Skip to content
BackEsc
Sign in

CWE-170 · weakness in Memory Corruption

Improper Null Termination

52 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

likely to be exploited
1

Every one of the 52 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name…CVE-2021-22931NodeJS · 22% likely

    Node.js

  2. DirectoryIterator class silently truncates after a null byteCVE-2019-11045PHP Group · CVSS 3.7 · 8.8% likely

    PHP

  3. Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packetCVE-2026-121943irontec · CVSS 4.8 · 5.6% likely

    Irontec

  4. link() silently truncates after a null byte on WindowsCVE-2019-11044PHP Group · CVSS 3.7 · 5.1% likely

    PHP

  5. UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote users. This attack app…CVE-2019-8275Kaspersky Lab · 4.0% likely

    Kaspersky Lab

  6. A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet)…CVE-2020-27736Siemens · CVSS 6.5 · 4.0% likely

    Siemens

  7. A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…CVE-2021-31886Siemens · 3.1% likelycovered by CyberSIXT

    Siemens1 article

  8. get_headers() silently truncates after a null byteCVE-2020-7066PHP Group · CVSS 5.3 · 2.7% likely

    PHP

  9. A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…CVE-2021-31888Siemens · 2.4% likely

    Siemens

  10. A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…CVE-2021-31887Siemens · 2.4% likely

    Siemens

  11. Windows Cryptographic Services Information Disclosure VulnerabilityCVE-2023-36906Microsoft · CVSS 5.5 · 2.0% likely

    Microsoft

  12. Windows Cryptographic Services Information Disclosure VulnerabilityCVE-2023-36907Microsoft · CVSS 5.5 · 1.7% likely

    Microsoft

  13. Windows Deployment Services Denial of Service VulnerabilityCVE-2023-35321Microsoft · CVSS 6.5 · 1.6% likely

    Microsoft

  14. A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…CVE-2021-31884Siemens · 1.5% likely

    Siemens

  15. Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCVE-2021-1411Cisco · CVSS 9.9 · 1.4% likely

    Cisco

  16. Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCVE-2021-1471Cisco · CVSS 9.9 · 1.4% likely

    Cisco

  17. Microsoft SQL Server Information Disclosure VulnerabilityCVE-2024-43474Microsoft · CVSS 7.6 · 1.3% likely

    Microsoft

  18. An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to…CVE-2022-47515CVSS 7.5 · 1.2% likely
  19. Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCVE-2021-1469Cisco · CVSS 9.9 · 1.1% likely

    Cisco

  20. Gnutls: gnutls: authentication bypass via nul character in usernameCVE-2026-42010Red Hat · CVSS 7.1 · 1.1% likely

    Red Hat

  21. Windows Remote Desktop Protocol Information Disclosure VulnerabilityCVE-2026-70587Microsoft · CVSS 7.5 · 1.0% likely

    Microsoft

  22. Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCVE-2021-1417Cisco · CVSS 9.9 · 1.0% likely

    Cisco

  23. Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCVE-2021-1418Cisco · CVSS 9.9 · 1.0% likely

    Cisco

  24. Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall…CVE-2023-24021Trustwave · CVSS 7.5 · 0.9% likely
  25. Windows USB Print Driver Elevation of Privilege VulnerabilityCVE-2024-21442Microsoft · CVSS 7.8 · 0.8% likely

    Microsoft

  26. Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-KeyCVE-2026-5067zephyrproject-rtos · CVSS 9.8 · 0.6% likely

    Zephyrproject-Rtos

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in