cve.bz

OWASP A10:2025 Mishandling of Exceptional Conditions vulnerabilities, newest first, page 6

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A10:2025 at MITRE.

Its weaknesses: 24

CWE-209, CWE-215, CWE-234, CWE-235, CWE-248, CWE-252, CWE-274, CWE-280, CWE-369, CWE-390, CWE-391, CWE-394, CWE-396, CWE-397, CWE-460, CWE-476, CWE-478, CWE-484, CWE-550, CWE-636, CWE-703, CWE-754, CWE-755, CWE-756

  1. 7.5CVE-2026-77207EPSS 0.5%

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsO…

  2. 7.5CVE-2026-77206EPSS 0.7%

    Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EA…

  3. 5.5CVE-2026-95640EPSS 0.2%

    Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service conditio…

  4. 5.3CVE-2026-85473EPSS 0.3%

    The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests o…

  5. 6.5CVE-2026-14909EPSS 0.3%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.

  6. 5.5CVE-2026-105896EPSS 0.1%

    Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service conditio…

  7. 5.5CVE-2026-103829EPSS 0.1%

    Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service con…

  8. 5.5CVE-2026-103828EPSS 0.1%

    Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service con…

  9. 5.5CVE-2026-103826EPSS 0.1%

    Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service con…

  10. 5.5CVE-2026-103824EPSS 0.1%

    Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service con…

  11. 5.5CVE-2026-103855EPSS 0.1%

    Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Explo…

  12. 5.5CVE-2026-103852EPSS 0.1%

    Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condi…

  13. 8.8CVE-2026-97767EPSS 0.6%

    Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  14. 7.8CVE-2026-96953EPSS 0.3%

    Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

  15. 7.5CVE-2026-96945EPSS 1.1%

    Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

  16. 5.9CVE-2026-88099EPSS 0.8%

    Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

  17. 7.0CVE-2026-88079EPSS 0.3%

    Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

  18. 7.0CVE-2026-88076EPSS 0.3%

    Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.

  19. 6.5CVE-2026-85859EPSS 0.8%

    Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.

  20. 8.7CVE-2026-84994EPSS 0.5%

    Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.res…

  21. 7.5CVE-2026-84017EPSS 1.1%

    Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

  22. 4.7CVE-2026-83786EPSS 0.7%

    Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.

  23. 7.5CVE-2026-83665EPSS 1.3%

    Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  24. 6.5CVE-2026-83648EPSS 1.2%

    Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

  25. 6.5CVE-2026-83636EPSS 0.4%

    Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

  26. 5.5CVE-2026-83571EPSS 0.5%

    Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.

  27. 7.8CVE-2026-70566EPSS 0.4%

    Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.

  28. 6.5CVE-2026-70248EPSS 0.4%

    Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

  29. 7.5CVE-2026-70082EPSS 1.3%

    Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.

  30. 5.5CVE-2026-69978EPSS 0.4%

    Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally.

  31. 7.0CVE-2026-69795EPSS 0.3%

    Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

  32. 5.5CVE-2026-104343EPSS 0.2%

    Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition…

  33. 7.5CVE-2026-102599EPSS 0.6%

    Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing …

  34. 9.1CVE-2026-52394EPSS 0.4%

    DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.

  35. 4.9CVE-2026-106170EPSS 0.3%

    An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI pe…

  36. 7.1CVE-2026-104004EPSS 0.2%

    MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur fo…

  37. 7.5CVE-2026-95122EPSS 0.5%

    mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service

  38. 7.1CVE-2026-77095EPSS 0.2%

    CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Client…

  39. 8.7CVE-2026-109967EPSS 0.6%

    yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value lik…

  40. 7.1CVE-2026-109942EPSS 0.3%

    FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without …

  41. 7.1CVE-2026-109939EPSS 0.3%

    FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is no…

  42. 6.0CVE-2026-109679EPSS 0.3%

    FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL…

  43. 6.8CVE-2026-85115EPSS 0.1%

    A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an…

  44. 5.5CVE-2026-109107EPSS 0.4%

    A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to …

  45. 5.8CVE-2026-41508EPSS 0.5%

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_…

  46. 7.1CVE-2026-109338EPSS 0.3%

    SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Head…

  47. 8.2CVE-2026-109301EPSS 0.3%

    Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers abl…

  48. 2.0CVE-2026-109280EPSS 0.1%

    ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure c…

  49. 6.3CVE-2026-109272EPSS 0.4%

    ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, ca…

  50. 2.0CVE-2026-109258EPSS 0.3%

    ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an inv…