CWE-170 · 42 records

Improper Null Termination

CVEs in this class

42 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
46Plan	CVE-2021-22931No exploit	Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validationnodejs · node.js · CWE-170 pre-auth RCE XSS	Critical9.8	—	22.0%	Aug 16, 2021
40Plan	CVE-2019-8275No exploit	UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being acuvnc · ultravnc · CWE-170 Pre-auth	Critical9.8	—	4.0%	Mar 8, 2019
40Plan	CVE-2021-31886No exploit	A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (siemens · nucleus net · CWE-170 Pre-auth	Critical9.8	—	3.0%	Nov 9, 2021
39Monitor	CVE-2021-31884No exploit	A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (siemens · capital vstar · CWE-170 Pre-auth	Critical9.8	—	1.5%	Nov 9, 2021
39Monitor	CVE-2021-1411No exploit	Cisco Jabber Desktop and Mobile Client Software Vulnerabilitiescisco · jabber · CWE-170 RCE	Critical9.9	—	1.4%	Mar 24, 2021
39Monitor	CVE-2026-42010No exploit	Gnutls: gnutls: authentication bypass via nul character in usernamegnu · gnutls · CWE-170 Pre-auth Auth bypass	Critical9.8	—	0.9%	May 7, 2026
39Monitor	CVE-2026-5067No exploit	Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Keyzephyrproject · zephyr · CWE-170 Pre-auth	Critical9.8	—	0.9%	Jun 9, 2026
39Monitor	CVE-2026-8721No exploit	Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLsjonasbn · crypt::openssl::pkcs12 · CWE-170 Pre-auth	Critical9.8	—	0.6%	May 17, 2026
36Monitor	CVE-2021-31887No exploit	A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (siemens · nucleus net · CWE-170	High8.8	—	2.4%	Nov 9, 2021
36Monitor	CVE-2021-31888No exploit	A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (siemens · nucleus net · CWE-170	High8.8	—	2.4%	Nov 9, 2021
33Monitor	CVE-2024-45288No exploit	Multiple vulnerabilities in libnvfreebsd · freebsd · CWE-170	High8.4	—	0.3%	Sep 5, 2024
32Monitor	CVE-2019-11044No exploit	link() silently truncates after a null byte on Windowsphp · php · CWE-170 Pre-auth	High7.5	—	5.1%	Dec 22, 2019
31Monitor	CVE-2023-36906No exploit	Windows Cryptographic Services Information Disclosure Vulnerabilitymicrosoft · windows 10 · CWE-170 Pre-auth	High7.5	—	2.0%	Aug 8, 2023
31Monitor	CVE-2023-36907No exploit	Windows Cryptographic Services Information Disclosure Vulnerabilitymicrosoft · windows 10 · CWE-170 Pre-auth	High7.5	—	1.7%	Aug 8, 2023
31Monitor	CVE-2024-21442No exploit	Windows USB Print Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 21h2 · CWE-170 Local privilege escalation	High7.8	—	0.8%	Mar 12, 2024
30Monitor	CVE-2024-43474No exploit	Microsoft SQL Server Information Disclosure Vulnerabilitymicrosoft · sql server 2017 · CWE-170 Pre-auth	High7.5	—	1.3%	Sep 10, 2024
30Monitor	CVE-2022-47515No exploit	An issue was discovered in drachtio-server before 0.8.20.drachtio · drachtio-server · CWE-170 Pre-auth Denial of service	High7.5	—	1.2%	Dec 18, 2022
30Monitor	CVE-2026-70587No exploit	Windows Remote Desktop Protocol Information Disclosure Vulnerabilitymicrosoft · windows 10 1607 · CWE-170 Pre-auth	High7.5	—	1.0%	Sep 8, 2026
30Monitor	CVE-2023-24021No exploit	Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer overtrustwave · modsecurity · CWE-170 Pre-auth	High7.5	—	0.9%	Jan 20, 2023
30Monitor	CVE-2024-31197No exploit	Improper Null Termination in libfluid_msg libraryopennetworking · libfluid msg · CWE-170 Pre-auth Denial of service	High7.5	—	0.3%	Sep 18, 2024
30Monitor	CVE-2025-67790No exploit	An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.drivelock · drivelock · CWE-170 Pre-auth Denial of service	High7.5	—	0.3%	Dec 17, 2025
29Monitor	CVE-2024-31484No exploit	A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communicatisiemens · cpc80 central processing/communication · CWE-170	High7.3	—	0.5%	May 14, 2024
28Monitor	CVE-2021-1469No exploit	Cisco Jabber Desktop and Mobile Client Software Vulnerabilitiescisco · jabber · CWE-170 RCE	High7.2	—	1.0%	Mar 24, 2021
28Monitor	CVE-2025-2026Proof of concept	The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a nullmoxa · nport 6100-g2/6200-g2 series · CWE-170	High7.1	—	0.4%	Dec 31, 2025
28Monitor	CVE-2021-1120No exploit	NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be pnvidia · virtual gpu · CWE-170	High7.0	—	0.2%	Oct 29, 2021

CVE-2021-22931
46Plan
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation
CriticalCVSS 9.8No exploitEPSS 22%
- pre-auth RCE
- XSS
nodejs · node.jsAug 16, 2021
CVE-2019-8275
40Plan
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being ac
CriticalCVSS 9.8No exploitEPSS 4%
- Pre-auth
uvnc · ultravncMar 8, 2019
CVE-2021-31886
40Plan
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (
CriticalCVSS 9.8No exploitEPSS 3%
- Pre-auth
siemens · nucleus netNov 9, 2021
CVE-2021-31884
39Monitor
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
siemens · capital vstarNov 9, 2021
CVE-2021-1411
39Monitor
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
CriticalCVSS 9.9No exploitEPSS 1%
- RCE
cisco · jabberMar 24, 2021
CVE-2026-42010
39Monitor
Gnutls: gnutls: authentication bypass via nul character in username
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
gnu · gnutlsMay 7, 2026
CVE-2026-5067
39Monitor
Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
zephyrproject · zephyrJun 9, 2026
CVE-2026-8721
39Monitor
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
jonasbn · crypt::openssl::pkcs12May 17, 2026
CVE-2021-31887
36Monitor
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (
HighCVSS 8.8No exploitEPSS 2%
siemens · nucleus netNov 9, 2021
CVE-2021-31888
36Monitor
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (
HighCVSS 8.8No exploitEPSS 2%
siemens · nucleus netNov 9, 2021
CVE-2024-45288
33Monitor
Multiple vulnerabilities in libnv
HighCVSS 8.4No exploitEPSS 0%
freebsd · freebsdSep 5, 2024
CVE-2019-11044
32Monitor
link() silently truncates after a null byte on Windows
HighCVSS 7.5No exploitEPSS 5%
- Pre-auth
php · phpDec 22, 2019
CVE-2023-36906
31Monitor
Windows Cryptographic Services Information Disclosure Vulnerability
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
microsoft · windows 10Aug 8, 2023
CVE-2023-36907
31Monitor
Windows Cryptographic Services Information Disclosure Vulnerability
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
microsoft · windows 10Aug 8, 2023
CVE-2024-21442
31Monitor
Windows USB Print Driver Elevation of Privilege Vulnerability
HighCVSS 7.8No exploitEPSS 1%
- Local privilege escalation
microsoft · windows 10 21h2Mar 12, 2024
CVE-2024-43474
30Monitor
Microsoft SQL Server Information Disclosure Vulnerability
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
microsoft · sql server 2017Sep 10, 2024
CVE-2022-47515
30Monitor
An issue was discovered in drachtio-server before 0.8.20.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
drachtio · drachtio-serverDec 18, 2022
CVE-2026-70587
30Monitor
Windows Remote Desktop Protocol Information Disclosure Vulnerability
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
microsoft · windows 10 1607Sep 8, 2026
CVE-2023-24021
30Monitor
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
trustwave · modsecurityJan 20, 2023
CVE-2024-31197
30Monitor
Improper Null Termination in libfluid_msg library
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
opennetworking · libfluid msgSep 18, 2024
CVE-2025-67790
30Monitor
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
drivelock · drivelockDec 17, 2025
CVE-2024-31484
29Monitor
A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communicati
HighCVSS 7.3No exploitEPSS 0%
siemens · cpc80 central processing/communicationMay 14, 2024
CVE-2021-1469
28Monitor
Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
HighCVSS 7.2No exploitEPSS 1%
- RCE
cisco · jabberMar 24, 2021
CVE-2025-2026
28Monitor
The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null
HighCVSS 7.1Proof of conceptEPSS 0%
moxa · nport 6100-g2/6200-g2 seriesDec 31, 2025
CVE-2021-1120
28Monitor
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be p
HighCVSS 7.0No exploitEPSS 0%
nvidia · virtual gpuOct 29, 2021

All vulnerability classes