cve.bz

OWASP A10:2025 Mishandling of Exceptional Conditions vulnerabilities, newest first, page 21

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A10:2025 at MITRE.

Its weaknesses: 24

CWE-209, CWE-215, CWE-234, CWE-235, CWE-248, CWE-252, CWE-274, CWE-280, CWE-369, CWE-390, CWE-391, CWE-394, CWE-396, CWE-397, CWE-460, CWE-476, CWE-478, CWE-484, CWE-550, CWE-636, CWE-703, CWE-754, CWE-755, CWE-756

  1. 6.9CVE-2024-58358EPSS 0.5%

    SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assig…

  2. 7.1CVE-2024-58357EPSS 0.4%

    SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliab…

  3. 5.3CVE-2026-8861EPSS 0.4%

    IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.

  4. 8.2CVE-2026-53712EPSS 0.3%

    SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.s…

  5. 4.3CVE-2026-21764EPSS 0.2%

    HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions.

  6. 5.3CVE-2024-23575EPSS 0.3%

    HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error messages to help launch another ,more foc…

  7. 6.5CVE-2026-8075EPSS 0.4%

    Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with a…

  8. 5.7CVE-2026-62764EPSS 0.8%

    Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator…

  9. 2.3CVE-2026-62235EPSS 0.3%

    Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less dir…

  10. 6.8CVE-2026-61378EPSS 0.2%

    A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.

  11. 3.7CVE-2026-62994EPSS 0.5%

    CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes…

  12. 7.5CVE-2026-62309EPSS 0.7%

    CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 he…

  13. 5.3CVE-2026-62299EPSS 0.5%

    CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/ed…

  14. 8.2CVE-2026-15352EPSS 0.6%

    A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial …

  15. 7.5CVE-2026-20187EPSS 0.5%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses …

  16. 7.1CVE-2026-52865EPSS 0.5%

    When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to term…

  17. 5.7CVE-2025-56363EPSS 0.4%

    A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks pr…

  18. 8.2CVE-2026-50528EPSS 0.6%

    Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

  19. 7.5CVE-2026-48069EPSS 0.9%

    @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process th…

  20. 7.5CVE-2026-48068EPSS 0.9%

    @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process create…

  21. 5.3CVE-2026-48038EPSS 0.5%

    joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() s…

  22. 7.5CVE-2026-47480EPSS 0.5%

    NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit of this vulnerability might lead to denial of service.

  23. 6.5CVE-2026-56168EPSS 1.1%

    Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network.

  24. 7.8CVE-2026-50673EPSS 0.2%

    Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

  25. 6.5CVE-2026-50366EPSS 1.1%

    Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

  26. 7.5CVE-2026-50328EPSS 1.2%

    Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

  27. 7.8CVE-2026-50315EPSS 0.3%

    Null pointer dereference in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

  28. 6.5CVE-2026-57976EPSS 1.1%

    Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

  29. 5.5CVE-2026-10670EPSS 0.2%

    The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy() in kernel/thread.c) calls k_object_find() on the caller-supplied thread pointer and then dereferences the returned struct k_obj…

  30. 4.3CVE-2026-62393EPSS 0.5%

    Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects. This issue affects Ap…

  31. 1.3CVE-2026-15690EPSS 0.4%

    A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_connect.c of the component Shared Client Library. Such manipulation of the argumen…

  32. 7.5CVE-2026-58101EPSS 0.3%

    Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its resul…

  33. 6.3CVE-2026-61857EPSS 0.3%

    ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cau…

  34. 7.8CVE-2026-45196EPSS 0.1%

    Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.

  35. 6.9CVE-2026-59162EPSS 0.7%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, a…

  36. 2.4CVE-2026-55783EPSS 0.2%

    NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's seven in-house IInArchive handlers in NanaZip.Codecs unconditionally dereference the caller-supplied Indices array inside Extract wh…

  37. 2.4CVE-2026-55780ExploitEPSS 0.6%

    NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Siz…

  38. 5.3CVE-2026-57031EPSS 0.2%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters. On MX Series devices …

  39. 8.2CVE-2026-57022EPSS 0.4%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-…

  40. 7.1CVE-2026-57020EPSS 0.3%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on QFX10000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). O…

  41. 7.1CVE-2026-33801EPSS 0.3%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker sending a specific BGP update over an…

  42. 8.2CVE-2026-33794EPSS 0.4%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the advanced forwarding toolkit (evo-aftmand) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker generating conti…

  43. 6.7CVE-2026-21901EPSS 0.2%

    A NULL Pointer Dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker setting or deactivating a specific SSH configuration parameter to create a D…

  44. 6.6CVE-2026-0287EPSS 0.6%

    Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through…

  45. 7.5CVE-2026-51600EPSS 0.6%

    Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods). When a request carrying a Content-Length header is received without a corresponding messag…

  46. 8.7CVE-2026-60109EPSS 0.9%

    Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the sensor by sending a crafted KRB_ERROR message with error-code 25 (KDC_ERR_PREAU…

  47. 1.9CVE-2026-15184EPSS 0.2%

    A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointe…

  48. 4.6CVE-2026-56288EPSS 0.1%

    GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) dat…

  49. 6.5CVE-2026-54775EPSS 0.6%

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka topic stops processing new records from that topic when KafkaTransportPump recei…

  50. 7.5CVE-2026-58208EPSS 0.6%

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was…