CVE-2024-50302Medium· 5.5▾ Midnight⚠ Exploited in the wildPoC availableIn the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to mak…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 30.3 · likelihood 0.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Mar 25, 2025
Last analysed / modified upstream
0.8%
Exploit / PoC code exists
Added to the CISA catalog on Mar 4, 2025. Federal remediation due Mar 25, 2025. View catalog ↗
In the Linux kernel, the following vulnerability has been resolved:
HID: core: zero-initialize the report buffer
Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
androiddebian_linux = 11.0simatic_s7-1500_tm_mfp_firmwaresinec_os < 3.2linux_kernel >= 3.12, < 4.19.324linux_kernel >= 4.20, < 5.4.286linux_kernel >= 5.5, < 5.10.230linux_kernel >= 5.11, < 5.15.172linux_kernel >= 5.16, < 6.1.117linux_kernel >= 6.2, < 6.6.61linux_kernel >= 6.7, < 6.11.8linux_kernel = 6.12Upgrade past the affected range:
sinec_os 3.2linux_kernel 6.11.8Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106386Medium· 6.5Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page
CVE-2026-0014Medium· 6.2In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation
CVE-2026-0010High· 8.4In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check
CVE-2026-55330Critical· 9.8In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code
CVE-2026-106376Medium· 4.7Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
CVE-2026-106379Medium· 4.3Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page