SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources.
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10.
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.
CVE-2026-120754 is a low-severity vulnerability in The HDF Group's Scale-Offset Filter (HDF5 through version 2.2.0) that allows an uninitialized memory read. The flaw occurs because the decode path validates reads against the allocated chunk buffer size rather than the actual bytes read, potentially exposing unrelated heap contents when reading crafted HDF5 files. This issue is due to an incomplete fix for a previous vulnerability (CVE-2026-19029). A fix is available in version 2.3.0.
CVE-2026-114651 is a vulnerability in the BSON deserialization component of the MongoDB C# Driver. It involves a memory-handling weakness where uninitialized data from previous operations may be returned when parsing specially crafted serialized input. This can lead to limited disclosure of information from other requests or users without requiring authentication or special privileges. The issue affects versions from 2.26.0 up to but not including 3.13.0 and is fixed in version 3.13.0.
A vulnerability in the python-pillow Pillow library versions 11.2.1 through 12.x allows sensitive memory contents to be disclosed when exporting images to Arrow format with certain alignment configurations. This occurs because the export process assumes tightly contiguous image rows and may include uninitialized or stale memory in the output buffer. The issue is fixed in version 13.0.0.
A use of uninitialized resource vulnerability exists in the python-pillow Pillow library versions 5.3.0 through 12.x. Pillow can return uninitialized memory as pixel data when decoding certain JPEG-compressed or Group 4 fax TIFF images. This occurs because the decoding buffers may be larger than the data written by libtiff, and the unwritten buffer tail is not cleared. An attacker can exploit this by supplying a crafted TIFF file to disclose stale heap memory contents. The issue is fixed in Pillow version 13.0.0.
CVE-2026-97629 is a vulnerability in F5 NGINX Plus and NGINX Open Source related to the use of uninitialized resources when configured with ssl_session_cache without explicit ssl_session_ticket_key rotation. This flaw allows a remote unauthenticated attacker to forge client SSL sessions unpredictably, potentially bypassing client certificate verification. The issue affects certain versions of NGINX Plus and Open Source prior to fixed releases. The vulnerability impacts the data plane only and does not expose the control plane. It has a medium severity rating with a CVSS score of 6.5.