CWE-170 · Memory Corruption
Improper Null Termination
52CVEs
SortMost likely exploited
52 CVEs with CWE-170 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-22931Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name…NodeJS · Node · 2021-08-16 | – | 22% | 2021-08-16 |
| CVE-2019-11045DirectoryIterator class silently truncates after a null bytePHP Group · PHP · CVSS 3.7 · 2019-12-23 | 3.7 | 8.8% | 2019-12-23 |
| CVE-2026-121943Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packetirontec · sngrep · CVSS 4.8 · 2026-11-04 | 4.8 | 5.6% | 2026-11-04 |
| CVE-2019-11044link() silently truncates after a null byte on WindowsPHP Group · PHP · CVSS 3.7 · 2019-12-23 | 3.7 | 5.1% | 2019-12-23 |
| CVE-2019-8275UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote users. This attack app…Kaspersky Lab · UltraVNC · 2019-03-09 | – | 4.0% | 2019-03-09 |
| CVE-2020-27736A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet)…Siemens · APOGEE PXC Compact (BACnet) · CVSS 6.5 · 2021-04-22 | 6.5 | 4.0% | 2021-04-22 |
| CVE-2021-31886A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…Siemens · APOGEE MBC (PPC) (BACnet) · 2021-11-09 | – | 3.1% | 2021-11-09 |
| CVE-2020-7066get_headers() silently truncates after a null bytePHP Group · PHP · CVSS 5.3 · 2020-04-01 | 5.3 | 2.7% | 2020-04-01 |
| CVE-2021-31888A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…Siemens · APOGEE MBC (PPC) (BACnet) · 2021-11-09 | – | 2.4% | 2021-11-09 |
| CVE-2021-31887A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…Siemens · APOGEE MBC (PPC) (BACnet) · 2021-11-09 | – | 2.4% | 2021-11-09 |
| CVE-2023-36906Windows Cryptographic Services Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 5.5 · 2023-08-08 | 5.5 | 2.0% | 2023-08-08 |
| CVE-2023-36907Windows Cryptographic Services Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 5.5 · 2023-08-08 | 5.5 | 1.7% | 2023-08-08 |
| CVE-2023-35321Windows Deployment Services Denial of Service VulnerabilityMicrosoft · Windows Server 2019 · CVSS 6.5 · 2023-07-11 | 6.5 | 1.6% | 2023-07-11 |
| CVE-2021-31884A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…Siemens · APOGEE MBC (PPC) (BACnet) · 2021-11-09 | – | 1.5% | 2021-11-09 |
| CVE-2021-1411Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2021-03-24 | 9.9 | 1.4% | 2021-03-24 |
| CVE-2021-1471Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2021-03-24 | 9.9 | 1.4% | 2021-03-24 |
| CVE-2024-43474Microsoft SQL Server Information Disclosure VulnerabilityMicrosoft · Microsoft SQL Server 2017 (CU 31) · CVSS 7.6 · 2024-09-10 | 7.6 | 1.3% | 2024-09-10 |
| CVE-2022-47515An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to…Drachtio · Drachtio-Server · CVSS 7.5 · 2022-12-18 | 7.5 | 1.2% | 2022-12-18 |
| CVE-2021-1469Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2021-03-24 | 9.9 | 1.1% | 2021-03-24 |
| CVE-2026-42010Gnutls: gnutls: authentication bypass via nul character in usernameRed Hat · gnutls · CVSS 7.1 · 2026-05-07 | 7.1 | 1.1% | 2026-05-07 |
| CVE-2026-70587Windows Remote Desktop Protocol Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2026-09-08 | 7.5 | 1.0% | 2026-09-08 |
| CVE-2021-1417Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2021-03-24 | 9.9 | 1.0% | 2021-03-24 |
| CVE-2021-1418Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco · Cisco Jabber · CVSS 9.9 · 2021-03-24 | 9.9 | 1.0% | 2021-03-24 |
| CVE-2023-24021Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall…Trustwave · Modsecurity · CVSS 7.5 · 2023-01-20 | 7.5 | 0.9% | 2023-01-20 |
| CVE-2024-21442Windows USB Print Driver Elevation of Privilege VulnerabilityMicrosoft · Windows Server 2022 · CVSS 7.8 · 2024-03-12 | 7.8 | 0.8% | 2024-03-12 |
| CVE-2026-5067Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Keyzephyrproject-rtos · Zephyr · CVSS 9.8 · 2026-06-09 | 9.8 | 0.6% | 2026-06-09 |
| CVE-2020-14323A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the win…Samba · Samba · CVSS 5.5 · 2020-10-29 | 5.5 | 0.6% | 2020-10-29 |
| CVE-2023-28263Visual Studio Information Disclosure VulnerabilityMicrosoft · Microsoft Visual Studio 2022 version 17.2 · CVSS 5.5 · 2023-04-11 | 5.5 | 0.6% | 2023-04-11 |
| CVE-2026-78506Microsoft Office Word Information Disclosure VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 5.5 · 2026-09-08 | 5.5 | 0.5% | 2026-09-08 |
| CVE-2026-2239Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflowRed Hat · Red Hat Enterprise Linux 7 · CVSS 2.8 · 2026-03-26 | 2.8 | 0.5% | 2026-03-26 |
| CVE-2023-48674Dell Platform BIOS contains an Improper Null Termination vulnerability. A high privilege user with network access to the system could potentially send malicious data to the device…Dell · CPG BIOS · CVSS 6.8 · 2024-03-01 | 6.8 | 0.5% | 2024-03-01 |
| CVE-2026-34032Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)Apache Software Foundation · Apache HTTP Server · CVSS 5.3 · 2026-05-04 | 5.3 | 0.5% | 2026-05-04 |
| CVE-2024-31484A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Centr…Siemens · CPC80 Central Processing/Communication · CVSS 7.8 · 2024-05-14 | 7.8 | 0.5% | 2024-05-14 |
| CVE-2026-8721Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLsJONASBN · Crypt::OpenSSL::PKCS12 · CVSS 9.8 · 2026-05-17 | 9.8 | 0.4% | 2026-05-17 |
| CVE-2025-2026The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection through the device’s we…Moxa · NPort 6100-G2/6200-G2 Series · CVSS 7.1 · 2025-12-31 | 7.1 | 0.4% | 2025-12-31 |
| CVE-2026-114457Mod_qos: missing nul termination in json value escaping permits out-of-bounds readspbuchbinder · mod_qos · CVSS 3.7 · 2026-10-22 | 3.7 | 0.4% | 2026-10-22 |
| CVE-2026-83781Windows Program Compatibility Assistant Service Elevation of Privilege VulnerabilityMicrosoft · Windows 11 version 23H2 · CVSS 7.8 · 2026-10-13 | 7.8 | 0.4% | 2026-10-13 |
| CVE-2024-31197Improper Null Termination in libfluid_msg libraryOpen Networking Foundation (ONF) · libfluid · CVSS 5.3 · 2024-09-18 | 5.3 | 0.3% | 2024-09-18 |
| CVE-2025-67790An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Screen Of Death (BSOD) on…Drivelock · Drivelock · CVSS 9.8 · 2025-12-17 | 9.8 | 0.3% | 2025-12-17 |
| CVE-2024-45288Multiple vulnerabilities in libnvFreeBSD · FreeBSD · CVSS 8.4 · 2024-09-05 | 8.4 | 0.3% | 2024-09-05 |
| CVE-2026-116321PostgreSQL unterminated name value discloses server memoryPostgreSQL · CVSS 4.3 · 2026-11-12 | 4.3 | 0.3% | 2026-11-12 |
| CVE-2026-33948jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Inputjqlang · jq · CVSS 2.9 · 2026-04-13 | 2.9 | 0.3% | 2026-04-13 |
| CVE-2026-32837mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsingmackron · miniaudio · CVSS 4 · 2026-03-17 | 4.0 | 0.3% | 2026-03-17 |
| CVE-2021-1120NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be properly null terminated. The guest OS o…NVIDIA · NVIDIA Virtual GPU Software · CVSS 7 · 2021-10-29 | 7.0 | 0.2% | 2021-10-29 |
| CVE-2026-40334libgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.cgphoto · libgphoto2 · CVSS 3.5 · 2026-04-17 | 3.5 | 0.2% | 2026-04-17 |
| CVE-2026-23749Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds ReadGolioth · Firmware SDK · CVSS 2.9 · 2026-02-26 | 2.9 | 0.2% | 2026-02-26 |
| CVE-2026-63860RDMA/core: Prefer NLA_NUL_STRINGLinux · Linux · CVSS 8.4 · 2026-07-19 | 8.4 | 0.2% | 2026-07-19 |
| CVE-2025-66220Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byteenvoyproxy · envoy · CVSS 5 · 2025-12-03 | 5.0 | 0.2% | 2025-12-03 |
| CVE-2026-72095dma-fence: Make dma_fence_dedup_array() robust against 0-count inputLinux · Linux · CVSS 7.8 · 2026-08-15 | 7.8 | 0.2% | 2026-08-15 |
| CVE-2026-12386Buffer Overflow in TUBITAK BILGEM's Pardus PenTUBITAK BILGEM Software Technologies Research Institute · Pardus Pen · CVSS 3.9 · 2026-07-05 | 3.9 | 0.1% | 2026-07-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.