cve.bz

OWASP A10:2025 Mishandling of Exceptional Conditions vulnerabilities, newest first, page 13

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A10:2025 at MITRE.

Its weaknesses: 24

CWE-209, CWE-215, CWE-234, CWE-235, CWE-248, CWE-252, CWE-274, CWE-280, CWE-369, CWE-390, CWE-391, CWE-394, CWE-396, CWE-397, CWE-460, CWE-476, CWE-478, CWE-484, CWE-550, CWE-636, CWE-703, CWE-754, CWE-755, CWE-756

  1. 4.3CVE-2026-87548EPSS 0.3%

    Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  2. 6.5CVE-2026-87532EPSS 0.3%

    Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  3. 6.5CVE-2026-66306EPSS 0.9%

    Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.

  4. 6.5CVE-2026-66303EPSS 1.1%

    Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.

  5. 8.2CVE-2026-81379EPSS 0.5%

    Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  6. 8.8CVE-2026-77901EPSS 0.8%

    Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  7. 7.8CVE-2026-77489EPSS 0.3%

    Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  8. 7.5CVE-2026-72949EPSS 1.2%

    Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.

  9. 6.5CVE-2026-72939EPSS 1.1%

    Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network.

  10. 6.5CVE-2026-70575EPSS 1.0%

    Null pointer dereference in Windows Schannel allows an authorized attacker to deny service over a network.

  11. 7.8CVE-2026-69907EPSS 0.3%

    Improper handling of insufficient permissions or privileges in Windows Enterprise App Management allows an authorized attacker to elevate privileges locally.

  12. 7.5CVE-2026-69881EPSS 1.2%

    Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

  13. 6.5CVE-2026-69839EPSS 1.1%

    Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network.

  14. 7.5CVE-2026-69744EPSS 1.2%

    Null pointer dereference in Windows Kerberos allows an unauthorized attacker to deny service over a network.

  15. 5.5CVE-2026-69684EPSS 0.5%

    Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally.

  16. 7.5CVE-2026-69587EPSS 1.2%

    Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

  17. 5.7CVE-2026-69552EPSS 0.9%

    Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.

  18. 7.1CVE-2026-69384EPSS 0.4%

    Null pointer dereference in Virtual Hard Disk (VHD) Miniport Driver allows an unauthorized attacker to deny service locally.

  19. 5.5CVE-2026-69294EPSS 0.5%

    Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.

  20. 5.5CVE-2026-68886EPSS 0.5%

    Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally.

  21. 6.5CVE-2026-67383EPSS 1.0%

    Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.

  22. 6.5CVE-2026-62762EPSS 1.1%

    Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

  23. 2.7CVE-2026-84392EPSS 1.1%

    A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 al…

  24. 7.1CVE-2026-82058EPSS 0.4%

    A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonS…

  25. 7.1CVE-2026-82055EPSS 0.4%

    A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsist…

  26. 8.7CVE-2026-73314EPSS 0.7%

    XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_al…

  27. 6.9CVE-2026-62652EPSS 0.3%

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly…

  28. 7.5CVE-2026-18453EPSS 0.8%

    A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests us…

  29. 5.3CVE-2026-80135EPSS 0.4%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access c…

  30. 7.1CVE-2022-51014EPSS 0.5%

    PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to tr…

  31. 8.7CVE-2022-51009EPSS 0.6%

    PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeExcep…

  32. 5.5CVE-2026-6244EPSS 0.1%

    libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.

  33. 5.3CVE-2026-86120EPSS 0.4%

    APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can wr…

  34. 3.3CVE-2026-86141EPSS 0.2%

    xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

  35. 7.1CVE-2026-86097EPSS 0.4%

    PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or '…

  36. 7.5CVE-2026-75439EPSS 0.8%

    An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component

  37. 8.4CVE-2026-80118EPSS 0.2%

    PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users throu…

  38. 7.5CVE-2026-19534EPSS 0.4%

    undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 10…

  39. 5.9CVE-2026-85024EPSS 0.4%

    undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compresse…

  40. 7.5CVE-2026-85014EPSS 0.4%

    undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writa…

  41. 5.3CVE-2026-84947EPSS 0.2%

    undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length a…

  42. 6.5CVE-2026-17273EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.

  43. 7.9CVE-2026-85649EPSS 0.2%

    (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate y…

  44. 2.1CVE-2026-85458EPSS 0.1%

    Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.

  45. 8.7CVE-2026-57445EPSS 0.4%

    Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal benefici…

  46. 7.5CVE-2026-85150EPSS 0.5%

    A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement aroun…

  47. 8.5CVE-2026-76642EPSS 0.2%

    util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.i…

  48. 5.9CVE-2026-17539EPSS 0.4%

    RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, res…

  49. 8.8CVE-2026-20280EPSS 0.5%

    As part of Cisco's ongoing commitment to proactive security and product quality, the&nbsp;Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases …

  50. 8.7CVE-2026-78222EPSS 0.6%

    A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTT…