnet Stack: Uninitialized Value Use in AtomicReadFile-ACK Record-Access Encoder Causes Response Corruption and Conditional Information Disclosure

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, an uninitialized value use vulnerability in bacnet-stack's AtomicReadFile record-access ACK encoder allows unauthenticated remote attackers to corrupt the encoded OCTET STRING length and payload boundary in network responses by sending a crafted AtomicReadFile request that reaches a successful record-access path. This issue has been patched in versions 1.4.4 and 1.5.1.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

bacnet-stack · bacnet-stack
high7.5
CVE-2026-126915

Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer…

Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
low2.3
CVE-2026-58810

In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to non-secure callers due to…

In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to non-secure callers due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Android
unknown
CVE-2026-88822

QUIC Uses Uninitialized Stack Bytes During Automated Peer Detection

Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenSSL · OpenSSL
medium6.5
CVE-2026-121611

Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loop

A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Enterprise Linux 10 / Red Hat · Red Hat Enterprise Linux 7
low2.4
CVE-2026-85068

NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

networkupstools · nut
medium6.9
CVE-2026-54913

WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

bytecodealliance · wasm-micro-runtime
medium6.9
CVE-2026-118448

Uninitialized output buffer returned after nd_to_text failure in pybddisasm

A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Bitdefender · pybddisasm
medium4.8
CVE-2026-118447

Uninitialized INSTRUX contents returned after decoding failure in pybddisasm

A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Bitdefender · pybddisasm
high7.5
CVE-2026-120061

psqlODBC ODBC escape parser stack buffer overflow

The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

PostgreSQL · psqlODBC
medium6.8
CVE-2026-120246

FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

FFmpeg · FFmpeg
medium6.8
CVE-2026-120243

FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

FFmpeg · FFmpeg
high8.1
CVE-2026-117952

Uninitialized memory in the Networking component

Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Mozilla · Firefox / Mozilla · Thunderbird
medium5.4
CVE-2026-117888

Uninitialized memory in the Graphics: Canvas2D component

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Mozilla · Firefox / Mozilla · Thunderbird
high8.8
CVE-2026-113100

Use of uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a…

Use of uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
high8.8
CVE-2026-113030

Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a…

Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Google · Chrome
high8.8
CVE-2026-113120

Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a…

Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
high8.8
CVE-2026-113028

Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a…

Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
medium6.9
CVE-2026-112898

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

python-pillow · Pillow
high8.2
CVE-2026-112893

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

python-pillow · Pillow
low2.5
CVE-2026-109854

M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Red Hat · Red Hat Enterprise Linux 10 / Red Hat · Red Hat Enterprise Linux 6
medium5.5
CVE-2026-65405

A memory initialization issue was addressed with improved memory handling.

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to determine kernel memory layout.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apple · iOS and iPadOS / Apple · macOS
medium4.3
CVE-2026-84564

An uninitialized memory issue was addressed with improved memory initialization.

An uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may result in disclosure of process memory.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apple · iOS and iPadOS / Apple · macOS
high7.0
CVE-2026-64413

netfilter: ebtables: zero chainstack array

In the Linux kernel, the following vulnerability has been resolved:

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Linux · Linux / Linux · Linux
high7.8
CVE-2026-43303

mm/page_alloc: clear page->private in free_pages_prepare()

In the Linux kernel, the following vulnerability has been resolved:

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Linux · Linux / Linux · Linux
medium5.7
CVE-2025-13763

Libopensc: opensc: multiple uses of uninitialized variable

Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Public exploit reference

OpenSC · OpenSC / Red Hat · Red Hat Enterprise Linux 10
high7.5
CVE-2026-23003

ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

In the Linux kernel, the following vulnerability has been resolved:

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Linux · Linux / Linux · Linux
medium6.5
CVE-2024-9355

Golang-fips: golang fips zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

github.com/golang-fips/openssl / Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support