Total
4249 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-50422 | 1 Freedesktop | 1 Poppler | 2025-08-10 | 2.9 Low |
| Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c. | ||||
| CVE-2025-22037 | 1 Linux | 1 Linux Kernel | 2025-08-09 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete. | ||||
| CVE-2025-8735 | 2025-08-08 | 3.3 Low | ||
| A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-20339 | 1 Cisco | 1 Firepower Threat Defense Software | 2025-08-08 | 8.6 High |
| A vulnerability in the TLS processing feature of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an issue that occurs when TLS traffic is processed. An attacker could exploit this vulnerability by sending certain TLS traffic over IPv4 through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition and impacting traffic to and through the affected device. | ||||
| CVE-2023-32171 | 1 Unified-automation | 1 Uagateway | 2025-08-08 | N/A |
| Unified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability. The specific flaw exists within the ImportCsv method. A crafted XML payload can cause a null pointer dereference. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20495. | ||||
| CVE-2025-50952 | 2025-08-07 | 6.5 Medium | ||
| openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c. | ||||
| CVE-2025-47807 | 2025-08-07 | 5.6 Medium | ||
| In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. | ||||
| CVE-2025-47808 | 2025-08-07 | 5.6 Medium | ||
| In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. | ||||
| CVE-2022-3109 | 3 Debian, Fedoraproject, Ffmpeg | 3 Debian Linux, Fedora, Ffmpeg | 2025-08-07 | 7.5 High |
| An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability. | ||||
| CVE-2022-3341 | 2 Debian, Ffmpeg | 2 Debian Linux, Ffmpeg | 2025-08-07 | 5.3 Medium |
| A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash. | ||||
| CVE-2024-53024 | 1 Qualcomm | 332 Ar8035, Ar8035 Firmware, Csra6620 and 329 more | 2025-08-07 | 7.8 High |
| Memory corruption in display driver while detaching a device. | ||||
| CVE-2023-24847 | 1 Qualcomm | 514 315 5g Iot Modem, 315 5g Iot Modem Firmware, Aqt1000 and 511 more | 2025-08-07 | 7.5 High |
| Transient DOS in Modem while allocating DSM items. | ||||
| CVE-2023-33088 | 1 Qualcomm | 612 315 5g Iot Modem, 315 5g Iot Modem Firmware, Aqt1000 and 609 more | 2025-08-07 | 8.4 High |
| Memory corruption when processing cmd parameters while parsing vdev. | ||||
| CVE-2023-33089 | 1 Qualcomm | 456 315 5g Iot Modem, 315 5g Iot Modem Firmware, Aqt1000 and 453 more | 2025-08-07 | 7.5 High |
| Transient DOS when processing a NULL buffer while parsing WLAN vdev. | ||||
| CVE-2023-43522 | 1 Qualcomm | 572 Aqt1000, Aqt1000 Firmware, Ar8035 and 569 more | 2025-08-07 | 7.5 High |
| Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL. | ||||
| CVE-2023-33109 | 1 Qualcomm | 620 315 5g Iot Modem, 315 5g Iot Modem Firmware, Aqt1000 and 617 more | 2025-08-07 | 7.5 High |
| Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host. | ||||
| CVE-2025-21433 | 1 Qualcomm | 551 215 Mobile, 215 Mobile Firmware, Apq8017 and 548 more | 2025-08-07 | 6.2 Medium |
| Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus. | ||||
| CVE-2025-48965 | 2 Arm, Mbed | 2 Mbed Tls, Mbedtls | 2025-08-07 | 4 Medium |
| Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero. | ||||
| CVE-2019-9923 | 2 Gnu, Opensuse | 2 Tar, Leap | 2025-08-06 | 7.5 High |
| pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. | ||||
| CVE-2025-8586 | 1 Libav | 1 Libav | 2025-08-06 | 3.3 Low |
| A vulnerability, which was classified as problematic, was found in libav up to 12.3. This affects the function ff_seek_frame_binary of the file /libavformat/utils.c of the component MPEG File Parser. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The bug was initially reported by the researcher to the wrong project. This vulnerability only affects products that are no longer supported by the maintainer. | ||||