CWE-226 · Information Disclosure
Sensitive Information in Resource Not Removed Before Reuse
41CVEs
SortMost likely exploited
41 CVEs with CWE-226 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-27218In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests fr…The Eclipse Foundation · Eclipse Jetty · 2020-11-28 | – | 8.3% | 2020-11-28 |
| CVE-2018-7166In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only r…The Node.js Project · Node.js · 2018-08-21 | – | 3.3% | 2018-08-21 |
| CVE-2022-39393Wasmtime vulnerable to data leakage between instances in the pooling allocatorbytecodealliance · wasmtime · CVSS 8.6 · 2022-11-10 | 8.6 | 0.9% | 2022-11-10 |
| CVE-2024-32036SixLabors.ImageSharp vulnerable to data leakageSixLabors · ImageSharp · CVSS 5.3 · 2024-04-15 | 5.3 | 0.6% | 2024-04-15 |
| CVE-2026-5795In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are condition…Eclipse Foundation · Eclipse Jetty · CVSS 7.4 · 2026-04-08 | 7.4 | 0.5% | 2026-04-08 |
| CVE-2019-25560Lyric Video Creator 2.1 Denial of Service via MP3 FileLyricvideocreator · Lyric Video Creator · CVSS 7.5 · 2026-03-21 | 7.5 | 0.5% | 2026-03-21 |
| CVE-2024-7883CMSE secure state may leak from stack to floating-point registersArm Ltd · Arm Compiler for Embedded · CVSS 3.7 · 2024-10-31 | 3.7 | 0.5% | 2024-10-31 |
| CVE-2024-38275moodle: HTTP authorization header is preserved between "emulated redirects"Moodle · Moodle · CVSS 7.5 · 2024-06-18 | 7.5 | 0.4% | 2024-06-18 |
| CVE-2026-74791Scriban before 7.0.0 Authorization Bypass via Stale Include Cachescriban · scriban · CVSS 8.6 · 2026-08-16 | 8.6 | 0.4% | 2026-08-16 |
| CVE-2026-114366Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Frameworkqt · Qt Framework · CVSS 2.3 · 2026-11-06 | 2.3 | 0.4% | 2026-11-06 |
| CVE-2026-114501Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1python-pillow · Pillow · CVSS 6.3 · 2026-10-21 | 6.3 | 0.4% | 2026-10-21 |
| CVE-2025-11602Untargeted information leak in Bolt protocol handshakeneo4j · Enterprise Edition · CVSS 6.3 · 2025-10-31 | 6.3 | 0.3% | 2025-10-31 |
| CVE-2026-119179MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's dataMongoDB · Node.js Driver · CVSS 7 · 2026-11-03 | 7.0 | 0.3% | 2026-11-03 |
| CVE-2026-74250In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.OpenStack · Ironic · CVSS 6.3 · 2026-08-14 | 6.3 | 0.3% | 2026-08-14 |
| CVE-2026-106111ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflateSixLabors · ImageSharp · CVSS 5.9 · 2026-10-06 | 5.9 | 0.3% | 2026-10-06 |
| CVE-2019-1573Information Disclosure in GlobalProtect AgentPalo Alto Networks · GlobalProtect Agent · CVSS 2.5 · 2019-04-09 | 2.5 | 0.3% | 2019-04-09 |
| CVE-2025-2522Lack of buffer clearing before reuse may result in incorrect system behavior.Honeywell · C300 PCNT02 · CVSS 6.5 · 2025-07-10 | 6.5 | 0.3% | 2025-07-10 |
| CVE-2023-3006A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v…Linux · Kernel · CVSS 5.5 · 2023-05-31 | 5.5 | 0.3% | 2023-05-31 |
| CVE-2026-32960SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse. An attacker may login to the device…silex technology, Inc. · SD-330AC · CVSS 6.5 · 2026-04-20 | 6.5 | 0.3% | 2026-04-20 |
| CVE-2023-1637A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the…Linux · Kernel · CVSS 5.5 · 2023-03-27 | 5.5 | 0.2% | 2023-03-27 |
| CVE-2025-13108Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsIBM · DB2 Merge Backup for Linux, UNIX and Windows · CVSS 5.5 · 2026-02-17 | 5.5 | 0.2% | 2026-02-17 |
| CVE-2026-107315pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)pgjdbc · pgjdbc · CVSS 5.3 · 2026-10-07 | 5.3 | 0.2% | 2026-10-07 |
| CVE-2024-21850Sensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version 1.5.02.00 may allow a privileged user to potentially enable…Intel(R) TDX Seamldr module software · CVSS 6 · 2024-11-13 | 6.0 | 0.2% | 2024-11-13 |
| CVE-2019-25657AnyBurn 4.3 x86 Denial of Service via Image ConversionAnyburn · AnyBurn x86 · CVSS 5.5 · 2026-04-05 | 5.5 | 0.2% | 2026-04-05 |
| CVE-2023-41138The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process.AppsAnywhere · AppsAnywhere Client · CVSS 7.5 · 2023-11-09 | 7.5 | 0.2% | 2023-11-09 |
| CVE-2019-25571MediaMonkey 4.1.23 Denial of Service via Malformed URLMediamonkey · MediaMonkey · CVSS 6.2 · 2026-03-21 | 6.2 | 0.2% | 2026-03-21 |
| CVE-2019-25563PCHelpWareV2 1.0.0.5 Denial of Service via SC CreationUvnc · PCHelpWareV2 · CVSS 6.2 · 2026-03-21 | 6.2 | 0.2% | 2026-03-21 |
| CVE-2019-25645WinAVI iPod 3GP MP4 PSP Converter 4.4.2 Denial of ServiceWinavi · WinAVI iPod/3GP/MP4/PSP Converter · CVSS 6.2 · 2026-03-24 | 6.2 | 0.2% | 2026-03-24 |
| CVE-2019-25553CEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed ImageCewe-Photoworld · CEWE PHOTO IMPORTER · CVSS 6.2 · 2026-03-21 | 6.2 | 0.2% | 2026-03-21 |
| CVE-2025-0647In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another…Arm · Neoverse-N2 · CVSS 7.9 · 2026-01-14 | 7.9 | 0.2% | 2026-01-14 |
| CVE-2025-33196NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to i…NVIDIA · DGX Spark · CVSS 4.4 · 2025-11-25 | 4.4 | 0.1% | 2025-11-25 |
| CVE-2025-33200NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to i…NVIDIA · DGX Spark · CVSS 2.3 · 2025-11-25 | 2.3 | 0.1% | 2025-11-25 |
| CVE-2025-33198NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to i…NVIDIA · DGX Spark · CVSS 3.3 · 2025-11-25 | 3.3 | 0.1% | 2025-11-25 |
| CVE-2025-20622Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 within Ring 3: User Applications may al…Intel(R) NPU Drivers for Windows · CVSS 3.8 · 2025-11-11 | 3.8 | 0.1% | 2025-11-11 |
| CVE-2019-25617Ease Audio Converter 5.30 Denial of Service via Audio CutterAudiotool · Ease Audio Converter · CVSS 6.2 · 2026-03-22 | 6.2 | 0.1% | 2026-03-22 |
| CVE-2026-18023Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a craft…ASUS · Armoury Crate · CVSS 5.7 · 2026-09-08 | 5.7 | 0.1% | 2026-09-08 |
| CVE-2025-14858Semtech LR11xx Encrypted Firmware DisclosureSemtech · LR1110 · CVSS 5.1 · 2026-04-07 | 5.1 | 0.1% | 2026-04-07 |
| CVE-2025-48066wire-webapp has no database deletion on client logoutwireapp · wire-webapp · CVSS 6 · 2025-05-22 | 6.0 | 0.1% | 2025-05-22 |
| CVE-2026-61377Sensitive information uncleared in resource before release for reuse in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an inform…Intel(R) TDX Migration Trust Domain (MigTD) · CVSS 6.8 · 2026-11-10 | 6.8 | 0.1% | 2026-11-10 |
| CVE-2026-128091AES key schedule not cleared by the TinyCrypt AES-CTR backend in MCUboot bootutilmcu-tools · mcuboot · CVSS 2 · 2026-11-13 | 2.0 | 0.1% | 2026-11-13 |
| CVE-2026-127928AES image key left on the stack after serial-recovery encrypted-image handling in MCUbootmcu-tools · mcuboot · CVSS 2 · 2026-11-13 | 2.0 | 0.1% | 2026-11-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.