Skip to content
CVE Tracker

CWE-252

205 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 205 in the listAtom feed of new CVEsWhat CWE-252 is, at MITRE (opens in a new tab)
Published CVEs
205
Last 12 months
62
Critical
16
Known exploited
1

Critical 16High 81Medium 93Low 15Not scored 0

CVEs per yearBy the year they were published

  1. 20174
  2. 20172
  3. 20184
  4. 20198
  5. 20209
  6. 20201
  7. 202416
  8. 202424
  9. 202430
  10. 202520
  11. 202523
  12. 202658

Known exploitedNewest addition to KEV first

  • CVE-2026-111497

    Out-of-Bounds Write in Google Brotli Decoder

    Google · Brotli

    ExploitedCritical9.2

Newest CVEs

  • CVE-2026-115403

    NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full

    Eclipse Foundation · Eclipse ThreadX

    High8.2
  • CVE-2026-114408

    NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

    Eclipse Foundation · Eclipse ThreadX

    High8.7
  • CVE-2026-118263

    Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

    labstack · echo

    Medium6.3
  • CVE-2026-111497

    Out-of-Bounds Write in Google Brotli Decoder

    Google · Brotli

    ExploitedCritical9.2
  • CVE-2026-110353

    HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING…

    HAProxy · HAProxy

    High7.5
  • CVE-2026-56388

    Apache bRPC: Out-of-Bounds Write in Redis Command Parser

    Apache Software Foundation · Apache bRPC

    Critical9.1
  • CVE-2026-48741

    libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS

    mz-automation · libiec61850

    High7.5
  • CVE-2026-48503

    libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead

    mz-automation · libiec61850

    High7.5
  • CVE-2026-77207

    Null Pointer Dereference in PKCS#7 bundle with no certificates

    The Libreswan Project · libreswan

    High7.5
  • CVE-2026-107838

    RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

    RIOT-OS · RIOT

    High7.5

Vendors it comes up for most

  1. Linux15
  2. InternationalColorConsortium9
  3. Juniper Networks6
  4. Google5
  5. wazuh5
  6. Dell4
  7. Apache Software Foundation3
  8. Google Inc.3
  9. IBM3
  10. ImageMagick3