https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T12:30:00.241354+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-103436 fkie_cve-2026-103436 2026-10-17T12:30:00.244478+00:00

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.

 https://db.gcve.eu/vuln/ghsa-8jv2-xm7v-55rg GHSA-8jv2-xm7v-55rg 2026-10-17T12:30:00.244532+00:00

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-103436 UBUNTU-CVE-2026-103436 2026-10-17T12:30:00.244552+00:00

Affected: Ubuntu:16.04:LTS: apcupsd, Ubuntu:18.04:LTS: apcupsd, Ubuntu:20.04:LTS: apcupsd, Ubuntu:22.04:LTS: apcupsd, Ubuntu:24.04:LTS: apcupsd, Ubuntu:26.04:LTS: apcupsd

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.