Total
6226 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-28581 | 1 Google | 1 Android | 2026-09-10 | 4 Medium |
| In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lead to local escalation with User execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2026-86141 | 1 Xmlsoft | 1 Libxml2 | 2026-09-09 | 2.9 Low |
| xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. | ||||
| CVE-2026-77489 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-09 | 7.8 High |
| Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-18453 | 1 Redhat | 11 Directory Server, Directory Server E4s, Enterprise Linux and 8 more | 2026-09-09 | 7.5 High |
| A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service. | ||||
| CVE-2026-17273 | 1 Ibm | 1 I | 2026-09-09 | 6.5 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference. | ||||
| CVE-2026-24263 | 1 Nvidia | 2 Dgx Spark, Dgx Spark Uefi | 2026-09-09 | 8.2 High |
| NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering. | ||||
| CVE-2026-86547 | 2026-09-09 | 6.2 Medium | ||
| mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service. | ||||
| CVE-2026-39835 | 1 Golang | 2 Crypto, Ssh | 2026-09-09 | 5.3 Medium |
| SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. | ||||
| CVE-2026-72949 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-09-08 | 7.5 High |
| Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-72939 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-08 | 6.5 Medium |
| Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-70575 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-09-08 | 5.3 Medium |
| Null pointer dereference in Windows Schannel allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-69881 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-08 | 7.5 High |
| Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-69744 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows Server 2025 | 2026-09-08 | 7.5 High |
| Null pointer dereference in Windows Kerberos allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-69587 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-09-08 | 7.5 High |
| Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-69384 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-08 | 7.1 High |
| Null pointer dereference in Virtual Hard Disk (VHD) Miniport Driver allows an unauthorized attacker to deny service locally. | ||||
| CVE-2026-66303 | 1 Microsoft | 3 Skype For Business Server 2015, Skype For Business Server 2019, Skype For Business Server Subscription Edition | 2026-09-08 | 6.5 Medium |
| Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-62762 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-08 | 6.5 Medium |
| Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-77901 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 8.8 High |
| Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-84392 | 1 Fortinet | 3 Fortios, Fortipam, Fortiproxy | 2026-09-08 | 2.5 Low |
| A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests. | ||||
| CVE-2026-82055 | 1 Mongodb | 1 Mongodb Server | 2026-09-08 | 6.5 Medium |
| A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service. | ||||