An exception is thrown from a function, but it is not caught.
206 vulnerabilities with CWE-248
CVE-2026-33191
HIGH
free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error
CVE-2026-32770
MEDIUM
Parse Server: LiveQuery subscription with invalid regular expression crashes server
CVSS 5.9
CVE-2026-32314
HIGH
Yamux remote Panic via malformed Data frame with SYN set and len = 262145
CVSS 7.5
CVE-2026-31949
MEDIUM
LibreChat < 0.8.3-rc1 - Authenticated Denial of Service via Malformed DELETE /api/convos Request
CVSS 6.5
CVE-2026-2229
HIGH
undici < 6.24.0 and 7.0.0-7.24.0 - Denial of Service via Invalid server_max_window_bits Parameter
CVSS 7.5
CVE-2026-1528
HIGH
undici 6.0.0-6.23.9 7.0.0-7.23.9 - Denial of Service via WebSocket Frame Length Overflow
CVSS 7.5
CVE-2026-31870
HIGH
cpp-httplib < 0.37.1 - Unauthenticated Denial of Service via Unhandled Content-Length Exception
CVSS 7.5
CVE-2026-31812
HIGH
quinn-proto < 0.11.14 - Unauthenticated Denial of Service via Malformed QUIC Transport Parameters
CVE-2026-20068
MEDIUM
Cisco Snort 3 Detection Engine - Unauthenticated Denial of Service via RPC Packet Parsing
CVSS 5.8
CVE-2026-20031
MEDIUM
ClamAV - Denial of Service via Crafted HTML File with UTF-8 String Handling
CVSS 5.3
CVE-2026-27631
MEDIUM
exiv2 < 0.28.8 - Denial of Service via Preview Command Line Argument
CVSS 5.3
CVE-2026-27819
HIGH
Vikunja < 2.0.0 - Path Traversal and Denial of Service via Malicious ZIP Archive
CVSS 7.2
CVE-2026-1507
HIGH
AVEVA PI Data Archive PI Server < 2018_SP3_Patch_7 - Unauthenticated Denial of Service via Uncaught Exception
CVSS 7.5
CVE-2026-25577
HIGH
emmett-core < 1.3.11 - Unauthenticated Denial of Service via Malformed Cookie Header
CVSS 7.5
CVE-2026-25128
HIGH
fast-xml-parser 5.0.9-5.3.3 - Denial of Service via Out-of-Range XML Entity Code Points
CVSS 7.5
CVE-2025-15649
MEDIUM
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date
CVSS 5.5
CVE-2025-24851
MEDIUM
Intel(R) Ethernet Controller E810 <cvl fw 1.7.8.x - DoS
CVSS 6.0
CVE-2025-13064
MEDIUM
Server-Side Injection - Code Injection
CVSS 4.5
CVE-2025-59466
HIGH
Node.js 20.0.0-20.19.1 - Denial of Service via Uncatchable Stack Overflow in async_hooks
CVSS 7.5
CVE-2025-67647
CRITICAL
SvelteKit 2.19.0-2.49.4 - Server-Side Request Forgery and Denial of Service via Prerendered Routes
CVSS 9.1
CVE-2025-66578
MEDIUM
xmlseclibs < 3.1.4 - Authentication Bypass via libxml2 Canonicalization Failure
CVSS 6.0
CVE-2025-20758
MEDIUM
MediaTek NR15 NR16 NR17 NR17R - Remote Denial of Service via Rogue Base Station
CVSS 4.9
CVE-2025-20754
MEDIUM
MediaTek NR15, NR16, NR17, NR17R - Denial of Service via Rogue Base Station
CVSS 5.3
CVE-2025-20753
MEDIUM
MediaTek NR15 and NR16 - Remote Denial of Service via Rogue Base Station
CVSS 5.3
CVE-2025-66305
MEDIUM
Grav < 1.8.0-beta.27 - Denial of Service via Malformed Supported Parameter in Admin Configuration
CVSS 4.9
Details
Vulnerabilities
206