CVE-2026-55371

OpenEXR (the reference implementation for the EXR high-dynamic-range image format) versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level value pointer but fails to check that the nested type_hin...

CVE-2026-71922

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

CVE-2026-71920

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

CVE-2026-13213

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-74706

A flaw was found in the Linux kernel's bnge driver. During the setup of an auxiliary device, if the allocation of a specific resource auxrdev fails, the subsequent release process attempts to access an unallocated memory region. This results in a NULL pointer dereference, which can lead to a syst...

CVE-2026-74702

A flaw was found in the vhost-scsi component of the Linux kernel. This vulnerability allows a local attacker to cause a denial of service DoS by changing virtio feature bits after the vhost-scsi endpoint has been activated. Specifically, enabling the T10-PI feature after setup can lead to an...

CVE-2026-74684

A flaw was found in the Linux kernel's net: tap module. A NULL pointer dereference can occur in the tapgetuserxdp function when processing an XDP buffer with a GSO virtio-net header and a zero protocol. This can be triggered by a malicious guest in a virtualized environment, leading to a system...

CVE-2026-13213

Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server (subsys/bluetooth/audio/has.c) contains a NULL-pointer dereference in security_changed(). The connection-callback set is installed unconditionally via BT_CONN_CB_DEFINE, so the callback fires before the application calls bt_has_regist...

EUVD-2026-65003

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-71922

Multiple DrayTek VigorSwitch models are affected by a pre-authentication null pointer dereference in the setget.cgi interface. The root cause is missing validation when the pass field is absent from a request, allowing a remote unauthenticated attacker to crash the service via a crafted request, ...

CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

EUVD-2026-64981

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

CVE-2026-71920

DrayTek VigorSwitch (multiple models) contains a null pointer dereference in the formlogout function caused by missing validation of the Cookie header before string handling. A remote attacker with valid administrative credentials on the web management interface can send a crafted request to cras...

CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

EUVD-2026-64979

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

CVE-2026-47753

A flaw was found in Incus, a system container and virtual machine manager. An authenticated user with permissions to create instances in any project can remotely trigger a nil-pointer dereference by uploading a specially crafted backup tarball. This vulnerability causes the Incus daemon to panic...

CVE-2026-48754

A flaw was found in Incus, a system container and virtual machine manager. An authenticated user with cancreateinstances permission can crash the incusd daemon by uploading a specially crafted instance backup tarball. This vulnerability, a nil-pointer dereference, leads to a Denial of Service DoS...

CVE-2026-48756

A flaw was found in Incus, a system container and virtual machine manager. An authenticated user with cancreatestoragevolumes permission can crash the incusd daemon. This occurs by uploading a crafted backup tarball where the volumesnapshots.expiresat field is absent, leading to an unguarded...

CVE-2026-62377

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could provide a specially crafted HEIF sequence. Processing this malicious file could lead to a reachable assertion or dereference an empty map, resulting in a crash of the application. This...