cve-2021-3449

CVE-2021-3449 OpenSSL This issue was reported to OpenSSL on 17th March 2021 by Nokia. The fix was developed by Peter Kästle and Samuel Sapalski from Nokia. Mitigation The only known fix is to update libssl1.1. Even though some applications use hardened TLS configurations by default that disable T...

CVE-2026-112405

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...

wasm2c-tableflip

wasm2c sandbox escape: guest module runs a shell command on the host Read the blog: trustsig.eu/blog wasmrtallocatefuncreftable in wasm2c/wasm-rt-impl-tableops.inc sets table-size from the module's declared element count and then ignores the result of calloc. When the allocation fails the table i...

CVE-2026-112405

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC fil...

CVE-2026-98537

A flaw was found in the Linux kernel's workqueue subsystem. A local attacker can cause a Denial of Service DoS by inducing memory pressure that triggers an out-of-memory notification. During subsequent dependency checks, a worker thread not actively running a task dereferences a null pointer,...

CVE-2026-112405

The Pillow Python imaging library versions 12.0.0 through 13.0.0 contain a NULL pointer dereference vulnerability in the Image.merge() function. The root cause is that validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged a...

CVE-2026-112405

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC fil...

CVE-2026-112405 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC fil...

CVE-2026-76787

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

EUVD-2026-104599

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

CVE-2026-76787

The UpdateHub firmware-over-the-air (FOTA) client in Zephyr is vulnerable to a NULL pointer dereference within the z_impl_updatehub_probe() function. The issue occurs because the JSON decoder treats the sha256sum field as optional; if a network peer omits this string in a CoAP probe response, the...

CVE-2026-76787 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

CVE-2025-52290

A flaw was found in ffmpeg. An attacker could exploit this vulnerability by providing a crafted media file to be processed by the application. This issue triggers a NULL pointer dereference in the avprivh264hasnumreorderframes function, leading to an unexpected application crash and resulting in ...

CVE-2022-34683

CVE-2022-34683 NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape, where a null-pointer dereference occurs, which may lead to denial of service. authentication| complexity| vector ---|---|--- not available| not available|...

CVE-2026-112259

A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application...

CVE-2026-66859

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by triggering an application crash due to improper memory handling in the C GLib bindings. This vulnerability stems from an uninitialized variable and a null pointer dereference during data processing...

CVE-2026-98467

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for ARM64 architecture. A race condition during the teardown of nested virtual machine memory mappings can cause the kernel to dereference a null pointer. A local user or nested guest can trigger concurrent memory...

CVE-2026-112259

A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application. Mitigation Avoid importing untrusted SBZ palette files. If GIMP is unused, remove the gi...

EUVD-2026-104572

A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application...

CVE-2026-112259

A flaw in GIMP allows for a NULL pointer dereference during the import of a crafted SBZ palette file. Specifically, if the palette lacks a color-model attribute , the application triggers a null pointer dereference during a string comparison operation. This vulnerability leads to a denial of serv...