CWE-476 · NULL Pointer Dereference (page 3)
Page 3 of 57 — CVEs classified under CWE-476, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64297 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() module_extend_max_pag… |
CVE-2026-64295 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The pag… |
CVE-2026-64288 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs fro… |
CVE-2026-64258 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref If a copy… |
CVE-2026-64253 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() PF_BLOCK_TS is only set in blk_time_get_… |
CVE-2026-64234 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: pch_uart: add check for dma_alloc_coherent() Add a check for dma_alloc_coher… |
CVE-2026-64230 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irq_data.rdev not being assigned Commit 64a6b577490c ("regulator… |
CVE-2026-64229 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB flush when PCID is disabled Booting with "nopcid" clears X8… |
CVE-2026-64228 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev->drv can become NUL… |
CVE-2026-64227 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPI_COMPANION() against NULL during probe Since every platform drive… |
CVE-2026-64215 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table Check the return value of… |
CVE-2026-64214 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() … |
CVE-2026-64212 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove… |
CVE-2026-45816 | High | 7.5 | 2026-07-24 | NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would trigger befo… |
CVE-2026-50032 | High | 7.5 | 2026-07-23 | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequ… |
CVE-2026-13070 | Medium | 5.3 | 2026-07-22 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS han… |
CVE-2026-13065 | Medium | 6.5 | 2026-07-22 | A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type… |
CVE-2026-55717 | Medium | 5.9 | 2026-07-22 | In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <ne… |
CVE-2026-47709 | Medium | 5.5 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a… |
CVE-2026-10678 | High | 8.1 | 2026-07-21 | The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte… |
CVE-2026-47143 | Medium | 5.1 | 2026-07-21 | Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassem… |
CVE-2026-16353 | Critical | 9.8 | 2026-07-21 | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-64207 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segme… |
CVE-2026-64192 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized When CONFIG_B… |
CVE-2026-64190 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in team_xmit during mode change __team_change_mod… |
CVE-2026-64187 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transacti… |
CVE-2026-47276 | Medium | 6.5 | 2026-07-20 | In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sendi… |
CVE-2026-47275 | Low | 2.6 | 2026-07-20 | In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicious MQTT broker to crash any connecting… |
CVE-2026-63762 | Medium | 6.5 | 2026-07-20 | SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via… |
CVE-2026-64183 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: efi: Allocate runtime workqueue before ACPI init Since commit 5894cf571e14 ("acpi/prmt… |
CVE-2026-64170 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mo… |
CVE-2026-64169 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO… |
CVE-2026-64168 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO m… |
CVE-2026-64167 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel kho_fill_kimage() unconditionally populates the kimage wit… |
CVE-2026-64166 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Check for NULL FF-A ID table while driver registration The bus match c… |
CVE-2026-64165 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ARM: integrator: Fix early initialization Starting with commit bdb249fce9ad4 ("ARM: integ… |
CVE-2026-64164 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() The trace even… |
CVE-2026-64141 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compare_guid_key() session_fd_check() walks the pe… |
CVE-2026-64140 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client opens a file… |
CVE-2026-64134 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM… |
CVE-2026-64128 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISO_END frames received without prior ISO_START ISO data PDUs carry… |
CVE-2026-64120 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix NULL pointer dereference in phy_reply_size In phy_prepare_data(), sever… |
CVE-2026-64116 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function… |
CVE-2026-64107 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put() In the pcm… |
CVE-2026-64094 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnl_lock h… |
CVE-2026-64079 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: allocate hook ops while under mutex arp/ip(6)t_register_table() add… |
CVE-2026-64052 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() pin_user_pages_fast(… |
CVE-2026-64049 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will… |
CVE-2026-64048 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slo… |
CVE-2026-64045 | High | 8.4 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpn_tcp_close() ovpn_tcp_close() loads the ovpn_s… |
CVE-2026-53403 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var info->var, a… |
CVE-2026-53399 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid in… |
CVE-2026-53392 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the… |
CVE-2026-53391 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr()… |
CVE-2026-53385 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-… |
CVE-2026-53383 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() take… |
CVE-2026-53382 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si syzbot reported a general… |
CVE-2026-62309 | High | 7.5 | 2026-07-16 | CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled becau… |
CVE-2026-62299 | Medium | 5.3 | 2026-07-16 | CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response… |
CVE-2026-15352 | High | 7.5 | 2026-07-16 | A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fa… |
CVE-2026-52865 | Medium | 6.5 | 2026-07-15 | When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or… |
CVE-2025-56363 | High | 7.5 | 2026-07-14 | A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple… |
CVE-2026-56168 | Medium | 6.5 | 2026-07-14 | Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network. |
CVE-2026-50673 | High | 7.8 | 2026-07-14 | Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50366 | Medium | 6.5 | 2026-07-14 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. |
CVE-2026-50315 | High | 7.8 | 2026-07-14 | Null pointer dereference in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. |
CVE-2026-57976 | Medium | 6.5 | 2026-07-14 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. |
CVE-2026-10670 | Medium | 5.5 | 2026-07-14 | The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on th… |
CVE-2026-15690 | Low | 3.1 | 2026-07-14 | A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_co… |
CVE-2026-58101 | High | 7.5 | 2026-07-13 | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's… |
CVE-2026-55783 | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's seven in-house IInArchive handlers in NanaZip.Codecs… | |
CVE-2026-21901 | Medium | 4.4 | 2026-07-09 | A NULL Pointer Dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attac… |
CVE-2026-60109 | High | 7.5 | 2026-07-09 | Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the… |
CVE-2026-15184 | Low | 3.3 | 2026-07-09 | A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Ha… |
CVE-2026-56288 | Medium | 5.5 | 2026-07-09 | GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file… |
CVE-2026-15171 | Medium | 5.5 | 2026-07-08 | SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service |
CVE-2026-58250 | High | 7.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with net… |
CVE-2026-44512 | Medium | 5.5 | 2026-07-08 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version… |
CVE-2026-50812 | Medium | 5.5 | 2026-07-08 | A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can… |
CVE-2026-50810 | Medium | 5.5 | 2026-07-07 | A NULL pointer dereference in smooth_parse_stream_index() in src/media_tools/mpd.c in GPAC master HEAD before commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 a… |
CVE-2026-10659 | Medium | 4.7 | 2026-07-07 | The Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) implemented the dhara_nand_ callbacks so that, on a flash error, the error code was wr… |
CVE-2026-38976 | High | 7.5 | 2026-07-06 | mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super. |
CVE-2026-48267 | Medium | 5.5 | 2026-07-06 | DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An atta… |
CVE-2026-14790 | Low | 3.3 | 2026-07-06 | A flaw has been found in GPAC 26.02.0. This affects the function nhmldump_send_frame of the file src/filters/write_nhml.c of the component Media File Handler… |
CVE-2026-10656 | Medium | 4.6 | 2026-07-05 | The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c, compatible adi_max32_usbhs) dereferenced an endpoint buffer in its OUT and IN transfer-… |
CVE-2026-13084 | High | 7.5 | 2026-07-03 | A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by… |
CVE-2026-36912 | High | 7.5 | 2026-07-01 | A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of… |
CVE-2026-36909 | Medium | 6.2 | 2026-07-01 | A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Servic… |
CVE-2026-14324 | Medium | 6.5 | 2026-07-01 | RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. |
CVE-2026-53355 | Critical | 9.8 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so… |
CVE-2026-53350 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: ASoC: wm_adsp: Fix NULL dereference when removing firmware controls In wm_adsp_control_re… |
CVE-2026-53348 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions sdca_dev_unregi… |
CVE-2026-53339 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() On all modern platforms Qualc… |
CVE-2026-53338 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()… |
CVE-2026-53337 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL pointer dereference in bond_do_ioctl() In bond_do_ioctl(), slave_d… |
CVE-2026-53335 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: handle ctx allocation failure DAMON_LRU_SORT allocates the damon_ctx o… |
CVE-2026-53334 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: handle ctx allocation failure Patch series "mm/damon/{reclaim,lru_sort}… |
CVE-2026-20457 | Medium | 5.3 | 2026-07-01 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2026-58369 | Medium | 5.3 | 2026-06-30 | Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally de… |
CVE-2026-10648 | Medium | 6.2 | 2026-06-29 | mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for… |