Monthly
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.
NULL pointer dereference in Samsung mTower's TEE kernel allows a Non-Secure caller to crash the secure world by supplying an invalid, zero, or stale session ID to the ioctl invoke path. The flaw exists in tee_ioctl_invoke() (entry_std.c) and tee_ta_invoke_command() (tee_ta_manager.c), where find_session() returns NULL without a guard before dereferencing sess->ctx, causing a secure-world fault. All mTower versions prior to commit afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a are affected; no public exploit has been identified at time of analysis.
Null pointer dereference in FLVMeta up to 1.2.2 causes a process crash when parsing a malformed AMF object from a crafted FLV file, resulting in denial of service. The flaw resides in `amf_object_get` (and the parallel `amf_object_set`) in `src/amf.c`, where a chained double dereference `node->next->next` executes without first confirming `node->next` is non-NULL. A public SEGV proof-of-concept exists, though the project maintainer disputes the security relevance, stating no exploitation path beyond a crash has been demonstrated. No CISA KEV listing; no public exploit identified at time of analysis beyond the crash reproducer.
Null pointer dereference in armink struct2json 1.0 allows remote attackers to crash any application that deserializes attacker-controlled JSON through the library's `S2J_STRUCT_GET_string_ELEMENT` function. The root cause is an absence of null validation on the `valuestring` field during JSON deserialization in `struct2json/inc/s2jdef.h`, yielding a remotely triggerable denial-of-service. A public proof-of-concept exploit has been disclosed on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
NULL pointer dereference in TP-Link TL-WR841N v14's UPnP service allows adjacent-network attackers to crash the UPnP process by sending a specially crafted SOAP state variable query, resulting in a denial-of-service condition. The affected UPnP functionality - including device discovery and state management - remains unavailable until the process is restarted or the device is rebooted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
NULL pointer dereference in the UPnP SOAP request handler of the TP-Link TL-WR841N v14 allows an adjacent-network attacker to crash the UPnP daemon by sending a crafted SOAP action request with unexpected XML content, producing a denial-of-service condition until the service is restarted or the device rebooted. Impact is confined to UPnP functionality; the router itself continues operating. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. TP-Link has released a firmware patch addressing this flaw.
Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.
Null pointer dereference in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allows remote authenticated attackers to crash the web management interface by sending a crafted request. The web_poe_alive_rmtip_post handler in /cgi-bin/dispatcher.cgi dereferences the rmtIP POST parameter without first validating its presence, meaning a missing parameter is dereferenced as NULL, faulting the CGI process and rendering the web management interface unavailable. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the trigger is trivially simple - a single omitted parameter - for any attacker already holding administrative credentials.
NULL pointer dereference in Wazuh agent enrollment (versions 4.0.0-4.14.6) allows a network-positioned attacker operating a rogue manager or performing a man-in-the-middle attack to deterministically crash the agent process by supplying a malformed key response containing fewer than four space-separated fields. The flaw resides in `w_enrollment_process_agent_key()` in `src/shared/enrollment_op.c`, which passes unvalidated NULL entries from `OS_StrBreak()` directly into `OS_IsValidName()`, where an unguarded `strlen()` call on a NULL pointer terminates the agent. The attack is constrained by high complexity conditions (no CA certificate configured, or active MITM capability), and no public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in Wazuh 4.14.7.
NULL pointer dereference in free5gc v4.0.1's UDMC registration handler exposes remote unauthenticated attackers to crashing the 5G core network process by submitting a specially crafted registration payload, resulting in complete availability loss of the affected network function. Any deployment with a network-accessible UDMC registration interface running free5gc v4.0.1 is at risk. No public exploit has been identified at time of analysis; EPSS exploitation probability is very low at 0.15% (4th percentile), consistent with the niche, research-oriented deployment footprint of this product.
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.
NULL pointer dereference in Samsung mTower's TEE kernel allows a Non-Secure caller to crash the secure world by supplying an invalid, zero, or stale session ID to the ioctl invoke path. The flaw exists in tee_ioctl_invoke() (entry_std.c) and tee_ta_invoke_command() (tee_ta_manager.c), where find_session() returns NULL without a guard before dereferencing sess->ctx, causing a secure-world fault. All mTower versions prior to commit afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a are affected; no public exploit has been identified at time of analysis.
Null pointer dereference in FLVMeta up to 1.2.2 causes a process crash when parsing a malformed AMF object from a crafted FLV file, resulting in denial of service. The flaw resides in `amf_object_get` (and the parallel `amf_object_set`) in `src/amf.c`, where a chained double dereference `node->next->next` executes without first confirming `node->next` is non-NULL. A public SEGV proof-of-concept exists, though the project maintainer disputes the security relevance, stating no exploitation path beyond a crash has been demonstrated. No CISA KEV listing; no public exploit identified at time of analysis beyond the crash reproducer.
Null pointer dereference in armink struct2json 1.0 allows remote attackers to crash any application that deserializes attacker-controlled JSON through the library's `S2J_STRUCT_GET_string_ELEMENT` function. The root cause is an absence of null validation on the `valuestring` field during JSON deserialization in `struct2json/inc/s2jdef.h`, yielding a remotely triggerable denial-of-service. A public proof-of-concept exploit has been disclosed on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
NULL pointer dereference in TP-Link TL-WR841N v14's UPnP service allows adjacent-network attackers to crash the UPnP process by sending a specially crafted SOAP state variable query, resulting in a denial-of-service condition. The affected UPnP functionality - including device discovery and state management - remains unavailable until the process is restarted or the device is rebooted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
NULL pointer dereference in the UPnP SOAP request handler of the TP-Link TL-WR841N v14 allows an adjacent-network attacker to crash the UPnP daemon by sending a crafted SOAP action request with unexpected XML content, producing a denial-of-service condition until the service is restarted or the device rebooted. Impact is confined to UPnP functionality; the router itself continues operating. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. TP-Link has released a firmware patch addressing this flaw.
Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.
Null pointer dereference in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allows remote authenticated attackers to crash the web management interface by sending a crafted request. The web_poe_alive_rmtip_post handler in /cgi-bin/dispatcher.cgi dereferences the rmtIP POST parameter without first validating its presence, meaning a missing parameter is dereferenced as NULL, faulting the CGI process and rendering the web management interface unavailable. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the trigger is trivially simple - a single omitted parameter - for any attacker already holding administrative credentials.
NULL pointer dereference in Wazuh agent enrollment (versions 4.0.0-4.14.6) allows a network-positioned attacker operating a rogue manager or performing a man-in-the-middle attack to deterministically crash the agent process by supplying a malformed key response containing fewer than four space-separated fields. The flaw resides in `w_enrollment_process_agent_key()` in `src/shared/enrollment_op.c`, which passes unvalidated NULL entries from `OS_StrBreak()` directly into `OS_IsValidName()`, where an unguarded `strlen()` call on a NULL pointer terminates the agent. The attack is constrained by high complexity conditions (no CA certificate configured, or active MITM capability), and no public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in Wazuh 4.14.7.
NULL pointer dereference in free5gc v4.0.1's UDMC registration handler exposes remote unauthenticated attackers to crashing the 5G core network process by submitting a specially crafted registration payload, resulting in complete availability loss of the affected network function. Any deployment with a network-accessible UDMC registration interface running free5gc v4.0.1 is at risk. No public exploit has been identified at time of analysis; EPSS exploitation probability is very low at 0.15% (4th percentile), consistent with the niche, research-oriented deployment footprint of this product.