weakness in Memory Corruption
NULL Pointer Dereference
42 disclosed reports · $15,320 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
- reports
- 42
- paid a bounty
- 17
Every one of the 42 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Null Pointer Dereference by Crafted Response from AI Model
- Null pointer dereference in SMTP server function smtp_string_parse
- NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset
- wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)
- Crash in mrb_ary_push
- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
- NULL dereference when encoding DN of x509 certificate
- NULL Pointer Dereference (DoS) in libcurl SFTP QUOTE command parsing due to missing return statement
- Null Dereference in X509ToObject
- CVE-2024-35200 in nginx
- csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC
- NULL pointer dereference in `mrb_check_frozen`
- Null pointer dereference in ary_concat
- Inappropriately parsing HTTP response leads to PHP segment fault!
- SIGSEGV in mrb_vm_exec
- NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEME
- Null pointer deference in call to `mail_get_flags`
- null dereference in `sieve_address_do_validate` (or redundant null check)
- null pointer dereference in Sass::Eval::operator()(Sass::Map*)
- SIGSEGV in mrb_class
- No Rate Limiting for Password Reset Email Leads to Email Flooding
- Denial of Service: nghttp2 use of uninitialized pointer
- null pointer dereference and segfault in tile-count-merge
- Information disclosure vulnerability on a DoD website
- SIGSEGV in mrb_vm_exec
- SIGSEGV in mrb_str_inum
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP