# CWE-170. Every Advisory and CVE whose sources give the weakness CWE-170, newest first. ## Records, newest first - [Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet](https://agentprime.io/advisories/CVE-2026-121943.md) `CVE-2026-121943` · CVE record: irontec sngrep · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-170 - [Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser](https://agentprime.io/advisories/CVE-2026-57185.md) `CVE-2026-57185` · CVE record: asterisk asterisk and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-126, CWE-170 - [Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads](https://agentprime.io/advisories/CVE-2026-114457.md) `CVE-2026-114457` · CVE record: pbuchbinder mod_qos · CVSS 3.7 Low · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-170 - [Windows Modern Device Management (MDM) Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-96850.md) `CVE-2026-96850` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption, CWE-170 - [Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83781.md) `CVE-2026-83781` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-170 - [Windows USB Print Driver Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-96860.md) `CVE-2026-96860` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption, CWE-170 - [radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser](https://agentprime.io/advisories/CVE-2026-81882.md) `CVE-2026-81882` · CVE record: radareorg radare2 · CVSS 3.3 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption, CWE-170 - [VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability](https://agentprime.io/advisories/CVE-2026-73324.md) `CVE-2026-73324` · CVE record: VideoLAN VLC media player · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption, CWE-170 - [Microsoft Office Word Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-78506.md) `CVE-2026-78506` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-170 - [Windows Remote Desktop Protocol Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70587.md) `CVE-2026-70587` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-170 - [Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field](https://agentprime.io/advisories/CVE-2026-45798.md) `CVE-2026-45798` · CVE record: wazuh wazuh · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption, CWE-170 - [dma-fence: Make dma_fence_dedup_array() robust against 0-count input](https://agentprime.io/advisories/CVE-2026-72095.md) `CVE-2026-72095` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 15 Aug 2026 · Tags: CWE-170 - [RDMA/core: Prefer NLA_NUL_STRING](https://agentprime.io/advisories/CVE-2026-63860.md) `CVE-2026-63860` · CVE record: Linux Linux · CVSS 8.4 High · Not analysed yet · Published 19 Jul 2026 · Tags: CWE-170 - [h2o is vulnerable to heap overrun](https://agentprime.io/advisories/CVE-2026-44452.md) `CVE-2026-44452` · CVE record: h2o h2o · CVSS 5.9 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Memory corruption, CWE-170 - [Buffer Overflow in TUBITAK BILGEM's Pardus Pen](https://agentprime.io/advisories/CVE-2026-12386.md) `CVE-2026-12386` · CVE record: TUBITAK BILGEM Software Technologies Research Institute Pardus Pen · CVSS 3.9 Low · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-170 - [Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name field](https://agentprime.io/advisories/CVE-2026-55738.md) `CVE-2026-55738` · CVE record: rxi microtar · CVSS 8.7 High · Not analysed yet · Published 17 Jun 2026 · Tags: Memory corruption, CWE-170 - [Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key](https://agentprime.io/advisories/CVE-2026-5067.md) `CVE-2026-5067` · CVE record: zephyrproject-rtos Zephyr · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption, CWE-170 - [Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs](https://agentprime.io/advisories/CVE-2026-8721.md) `CVE-2026-8721` · CVE record: JONASBN Crypt::OpenSSL::PKCS12 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2026 · Tags: CWE-170 - [Gnutls: gnutls: authentication bypass via nul character in username](https://agentprime.io/advisories/CVE-2026-42010.md) `CVE-2026-42010` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 7 May 2026 · Tags: CWE-170, CWE-626 - [Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field](https://agentprime.io/advisories/CVE-2026-34464.md) `CVE-2026-34464` · CVE record: sandboxie-plus Sandboxie · CVSS 8.8 High · Not analysed yet · Published 5 May 2026 · Tags: Memory corruption, CWE-170 - [Sandboxie-Plus ProcessServer boxname stack buffer overflows via unterminated wide string copy](https://agentprime.io/advisories/CVE-2026-34462.md) `CVE-2026-34462` · CVE record: sandboxie-plus Sandboxie · CVSS 7.3 High · Not analysed yet · Published 5 May 2026 · Tags: Memory corruption, CWE-170 - [Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)](https://agentprime.io/advisories/CVE-2026-34032.md) `CVE-2026-34032` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Memory corruption, CWE-170 - [netfilter: x_tables: ensure names are nul-terminated](https://agentprime.io/advisories/CVE-2026-43028.md) `CVE-2026-43028` · CVE record: Linux Linux · CVSS 7.1 High · Not analysed yet · Published 1 May 2026 · Tags: CWE-170 - [libgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.c](https://agentprime.io/advisories/CVE-2026-40334.md) `CVE-2026-40334` · CVE record: gphoto libgphoto2 · CVSS 3.5 Low · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-170 - [jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input](https://agentprime.io/advisories/CVE-2026-33948.md) `CVE-2026-33948` · CVE record: jqlang jq · CVSS 2.9 Low · Not analysed yet · Published 13 Apr 2026 · Tags: CWE-20, CWE-170 - [Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow](https://agentprime.io/advisories/CVE-2026-2239.md) `CVE-2026-2239` · CVE record: Red Hat Red Hat Enterprise Linux 7 and 2 more · CVSS 2.8 Low · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-170 - [mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing](https://agentprime.io/advisories/CVE-2026-32837.md) `CVE-2026-32837` · CVE record: mackron miniaudio · CVSS 5.1 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-170 - [Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read](https://agentprime.io/advisories/CVE-2026-23749.md) `CVE-2026-23749` · CVE record: Golioth Firmware SDK · CVSS 2.1 Low · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-170 - [iccDEV has HBO in CIccTagTextDescription::Release()](https://agentprime.io/advisories/CVE-2026-27692.md) `CVE-2026-27692` · CVE record: InternationalColorConsortium iccDEV · CVSS 7.1 High · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption, CWE-170 - [Valkey Affected by RESP Protocol Injection via Lua error_reply](https://agentprime.io/advisories/CVE-2025-67733.md) `CVE-2025-67733` · CVE record: valkey-io valkey · CVSS 8.5 High · Not analysed yet · Published 23 Feb 2026 · Tags: Other injection, CWE-170 - [iccDEV has a heap-buffer-overflow in icXmlParseTextString()](https://agentprime.io/advisories/CVE-2026-24852.md) `CVE-2026-24852` · CVE record: InternationalColorConsortium iccDEV · CVSS 6.1 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Memory corruption, CWE-170 - [iccDEV has Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination](https://agentprime.io/advisories/CVE-2026-21488.md) `CVE-2026-21488` · CVE record: InternationalColorConsortium iccDEV · CVSS 6.1 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Memory corruption, CWE-170 - [Improper null termination in Moxa NPort 6100-G2/6200-G2 Series](https://agentprime.io/advisories/CVE-2025-2026.md) `CVE-2025-2026` · CVE record: Moxa NPort 6100-G2/6200-G2 Series · CVSS 7.1 High · Not analysed yet · Published 31 Dec 2025 · Tags: CWE-170 - [An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.](https://agentprime.io/advisories/CVE-2025-67790.md) `CVE-2025-67790` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-170 - [Envoy's TLS certificate matcher for \`match_typed_subject_alt_names\` may incorrectly treat certificates containing an embedded null byte](https://agentprime.io/advisories/GHSA-rwjg-c3h2-f57p.md) `GHSA-rwjg-c3h2-f57p`, `BIT-envoy-2025-66220`, `CVE-2025-66220` · Go `github.com/envoyproxy/envoy`: affected `<1.33.13 || >=1.34.0, <1.34.11 || >=1.35.0, <1.35.7 || >=1.36.0, <1.36.3`, fixed in `1.33.13`, `1.34.11`, `1.35.7`, `1.36.3` · CVSS 5.0 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-170 - [Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match](https://agentprime.io/advisories/CVE-2025-62792.md) `CVE-2025-62792` · CVE record: wazuh wazuh · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: CWE-126, CWE-170 - [python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination](https://agentprime.io/advisories/GHSA-p34h-wq7j-h5v6.md) `GHSA-p34h-wq7j-h5v6`, `CVE-2025-61912`, `PYSEC-2026-1846` · PyPI `python-ldap`: affected `<3.4.5`, fixed in `3.4.5` · CVSS 5.5 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-116, CWE-170 - [Improper Null Termination in libfluid_msg library](https://agentprime.io/advisories/CVE-2024-31197.md) `CVE-2024-31197` · CVE record: Open Networking Foundation (ONF) libfluid · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2024 · Tags: CWE-170 - [Microsoft SQL Server Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-43474.md) `CVE-2024-43474` · CVE record: Microsoft Microsoft SQL Server 2017 (CU 31) and 2 more · CVSS 7.6 High · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-170 - [Multiple vulnerabilities in libnv](https://agentprime.io/advisories/CVE-2024-45288.md) `CVE-2024-45288` · CVE record: FreeBSD FreeBSD · CVSS 8.4 High · Not analysed yet · Published 5 Sept 2024 · Tags: Memory corruption, CWE-170 - [Improper null termination in Siemens CPC80 Central Processing/Communication and others](https://agentprime.io/advisories/CVE-2024-31484.md) `CVE-2024-31484` · CVE record: Siemens CPC80 Central Processing/Communication and 4 more · CVSS 7.3 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-170 - [Windows USB Print Driver Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2024-21442.md) `CVE-2024-21442` · CVE record: Microsoft Windows Server 2022 and 4 more · CVSS 7.8 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-170 - [Improper null termination in Dell CPG BIOS](https://agentprime.io/advisories/CVE-2023-48674.md) `CVE-2023-48674` · CVE record: Dell CPG BIOS · CVSS 6.8 Medium · Not analysed yet · Published 1 Mar 2024 · Tags: CWE-170 - [Windows Cryptographic Services Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-36907.md) `CVE-2023-36907` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-170 - [Windows Cryptographic Services Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-36906.md) `CVE-2023-36906` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-170 - [Windows Deployment Services Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2023-35321.md) `CVE-2023-35321` · CVE record: Microsoft Windows Server 2019 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Jul 2023 · Tags: CWE-170 - [Visual Studio Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-28263.md) `CVE-2023-28263` · CVE record: Microsoft Microsoft Visual Studio 2022 version 17.2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: CWE-170 - [Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules…](https://agentprime.io/advisories/CVE-2023-24021.md) `CVE-2023-24021` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Jan 2023 · Tags: CWE-170 - [An issue was discovered in drachtio-server before 0.8.20.](https://agentprime.io/advisories/CVE-2022-47515.md) `CVE-2022-47515` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2022 · Tags: CWE-170 - [Improper null termination in Siemens APOGEE MBC (PPC) (BACnet) and others](https://agentprime.io/advisories/CVE-2021-31888.md) `CVE-2021-31888` · CVE record: Siemens APOGEE MBC (PPC) (BACnet) and 4 more · No CVSS score · Not analysed yet · Published 9 Nov 2021 · Tags: CWE-170 - [Improper null termination in Siemens APOGEE MBC (PPC) (BACnet) and others](https://agentprime.io/advisories/CVE-2021-31887.md) `CVE-2021-31887` · CVE record: Siemens APOGEE MBC (PPC) (BACnet) and 4 more · No CVSS score · Not analysed yet · Published 9 Nov 2021 · Tags: CWE-170 - [Improper null termination in Siemens APOGEE MBC (PPC) (BACnet) and others](https://agentprime.io/advisories/CVE-2021-31886.md) `CVE-2021-31886` · CVE record: Siemens APOGEE MBC (PPC) (BACnet) and 4 more · No CVSS score · Not analysed yet · Published 9 Nov 2021 · Tags: CWE-170 - [Improper null termination in Siemens APOGEE MBC (PPC) (BACnet) and others](https://agentprime.io/advisories/CVE-2021-31884.md) `CVE-2021-31884` · CVE record: Siemens APOGEE MBC (PPC) (BACnet) and 4 more · No CVSS score · Not analysed yet · Published 9 Nov 2021 · Tags: CWE-170 - [Improper null termination in NVIDIA Virtual GPU Software](https://agentprime.io/advisories/CVE-2021-1120.md) `CVE-2021-1120` · CVE record: NVIDIA NVIDIA Virtual GPU Software · CVSS 7.0 High · Not analysed yet · Published 29 Oct 2021 · Tags: CWE-170 - [Improper null termination in Node](https://agentprime.io/advisories/CVE-2021-22931.md) `CVE-2021-22931` · CVE record: NodeJS Node · No CVSS score · EPSS 0.22 · Not analysed yet · Published 16 Aug 2021 · Tags: CWE-170 - [Improper null termination in Siemens APOGEE PXC Compact (BACnet) and others](https://agentprime.io/advisories/CVE-2020-27736.md) `CVE-2020-27736` · CVE record: Siemens APOGEE PXC Compact (BACnet) and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2021 · Tags: CWE-170 - [Cisco Jabber Desktop and Mobile Client Software Vulnerabilities](https://agentprime.io/advisories/CVE-2021-1418.md) `CVE-2021-1418` · CVE record: Cisco Cisco Jabber · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2021 · Tags: CWE-170 - [Cisco Jabber Desktop and Mobile Client Software Vulnerabilities](https://agentprime.io/advisories/CVE-2021-1417.md) `CVE-2021-1417` · CVE record: Cisco Cisco Jabber · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2021 · Tags: CWE-170 - [Cisco Jabber Desktop and Mobile Client Software Vulnerabilities](https://agentprime.io/advisories/CVE-2021-1411.md) `CVE-2021-1411` · CVE record: Cisco Cisco Jabber · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2021 · Tags: CWE-170 - [Cisco Jabber Desktop and Mobile Client Software Vulnerabilities](https://agentprime.io/advisories/CVE-2021-1471.md) `CVE-2021-1471` · CVE record: Cisco Cisco Jabber · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2021 · Tags: CWE-170 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .