CWE-248 (page 2)
Page 2 of 3 — CVEs classified under CWE-248, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59229 | Medium | 5.5 | 2025-10-14 | Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally. |
CVE-2025-9124 | | 2025-10-14 | A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a crafted CIP unconnected explicit message is… | |
CVE-2025-59538 | High | 7.5 | 2025-10-01 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17… |
CVE-2025-55557 | High | 7.5 | 2025-09-25 | A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS). |
CVE-2025-55553 | High | 7.5 | 2025-09-25 | A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS). |
CVE-2025-35436 | Medium | 5.3 | 2025-09-17 | CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by provid… |
CVE-2025-59014 | Low | 2.7 | 2025-09-09 | An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users t… |
CVE-2025-54777 | Medium | 4.3 | 2025-08-29 | Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of… |
CVE-2025-55194 | Medium | 5.7 | 2025-08-13 | Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture w… |
CVE-2013-10065 | High | 7.5 | 2025-08-05 | A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash… |
CVE-2025-47281 | High | 7.7 | 2025-07-23 | Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists d… |
CVE-2025-54134 | Medium | 6.5 | 2025-07-21 | HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when… |
CVE-2025-7338 | High | 7.5 | 2025-07-17 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 a… |
CVE-2025-53620 | | 2025-07-09 | @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an inv… | |
CVE-2025-53366 | | 2025-07-04 | The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP… | |
CVE-2025-53365 | | 2025-07-04 | The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately tri… | |
CVE-2025-44019 | High | 7.1 | 2025-06-12 | AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary P… |
CVE-2025-36539 | Medium | 6.5 | 2025-06-12 | AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary P… |
CVE-2025-48907 | Medium | 6.2 | 2025-06-06 | Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48997 | | 2025-06-03 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 a… | |
CVE-2025-29785 | High | 7.5 | 2025-06-02 | quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to tr… |
CVE-2025-48943 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes… |
CVE-2025-48942 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a… |
CVE-2025-47944 | High | 7.5 | 2025-05-19 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 a… |
CVE-2025-23166 | High | 7.5 | 2025-05-19 | The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the… |
CVE-2025-20054 | Medium | 6.5 | 2025-05-13 | Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via lo… |
CVE-2024-52903 | Medium | 5.3 | 2025-05-01 | IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially cr… |
CVE-2025-3891 | High | 7.5 | 2025-04-29 | A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending… |
CVE-2025-43855 | | 2025-04-24 | tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled er… | |
CVE-2025-32944 | Medium | 6.5 | 2025-04-15 | The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is t… |
CVE-2024-49705 | Medium | 6.5 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into usin… |
CVE-2025-20664 | High | 7.5 | 2025-04-07 | In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosur… |
CVE-2025-20663 | High | 7.5 | 2025-04-07 | In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosur… |
CVE-2024-58112 | High | 7.5 | 2025-04-07 | Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect avail… |
CVE-2024-58111 | High | 7.5 | 2025-04-07 | Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect avail… |
CVE-2025-3083 | High | 7.5 | 2025-04-01 | Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connecti… |
CVE-2024-8249 | High | 7.5 | 2025-03-20 | mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionali… |
CVE-2024-8020 | High | 7.5 | 2025-03-20 | A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/… |
CVE-2024-11173 | Medium | 6.5 | 2025-03-20 | An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This i… |
CVE-2024-11172 | High | 7.5 | 2025-03-20 | A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to th… |
CVE-2025-24836 | High | 7.1 | 2025-02-13 | With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected… |
CVE-2025-20097 | Medium | 4.3 | 2025-02-12 | Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 may allow an authenti… |
CVE-2025-0158 | Medium | 5.5 | 2025-02-06 | IBM EntireX 11.1 could allow a local user to cause a denial of service due to an unhandled error and fault isolation. |
CVE-2024-13417 | Medium | 4.6 | 2025-02-06 | Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state. 2… |
CVE-2025-20176 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20173 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20172 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, remote attacker to… |
CVE-2025-20171 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2024-56946 | Medium | 5.3 | 2025-02-03 | Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC… |
CVE-2025-20637 | High | 7.5 | 2025-02-03 | In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privilege… |
CVE-2025-24883 | | 2025-01-30 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… | |
CVE-2025-0648 | Medium | 4.9 | 2025-01-23 | Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial o… |
CVE-2024-54106 | High | 7.1 | 2024-12-12 | Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-11738 | Medium | 5.3 | 2024-12-06 | A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message. |
CVE-2024-20137 | High | 7.5 | 2024-12-02 | In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions. This could lead to remote denial of service with n… |
CVE-2024-29076 | Medium | 5.5 | 2024-11-13 | Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2024-51750 | Medium | 5.0 | 2024-11-12 | Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web… |
CVE-2024-51518 | Medium | 5.3 | 2024-11-05 | Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-33848 | Medium | 6.5 | 2024-09-16 | Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-43367 | High | 7.5 | 2024-08-15 | Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when han… |
CVE-2024-43357 | High | 8.6 | 2024-08-15 | ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, intro… |
CVE-2024-42037 | Critical | 9.3 | 2024-08-08 | Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-38525 | High | 7.5 | 2024-06-28 | dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited… |
CVE-2023-5038 | High | 7.5 | 2024-06-25 | badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URL, nobody can access… |
CVE-2024-31217 | Medium | 5.3 | 2024-06-12 | Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing t… |
CVE-2024-34363 | High | 7.5 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception… |
CVE-2024-31904 | Medium | 6.5 | 2024-05-22 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of s… |
CVE-2024-32995 | Medium | 6.2 | 2024-05-14 | Denial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-3052 | High | 7.5 | 2024-04-26 | Malformed S2 Nonce Get command classes can be sent to crash the gateway. A hard reset is required to recover the gateway. |
CVE-2024-3051 | High | 7.5 | 2024-04-26 | Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowle… |
CVE-2023-52342 | High | 7.5 | 2024-04-08 | In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional ex… |
CVE-2024-20049 | Medium | 4.4 | 2024-04-01 | In flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local information disclosure with System execution privi… |
CVE-2024-20048 | Medium | 6.2 | 2024-04-01 | In flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local information disclosure with System execution privi… |
CVE-2024-23449 | Medium | 4.3 | 2024-03-29 | An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasti… |
CVE-2024-20276 | High | 7.4 | 2024-03-27 | A vulnerability in Cisco IOS Software for Cisco Catalyst 6000 Series Switches could allow an unauthenticated, adjacent attacker to cause an affected device to… |
CVE-2024-28835 | Medium | 5.0 | 2024-03-21 | A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --… |
CVE-2021-33145 | High | 7.2 | 2024-02-23 | Uncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially e… |
CVE-2023-3966 | High | 7.5 | 2024-02-22 | A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory a… |
CVE-2023-6640 | Medium | 6.5 | 2024-02-21 | Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier. |
CVE-2023-6533 | Medium | 6.5 | 2024-02-21 | Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After… |
CVE-2024-21983 | Medium | 6.5 | 2024-02-16 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authe… |
CVE-2023-26586 | Medium | 4.3 | 2024-02-14 | Uncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentia… |
CVE-2024-23325 | High | 7.5 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susc… |
CVE-2023-27318 | Medium | 6.5 | 2024-02-05 | StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.13 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploi… |
CVE-2024-0754 | Medium | 6.5 | 2024-01-23 | Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122. |
CVE-2023-5310 | Medium | 5.7 | 2023-12-15 | A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier… |
CVE-2023-22292 | High | 7.3 | 2023-11-14 | Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2023-22290 | Medium | 6.5 | 2023-11-14 | Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access. |
CVE-2023-20086 | High | 8.6 | 2023-11-01 | A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unaut… |
CVE-2023-46239 | High | 7.5 | 2023-10-31 | quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO t… |
CVE-2023-46135 | Medium | 5.3 | 2023-10-25 | rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len`… |
CVE-2023-25526 | Medium | 6.5 | 2023-09-20 | NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exception by injecting… |
CVE-2023-42447 | High | 8.6 | 2023-09-19 | blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representin… |
CVE-2023-42444 | High | 8.6 | 2023-09-19 | phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumb… |
CVE-2023-4785 | High | 7.5 | 2023-09-13 | Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial… |
CVE-2023-23774 | High | 8.4 | 2023-08-29 | Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on the device's seria… |
CVE-2023-39948 | High | 7.5 | 2023-08-11 | eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `Ba… |
CVE-2023-39945 | High | 8.2 | 2023-08-11 | eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, an… |
CVE-2023-3774 | Medium | 4.9 | 2023-07-28 | An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1… |
CVE-2023-38504 | High | 7.5 | 2023-07-27 | Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process t… |