google-poc

To reporoduce the CVE-2025-13425 just follow the steps below: Step 1: Clone the fresh osv-scalibr source code: $ git clone https://github.com/google/osv-scalibr Step 2: Remove the code mentioned in fix commit https://github.com/google/osv-scalibr/commit/e67c4e198ca099cb7c16957a80f6c5331d90a672 St...

CVE-2026-29781

Architectural vulnerability in the Sliver C2 server allows for Reverse-C2 Weaponization. By extracting credentials from a captured implant, a defender can weaponize the C2 relationship to trigger a remote Infrastructure Kill-Switch. This exploitation targets a systemic lack of nil-pointer...

CVE-2026-123507

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...

CVE-2026-123507

The project management software Vikunja (versions 0.24.0 before 2.7.1) is vulnerable to a nil pointer dereference (CWE-476) in its bucket filter handling. Project admins can trigger a Denial of Service (DoS) by saving a filter-mode bucket configuration containing a null filter. Because the valida...

CVE-2026-123507 Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...

EUVD-2026-119392

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...

CVE-2026-123507 Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...

CVE-2026-123507: go-vikunja vikunja: Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break…

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...

PT-2026-139788

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...

LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at

Summary sibling-field variant of CVE-2026-40197 fix 05bc272 lxdBackend.CreateCustomVolumeFromBackup in lxd/storage/backendlxd.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with...

CVE-2026-123492

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a...

CVE-2026-123492

SiYuan versions prior to 3.8.9 are vulnerable to a nil pointer dereference within the privateCacheMiddleware component. This flaw allows authenticated attackers possessing a valid API token to crash the kernel by sending a resources/read request during an initialized MCP session. Specifically, at...

EUVD-2026-118292

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a...

CVE-2026-123492 SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a...

CVE-2026-123492 SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a...

CVE-2026-123492 SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a...

CVE-2026-123492: siyuan-note siyuan: SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows…

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a...

CLEANSTART-2026-YC88588 nil pointer dereference in the golang

Security vulnerability affects the nodetaint package. A nil pointer dereference in the golang...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...