CWE-476 · NULL Pointer Dereference (page 2)
Page 2 of 57 — CVEs classified under CWE-476, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77217 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/disp… |
CVE-2026-75125 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_a… |
CVE-2026-54084 | Medium | 5.3 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a mali… |
CVE-2026-38344 | High | 7.5 | 2026-08-28 | A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Servi… |
CVE-2026-30072 | High | 7.5 | 2026-08-27 | A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload. |
CVE-2026-30069 | High | 7.5 | 2026-08-27 | A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying craft… |
CVE-2026-30056 | High | 7.5 | 2026-08-27 | A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGA… |
CVE-2026-26457 | High | 7.5 | 2026-08-27 | ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg() function when processing COAP messages… |
CVE-2026-26456 | High | 7.5 | 2026-08-27 | A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is cau… |
CVE-2026-26453 | High | 7.5 | 2026-08-27 | ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() function when processing C… |
CVE-2026-26449 | High | 7.5 | 2026-08-26 | In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or access to invalid… |
CVE-2026-65367 | Medium | 5.5 | 2026-08-25 | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5. An app… |
CVE-2026-48429 | Medium | 5.5 | 2026-08-25 | Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit… |
CVE-2026-24263 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful e… |
CVE-2026-13217 | Medium | 5.9 | 2026-08-25 | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp_process_server_m… |
CVE-2026-63076 | High | 7.5 | 2026-08-25 | Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before t… |
CVE-2026-14457 | High | 7.5 | 2026-08-25 | Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) confi… |
CVE-2026-55371 | | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Version… | |
CVE-2026-71922 | High | 7.5 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is cause… |
CVE-2026-71920 | Medium | 4.9 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks… |
CVE-2026-13213 | Medium | 5.3 | 2026-08-24 | The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so secur… |
CVE-2026-78148 | Medium | 5.3 | 2026-08-24 | A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp… |
CVE-2026-76905 | High | 7.5 | 2026-08-21 | kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder… |
CVE-2026-17251 | | 2026-08-21 | A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the… | |
CVE-2026-48756 | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend… | |
CVE-2026-48754 | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/back… | |
CVE-2026-47753 | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go`… | |
CVE-2026-17165 | High | 7.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. |
CVE-2026-17009 | Medium | 4.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to a NULL pointer dereference. |
CVE-2026-63380 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error… | |
CVE-2026-73199 | Medium | 6.5 | 2026-08-20 | A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malforme… |
CVE-2026-8619 | High | 7.5 | 2026-08-20 | An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper… |
CVE-2026-76928 | High | 7.5 | 2026-08-19 | X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76927 | Medium | 4.7 | 2026-08-19 | H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76922 | Medium | 5.5 | 2026-08-19 | Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76881 | Medium | 4.7 | 2026-08-19 | CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-68901 | Medium | 6.5 | 2026-08-19 | Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boa… |
CVE-2026-16846 | Medium | 6.5 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a null pointer dereference. |
CVE-2026-16829 | Medium | 5.3 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. |
CVE-2026-75618 | Medium | 6.5 | 2026-08-19 | Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests t… |
CVE-2026-16817 | High | 7.5 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. |
CVE-2026-76166 | Medium | 4.3 | 2026-08-19 | A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status li… |
CVE-2026-76014 | Low | 3.3 | 2026-08-19 | A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIM… |
CVE-2026-73502 | Medium | 5.3 | 2026-08-18 | kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denia… |
CVE-2026-50126 | Medium | 4.0 | 2026-08-18 | Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote se… |
CVE-2026-59949 | Medium | 6.5 | 2026-08-18 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and le… |
CVE-2026-75013 | Medium | 6.5 | 2026-08-17 | A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulati… |
CVE-2026-75012 | Medium | 6.5 | 2026-08-17 | A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bi… |
CVE-2026-58561 | Medium | 4.0 | 2026-08-17 | Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-58560 | Medium | 4.0 | 2026-08-17 | Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-55401 | Medium | 5.3 | 2026-08-13 | CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenti… |
CVE-2026-18699 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly b… |
CVE-2026-65681 | High | 7.5 | 2026-08-11 | Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network. |
CVE-2026-62702 | Medium | 6.8 | 2026-08-11 | Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network. |
CVE-2026-61345 | Medium | 6.5 | 2026-08-11 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. |
CVE-2026-59138 | Medium | 6.5 | 2026-08-11 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. |
CVE-2026-59132 | High | 7.5 | 2026-08-11 | Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network. |
CVE-2026-48438 | High | 7.5 | 2026-08-11 | CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploi… |
CVE-2026-20878 | High | 7.4 | 2026-08-11 | Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adver… |
CVE-2026-20787 | High | 7.4 | 2026-08-11 | Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adver… |
CVE-2026-20727 | High | 8.6 | 2026-08-11 | Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software… |
CVE-2026-18638 | Medium | 6.5 | 2026-08-11 | Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling Set… |
CVE-2026-12051 | Medium | 4.6 | 2026-08-11 | The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/u… |
CVE-2026-19411 | Low | 3.9 | 2026-08-10 | A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of se… |
CVE-2026-11810 | High | 7.5 | 2026-08-10 | The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the up… |
CVE-2026-71967 | Medium | 5.5 | 2026-08-10 | OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows… |
CVE-2026-72582 | High | 7.5 | 2026-08-10 | A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP… |
CVE-2026-17510 | High | 7.5 | 2026-08-09 | Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribut… |
CVE-2026-52878 | High | 7.5 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a proto… |
CVE-2026-19012 | Medium | 5.3 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition… |
CVE-2026-48097 | High | 7.8 | 2026-08-07 | NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command exec… |
CVE-2026-45204 | Medium | 5.5 | 2026-08-07 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error… |
CVE-2026-70640 | High | 7.0 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1cont… |
CVE-2026-70639 | Medium | 5.5 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails… |
CVE-2026-67870 | Critical | 9.8 | 2026-08-06 | In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacke… |
CVE-2026-19026 | | 2026-08-05 | H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nel… | |
CVE-2026-19024 | | 2026-08-05 | NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value… | |
CVE-2026-46334 | | 2026-08-05 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the S… | |
CVE-2026-45084 | | 2026-08-04 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence m… | |
CVE-2026-67304 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers… |
CVE-2026-67288 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCA… |
CVE-2026-18064 | High | 7.5 | 2026-07-30 | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reach… |
CVE-2026-58161 | High | 7.5 | 2026-07-29 | Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2026-67184 | High | 7.5 | 2026-07-28 | TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a mal… |
CVE-2026-66749 | Medium | 6.5 | 2026-07-28 | Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-charac… |
CVE-2026-47427 | High | 7.5 | 2026-07-28 | GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first ch… |
CVE-2026-17574 | Medium | 5.5 | 2026-07-27 | HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type fi… |
CVE-2026-17500 | Medium | 5.3 | 2026-07-27 | A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The… |
CVE-2026-64451 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr-… |
CVE-2026-64427 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e ("… |
CVE-2026-64420 | High | 7.0 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cro… |
CVE-2026-64417 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker_debugfs_add() creates both… |
CVE-2026-64416 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host lookup_swap_cgr… |
CVE-2026-64405 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() hci_abort_conn() read hci_skb… |
CVE-2026-64404 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() iso_conn_big_sync() drops… |
CVE-2026-64403 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt… |
CVE-2026-64358 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent… |
CVE-2026-64331 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't initializing vreq… |
CVE-2026-64325 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BU… |
CVE-2026-64314 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapoly_create() still… |