CWE-248 (page 2)
Page 2 of 4 — CVEs classified under CWE-248, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45554 | Medium | 5.3 | 2026-06-02 | NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path paramet… |
CVE-2026-9509 | | 2026-05-29 | An unhandled exception in Suprema BioStar 2 (Server), versions 2.9.8, 2.9.10, and 2.9.11, that allows an unauthenticated remote attacker to cause a denial of s… | |
CVE-2025-15649 | Medium | 5.5 | 2026-05-27 | IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes th… |
CVE-2026-44905 | High | 7.5 | 2026-05-26 | Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the crypto… |
CVE-2026-43988 | High | 7.5 | 2026-05-26 | Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the ASN.1/… |
CVE-2026-44001 | High | 8.6 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.j… |
CVE-2026-42545 | Medium | 5.9 | 2026-05-12 | Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP respo… |
CVE-2026-42544 | High | 7.5 | 2026-05-12 | Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket up… |
CVE-2026-42268 | High | 7.5 | 2026-05-12 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandl… |
CVE-2026-8161 | High | 7.5 | 2026-05-12 | multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that… |
CVE-2026-41585 | Medium | 6.5 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1.0.0-beta.45 to before 6.0.2, a vulnera… |
CVE-2026-37554 | High | 7.5 | 2026-05-01 | An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworkin… |
CVE-2026-7183 | Medium | 5.3 | 2026-04-27 | A vulnerability has been found in aligungr UERANSIM up to 3.2.7. The affected element is the function rls::DecodeRlsMessage in the library src/lib/rls/rls_pdu… |
CVE-2026-5937 | Medium | 5.5 | 2026-04-27 | Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultim… |
CVE-2026-35348 | Medium | 5.5 | 2026-04-22 | The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The imple… |
CVE-2026-34944 | Medium | 5.7 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2… |
CVE-2026-34943 | High | 7.5 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed comp… |
CVE-2026-24175 | High | 7.5 | 2026-04-07 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header to the server. A suc… |
CVE-2026-34986 | High | 7.5 | 2026-04-06 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSO… |
CVE-2026-34752 | High | 7.5 | 2026-04-02 | Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has be… |
CVE-2026-33939 | High | 7.5 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator s… |
CVE-2026-33203 | High | 7.5 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specifi… |
CVE-2026-33191 | High | 8.6 | 2026-03-20 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection… |
CVE-2026-32770 | Medium | 5.9 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker c… |
CVE-2026-32314 | High | 7.5 | 2026-03-16 | Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a… |
CVE-2026-31949 | Medium | 6.5 | 2026-03-13 | LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability exists in the DELETE /api/convos endpoint th… |
CVE-2026-2229 | High | 7.5 | 2026-03-12 | ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permess… |
CVE-2026-1528 | High | 7.5 | 2026-03-12 | ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends u… |
CVE-2026-31870 | High | 7.5 | 2026-03-11 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::s… |
CVE-2026-31812 | Medium | 5.3 | 2026-03-10 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a d… |
CVE-2026-20068 | Medium | 5.8 | 2026-03-04 | Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort… |
CVE-2026-20031 | Medium | 5.3 | 2026-03-04 | A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) co… |
CVE-2026-27631 | Medium | 5.3 | 2026-03-02 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaugh… |
CVE-2026-27819 | High | 7.2 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of th… |
CVE-2026-1507 | High | 7.5 | 2026-02-10 | The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a de… |
CVE-2026-25577 | High | 7.5 | 2026-02-10 | Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle… |
CVE-2025-24851 | Medium | 6.0 | 2026-02-10 | Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS may allow a den… |
CVE-2025-13064 | Medium | 4.5 | 2026-02-10 | A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This at… |
CVE-2026-25128 | High | 7.5 | 2026-01-30 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5… |
CVE-2025-59466 | High | 7.5 | 2026-01-20 | We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enable… |
CVE-2025-59465 | High | 7.5 | 2026-01-20 | A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. I… |
CVE-2025-67647 | Critical | 9.1 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side req… |
CVE-2025-66578 | Medium | 6.0 | 2025-12-09 | xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Versions 3.1.3 contain an authentication bypass vulnerability due to a f… |
CVE-2025-20758 | Medium | 4.9 | 2025-12-02 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2025-20754 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20753 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2025-66305 | Medium | 4.9 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin… |
CVE-2025-0657 | | 2025-11-27 | A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/T… | |
CVE-2025-8870 | Medium | 4.9 | 2025-11-14 | On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153 |
CVE-2025-12423 | High | 7.5 | 2025-10-28 | Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-59462 | Medium | 6.5 | 2025-10-27 | An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability. |
CVE-2025-48430 | Medium | 5.5 | 2025-10-23 | Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue… |
CVE-2025-62370 | High | 7.5 | 2025-10-15 | Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::Ty… |
CVE-2025-59229 | Medium | 5.5 | 2025-10-14 | Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally. |
CVE-2025-9124 | | 2025-10-14 | A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a crafted CIP unconnected explicit message is… | |
CVE-2025-59538 | High | 7.5 | 2025-10-01 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17… |
CVE-2025-55557 | High | 7.5 | 2025-09-25 | A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS). |
CVE-2025-55553 | High | 7.5 | 2025-09-25 | A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS). |
CVE-2025-35436 | Medium | 5.3 | 2025-09-17 | CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by provid… |
CVE-2025-59014 | Low | 2.7 | 2025-09-09 | An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users t… |
CVE-2025-54777 | Medium | 4.3 | 2025-08-29 | Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of… |
CVE-2025-55194 | Medium | 5.7 | 2025-08-13 | Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture w… |
CVE-2013-10065 | High | 7.5 | 2025-08-05 | A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash… |
CVE-2025-47281 | High | 7.7 | 2025-07-23 | Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists d… |
CVE-2025-54134 | Medium | 6.5 | 2025-07-21 | HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when… |
CVE-2025-7338 | High | 7.5 | 2025-07-17 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 a… |
CVE-2025-53620 | | 2025-07-09 | @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an inv… | |
CVE-2025-53366 | | 2025-07-04 | The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP… | |
CVE-2025-53365 | | 2025-07-04 | The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately tri… | |
CVE-2025-44019 | High | 7.1 | 2025-06-12 | AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary P… |
CVE-2025-36539 | Medium | 6.5 | 2025-06-12 | AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary P… |
CVE-2025-48907 | Medium | 6.2 | 2025-06-06 | Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48997 | | 2025-06-03 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 a… | |
CVE-2025-29785 | High | 7.5 | 2025-06-02 | quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to tr… |
CVE-2025-48943 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes… |
CVE-2025-48942 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a… |
CVE-2025-47944 | High | 7.5 | 2025-05-19 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 a… |
CVE-2025-23166 | High | 7.5 | 2025-05-19 | The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the… |
CVE-2025-20054 | Medium | 6.5 | 2025-05-13 | Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via lo… |
CVE-2024-52903 | Medium | 5.3 | 2025-05-01 | IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially cr… |
CVE-2025-3891 | High | 7.5 | 2025-04-29 | A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending… |
CVE-2025-43855 | | 2025-04-24 | tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled er… | |
CVE-2025-32944 | Medium | 6.5 | 2025-04-15 | The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is t… |
CVE-2024-49705 | Medium | 6.5 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into usin… |
CVE-2025-20664 | High | 7.5 | 2025-04-07 | In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosur… |
CVE-2025-20663 | High | 7.5 | 2025-04-07 | In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosur… |
CVE-2024-58112 | High | 7.5 | 2025-04-07 | Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect avail… |
CVE-2024-58111 | High | 7.5 | 2025-04-07 | Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect avail… |
CVE-2025-3083 | High | 7.5 | 2025-04-01 | Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connecti… |
CVE-2024-8249 | High | 7.5 | 2025-03-20 | mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionali… |
CVE-2024-8020 | High | 7.5 | 2025-03-20 | A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/… |
CVE-2024-11173 | Medium | 6.5 | 2025-03-20 | An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This i… |
CVE-2024-11172 | High | 7.5 | 2025-03-20 | A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to th… |
CVE-2025-24836 | High | 7.1 | 2025-02-13 | With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected… |
CVE-2025-20097 | Medium | 4.3 | 2025-02-12 | Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 may allow an authenti… |
CVE-2025-0158 | Medium | 5.5 | 2025-02-06 | IBM EntireX 11.1 could allow a local user to cause a denial of service due to an unhandled error and fault isolation. |
CVE-2024-13417 | Medium | 4.6 | 2025-02-06 | Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state. 2… |
CVE-2025-20176 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20173 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20172 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, remote attacker to… |