78511 matches found
CVE-2026-82357 RT-Labs AB C-Open CANopen NULL pointer dereference
RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromise...
CVE-2026-31431
CVE-2026-31431 — NULLポインタからrootへ：LinuxカーネルのAFALG AEADを悪用する バグクラス: NULLポインタ参照 → ヒープOOB書き込み → 資格情報の上書き 影響を受けるサブシステム: net/alg/afalg.c 影響: ローカル権限昇格（非特権ユーザー → root） 影響を受けるカーネル: Linux 4.4 – 4.9（パッチ適用前） 概要 カーネルがユーザー空間アドレスを期待する場所に、NULLポインタを指定してsetsockoptを呼び出します。カーネルはアドレス0x00000000から読み取ります —...
CVE-2025-24990_POC
Windows Agere Modem ドライバー（ltmdm64.sys）。このドライバーは非常に古く、私のテストマシンではデフォルトで読み込まれないため、BYOVDシナリオで悪用します。興味深いことに、私の調査によると、このドライバーはWindows 7に存在し、少なくとも1つのバグがあります。こちら 当時、MSRCは何の対応も取りませんでした 🤡 脆弱性...
CVE-2026-9032
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations...
CVE-2026-9032 Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations...
CVE-2026-9032 Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations...
EUVD-2026-90980
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations...
CVE-2026-9032
The Tapo C120 v1 and C200 v5 cameras are vulnerable to a NULL pointer dereference within the HTTPS onboarding connect request parser. The flaw exists because the interface—accessible without authentication after initial setup—fails to validate the presence of a password field for specific authent...
CVE-2026-47563
A flaw was found in xorg-x11-drv-nvidia. A local user can trigger an invalid memory access NULL pointer dereference in the driver's kernel mode layer. A successful exploit could allow an attacker to execute arbitrary code with elevated system privileges, access sensitive information, or cause a...
DEBIAN-CVE-2026-63686
A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...
CVE-2026-63686
A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...
CVE-2026-23398
CVE-2026-23398 Linuxカーネル icmptagvalidation ヌルポインタ参照（リモートDoS） 説明 net/ipv4/icmp.c の icmptagvalidation は、inetprotosproto をNULLチェックなしで参照します。リモートの攻撃者は、未登録の内部プロトコル番号を持つ単一の細工されたICMP Fragmentation Neededパケットを送信することで、softirqコンテキストでカーネルをクラッシュさせることができます。 影響を受けるバージョン: コミット 614aefe56af8（mainline）/...
wasm2c-tableflip
wasm2c サンドボックスエスケープ: ゲストモジュールがホスト上でシェルコマンドを実行する ブログを読む: trustsig.eu/blog wasm2c/wasm-rt-impl-tableops.inc 内の wasmrtallocatefuncreftable は、 table-size をモジュールが宣言した要素数から設定し、calloc の戻り値を無視します。 割り当てが失敗すると、テーブルは data == NULL のまま、宣言された完全な size を持つため、 すべての境界チェックは依然として通過し、table-datai は絶対アドレス i...
CVE-2026-63686
The Apache HTTP Server (versions before 2.4.69 ) is vulnerable to a NULL pointer dereference within the mod_xml2enc module. An untrusted backend server can trigger a Denial of Service (DoS) by returning a crafted response with a character set that partially succeeds and then fails during conversi...
CVE-2026-63686
A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...
CVE-2026-63686 Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...
CVE-2026-63686
A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...
EUVD-2026-90912
A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...