gimp: GIMP: Remote Code Execution via uninitialized memory in PGM file parsing

A flaw was found in GIMP. This uninitialized memory vulnerability allows a remote attacker to execute arbitrary code on affected installations. Successful exploitation requires user interaction, where the target must open a specially crafted PGM Portable Graymap image file. This can lead to...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::IDnsResource::decodeName

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=6299230322098176 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

AlmaLinux 8 : glibc (ALSA-2026:4772)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4772 advisory. glibc: glibc: Information disclosure via zero-valued network query CVE-2026-0915 glibc: wordexp with WRDEREUSE and WRDEAPPEND may return uninitialized...

Linux Distros Unpatched Vulnerability : CVE-2026-4147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

RHEL 8 : gimp:2.8 (RHSA-2026:5113)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:5113 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

SOLIDWORKS eDrawings 2025 / 2026 SP0Multiple Vulnerabilities

The version of SOLIDWORKS eDrawings installed on the remote host is 2025 through 2026 SP0. It is, therefore, affected by multiple vulnerabilities: - A Heap-based Buffer Overflow vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file...

SUSE-SU-2026:20903-1 Security update for libjxl

This update for libjxl fixes the following issues: Update to libjxl 0.11.2: - CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory bsc1258090. - CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to...

The vulnerability of the qla_nvme_ls_req() function in the drivers/scsi/qla2xxx/qla_nvme.c module of the Linux operating system’s SCSI device driver allows a hacker to cause a service failure.

The vulnerability of the qlanvmelsreq function in the drivers/scsi/qla2xxx/qlanvme.c module of the Linux SCSI device driver is related to the pointer dereferencing that occurs during the attempt to start an uninitialized queue, whose functionality has been removed. Exploiting this vulnerability c...

imagemagick:encoder_ptif_fuzzer: Use-of-uninitialized-value in GetImageRange

Detailed Report: https://oss-fuzz.com/testcase?key=5598138047201280 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderptiffuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: GetImageRange WriteTIFFImage...

AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

Summary The install/checkConfiguration.php endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized...

GHSA-2F9H-23F7-8GCX AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

Summary The install/checkConfiguration.php endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized...

Missing Authentication for Critical Function

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the checkConfiguration.php process. An attacker can gain full administrative control and manipulate the application...

EUVD-2026-12586

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory

A flaw was found in glibc. When the wordexp function is called with the flags WRDEREUSE and WRDEAPPEND, it may return uninitialized memory. If the caller inspects the wewordv array or calls the wordfree function to free the allocated memory, the process will abort, resulting in a denial of servic...

CVE-2026-4147

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

UBUNTU-CVE-2026-4147

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

CVE-2026-4147

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

CVE-2026-4147

The CVE-2026-4147 entry describes an issue where an authenticated user with the read role can read limited amounts of uninitialized stack memory through specially crafted issuances of the filemd5 command. Root cause: exposure of uninitialized stack memory during filemd5 handling. Impact: potentia...

Stack memory disclosure in filemd5 command

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

mpv:fuzzer_loadfile: Use-of-uninitialized-value in ff_hNUMBER_sei_message_decode

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=6400061390258176 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerloadfile Job Type: libfuzzermsanmpv Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...