52220 matches found
CVE-2026-13213
Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server (subsys/bluetooth/audio/has.c) contains a NULL-pointer dereference in security_changed(). The connection-callback set is installed unconditionally via BT_CONN_CB_DEFINE, so the callback fires before the application calls bt_has_regist...
CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register
The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...
CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...
EUVD-2026-64981
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...
CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...
CVE-2026-71922
Multiple DrayTek VigorSwitch models are affected by a pre-authentication null pointer dereference in the setget.cgi interface. The root cause is missing validation when the pass field is absent from a request, allowing a remote unauthenticated attacker to crash the service via a crafted request, ...
CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout
Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...
CVE-2026-71920
DrayTek VigorSwitch (multiple models) contains a null pointer dereference in the formlogout function caused by missing validation of the Cookie header before string handling. A remote attacker with valid administrative credentials on the web management interface can send a crafted request to cras...
CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout
Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...
EUVD-2026-64979
Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...
JLSEC-2026-1386
HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...
CVE-2026-74610
A flaw was found in the Linux kernel's Transport Layer Security TLS implementation. An unprivileged local user could trigger a kernel null pointer dereference by sending specific data on a loopback TCP socket with the TLS Upper Layer Protocol ULP attached. This vulnerability occurs because the TL...
CVE-2026-74732
A flaw was found in the Linux kernel's AMD display drm/amd/display driver. When a user turns off the display over HDMI on systems with older DCE timing generators, the driver attempts to call a function istgenabled that may not be implemented. This unconditional call can lead to a NULL pointer...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during the peek operation, it calls qdisctreereducebacklog. A problem arises because it calls...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removing the registration. The rpcrdmacreateid function registers ep-rern with the rbclient, before returning the new rdmacmid to rpcrdmaepcreate. However, rpcrdmaepcreate currently stores that...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: AppArmor: Fixed a NULL pointer dereferencing in unpackpdb. pdb-dfa can become NULL if unpackdfa fails, resulting in a NULL pointer dereferencing...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: usb: dwc3-meson-g12a: Fixed an issue where the USB2 PHY glue initialization was performed when PHY0 was disabled. When only PHY1 is used for example, on Odroid-HC4, the regmap initialization code uses USB2 ports without...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: uprobes: Fixed a NULL pointer dereference in hprobeexpire. Forking a task that has a pending uretprobe can lead to an error in the kernel, involving a NULL pointer dereference in the clone function path: - Bug: NULL pointer...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Invalid indirect BO handle is rejected during indirect CSD setup. The function v3dgetcpuindirectcsdparams looks up the indirect buffer object from a handle provided by the user space. However, it never checks the result....
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: Rejects option groups without values. The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and provides only a recognized option name, such as “cachemode”, will...