CWE-226
CWE-226 · 5 records · 3 with a public proof-of-concept
Records the NVD classes under CWE-226, highest CVSS first.
- HIGH 7CVE-2026-119179
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation t…
- MEDIUM 5.9CVE-2026-106111public PoC
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix …
- MEDIUM 5.3CVE-2026-114501public PoC
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before …
pillow
- MEDIUM 5.3CVE-2026-107315public PoC
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the dr…
- UNSCOREDCVE-2026-114366
An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.