CVE-2026-45798 | High | 7.5 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions()… |
CVE-2026-44452 | Medium | 5.9 | 2026-07-16 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it co… |
CVE-2026-12386 | Low | 3.9 | 2026-07-05 | Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers.
This issue affects Pard… |
CVE-2026-55738 | High | 8.8 | 2026-06-17 | A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname… |
CVE-2026-5067 | Critical | 9.8 | 2026-06-09 | A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header… |
CVE-2026-8721 | Critical | 9.8 | 2026-05-17 | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs.
Password parameters in PKCS12.xs are declared char *, which rou… |
CVE-2026-42010 | High | 7.1 | 2026-05-07 | A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character wi… |
CVE-2026-34464 | High | 8.8 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server f… |
CVE-2026-34462 | High | 7.8 | 2026-05-05 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler… |
CVE-2026-34032 | Medium | 5.3 | 2026-05-04 | Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommend… |
CVE-2026-40334 | Low | 3.5 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs… |
CVE-2026-33948 | Medium | 5.3 | 2026-04-14 | jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation… |
CVE-2026-2239 | Low | 2.8 | 2026-03-26 | A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing a specially crafted PSD (Photoshop Docu… |
CVE-2026-32837 | Medium | 4.0 | 2026-03-17 | miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser th… |
CVE-2026-23749 | Low | 2.9 | 2026-02-26 | Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise tr… |
CVE-2026-27692 | High | 7.1 | 2026-02-25 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read… |
CVE-2025-67733 | High | 8.5 | 2026-02-23 | Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary… |
CVE-2026-24852 | Medium | 6.1 | 2026-01-28 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21488 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, H… |
CVE-2025-2026 | | | 2025-12-31 | The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection thr… |
CVE-2025-67790 | High | 7.5 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Scree… |
CVE-2025-66220 | Medium | 5.0 | 2025-12-03 | Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subje… |
CVE-2025-62792 | High | 7.5 | 2025-10-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match(… |
CVE-2025-61912 | Medium | 5.3 | 2025-10-10 | python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorre… |
CVE-2024-31197 | Medium | 5.3 | 2024-09-18 | Improper Null Termination vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routi… |
CVE-2024-43474 | High | 7.6 | 2024-09-10 | Microsoft SQL Server Information Disclosure Vulnerability |
CVE-2024-45288 | High | 8.4 | 2024-09-05 | A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer. |
CVE-2024-31484 | High | 7.8 | 2024-05-14 | A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions <… |
CVE-2024-21442 | High | 7.8 | 2024-03-12 | Windows USB Print Driver Elevation of Privilege Vulnerability |
CVE-2023-48674 | Medium | 6.8 | 2024-03-01 | Dell Platform BIOS contains an Improper Null Termination vulnerability. A high privilege user with network access to the system could potentially send maliciou… |
CVE-2023-36907 | Medium | 5.5 | 2023-08-08 | Windows Cryptographic Services Information Disclosure Vulnerability |
CVE-2023-36906 | Medium | 5.5 | 2023-08-08 | Windows Cryptographic Services Information Disclosure Vulnerability |
CVE-2023-35321 | Medium | 6.5 | 2023-07-11 | Windows Deployment Services Denial of Service Vulnerability |
CVE-2023-28263 | Medium | 5.5 | 2023-04-11 | Visual Studio Information Disclosure Vulnerability |
CVE-2023-24021 | High | 7.5 | 2023-01-20 | Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web A… |
CVE-2022-47515 | High | 7.5 | 2022-12-18 | An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP re… |
CVE-2021-31888 | High | 8.8 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-31887 | High | 8.8 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-31886 | Critical | 9.8 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-31884 | Critical | 9.8 | 2021-11-09 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2021-1120 | High | 7.0 | 2021-10-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be properly null termin… |
CVE-2021-22931 | Critical | 9.8 | 2021-08-16 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names retu… |
CVE-2020-27736 | Medium | 6.5 | 2021-04-22 | A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P… |
CVE-2021-1418 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1417 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1411 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1471 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1469 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2020-14323 | Medium | 5.5 | 2020-10-29 | A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this f… |
CVE-2020-7066 | Medium | 5.3 | 2020-04-01 | In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) c… |
CVE-2019-11045 | Low | 3.7 | 2019-12-23 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as termin… |
CVE-2019-11044 | Low | 3.7 | 2019-12-23 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as ter… |
CVE-2019-8275 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote us… |