Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-476: NULL pointer dereference

5,902 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 5,902 in the listAtom feed of new CVEsWhat CWE-476 is, at MITRE (opens in a new tab)
Published CVEs
5,902
Last 12 months
1,233
Critical
134
Known exploited
1

Critical 134High 1,678Medium 3,910Low 174Not scored 6

CVEs per yearBy the year they were published

  1. 201510
  2. 201684
  3. 2017344
  4. 2018340
  5. 2019245
  6. 2020186
  7. 2021363
  8. 2022391
  9. 2023270
  10. 20241,163
  11. 20251,219
  12. 20261,179

Known exploitedNewest addition to KEV first

  • CVE-2026-21525

    Windows Remote Access Connection Manager Denial of Service Vulnerability

    Microsoft · Windows 10 Version 1607

    ExploitedMedium6.2

Newest CVEs

  • CVE-2026-123507

    Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter

    go-vikunja · vikunja

    Medium5.1
  • CVE-2026-124311

    Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk

    fraunhoferhhi · vvdec

    Medium6.8
  • CVE-2026-123492

    SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read

    siyuan-note · siyuan

    Medium6.9
  • CVE-2026-87045

    NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

    zephyrproject · zephyr

    High7.5
  • CVE-2026-48174

    In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

    Samsung Semiconductor · Exynos 1280

    Not scored
  • CVE-2026-69025

    In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service

    Samsung Semiconductor · Exynos 1480

    Not scored
  • CVE-2026-121522

    Possible panic from Git source resolver

    moby · BuildKit

    Medium6.7
  • CVE-2026-120955

    MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

    MongoDB · C Driver

    High8.7
  • CVE-2026-115297

    NULL Pointer Dereference in Packetbeat Leading to Denial of Service

    Elastic · Packetbeat

    Medium6.5
  • CVE-2026-120758

    NULL Pointer Dereference in H5HL_unprotect via Corrupted File

    The HDF Group · HDF5

    Medium5.4

Vendors it comes up for most

  1. Linux2,103
  2. Adobe123
  3. Qualcomm, Inc.118
  4. Microsoft101
  5. Red Hat88
  6. QNAP Systems Inc.87
  7. NVIDIA59
  8. tensorflow54
  9. Huawei47
  10. Juniper Networks33