CWE-226: Sensitive Information in Resource Not Removed Before Reuse
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
A kind of CWE-459 Incomplete Cleanup.
From the CWE List. © The MITRE Corporation.
Newest
- qt framework Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework 2.3 Low
- mongodb node.js driver MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data 8.3 High
- python pillow Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 6.3 Medium
- pgjdbc pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros) 5.3 Medium
- sixlabors imagesharp ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate 5.9 Medium
- sveltejs devalue devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers 7.5 High
- asus armoury crate Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a... 5.7 Medium
- openstack ironic In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning... 6.3 Medium
- asus business manager, system control interface, business manager manager +1 more +3 more Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not... 8.2 High
- mcdope pam usb pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap 4.7 Medium
- struktur libheif libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation 7.5 High
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 more SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive... 7.1 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, build of apache camel 4.18.1 for spring boot 3.5.14 +6 more +8 more Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables 7.4 High
- semtech lr1110, lr1120, lr1121 +2 more Semtech LR11xx Encrypted Firmware Disclosure 5.1 Medium
- anyburn, anyburn x86 +1 more AnyBurn 4.3 x86 Denial of Service via Image Conversion 6.8 Medium
- openclaw OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint 7.2 High
- scriban Scriban before 7.0.0 Authorization Bypass via Stale Include Cache 9.2 Critical
- winavi ipod/3gp/mp4/psp converter WinAVI iPod 3GP MP4 PSP Converter 4.4.2 Denial of Service 6.9 Medium
- audiotool ease audio converter Ease Audio Converter 5.30 Denial of Service via Audio Cutter 6.9 Medium
- mediamonkey MediaMonkey 4.1.23 Denial of Service via Malformed URL 6.9 Medium
- uvnc pchelpwarev2 PCHelpWareV2 1.0.0.5 Denial of Service via SC Creation 6.9 Medium
- lyricvideocreator lyric video creator Lyric Video Creator 2.1 Denial of Service via MP3 File 8.7 High
- cewe photo importer, cewe-photoworld cewe photo importer +1 more CEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed Image 6.9 Medium
- ibm db2 merge backup for linux, unix and windows, db2 merge backup +1 more Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows 5.5 Medium
- arm c1-premium, c1-premium firmware, c1-ultra +19 more +21 more In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit... 7.9 High
- nvidia dgx spark, dgx os +1 more NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a... 2.3 Low
- nvidia dgx spark, dgx os +1 more NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a... 3.3 Low
- nvidia dgx spark, dgx os +1 more NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a... 4.4 Medium
- No product listed Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU... 2.0 Low
- neo4j community edition, enterprise edition +1 more Untargeted information leak in Bolt protocol handshake 6.3 Medium
- honeywell c200e, c300pm, cn100 +7 more +9 more Lack of buffer clearing before reuse may result in incorrect system behavior. 6.5 Medium
- wire wire-webapp wire-webapp has no database deletion on client logout 6.0 Medium
- intel tdx module software Sensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module... 8.3 High
- arm compiler for embedded, compiler for embedded fusa, compiler for functional safety +4 more +6 more CMSE secure state may leak from stack to floating-point registers 3.7 Low
- moodle moodle: HTTP authorization header is preserved between "emulated redirects" 7.5 High
- sixlabors imagesharp SixLabors.ImageSharp vulnerable to data leakage 5.3 Medium
- appsanywhere client The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands... 7.5 High
- linux kernel A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB,... 5.5 Medium
- linux kernel A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks... 5.5 Medium
- bytecodealliance wasmtime Wasmtime vulnerable to data leakage between instances in the pooling allocator 8.6 High
- eclipse jetty, the eclipse foundation eclipse jetty, apache kafka +15 more +17 more Buffer not correctly recycled in Gzip Request inflation 4.8 Medium
- palo alto networks globalprotect agent, paloaltonetworks globalprotect +1 more Information Disclosure in GlobalProtect Agent 2.5 Low
- node.js In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer... 7.5 High