# CWE-754.

Every Advisory and CVE whose sources give the weakness CWE-754, newest first.

## Records, newest first

- [Improper check for unusual conditions in Samsung Semiconductor Exynos 1280 and others](https://agentprime.io/advisories/CVE-2026-48186.md)
  `CVE-2026-48186` · CVE record: Samsung Semiconductor Exynos 1280 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Samsung Semiconductor Exynos 850 and others](https://agentprime.io/advisories/CVE-2026-69006.md)
  `CVE-2026-69006` · CVE record: Samsung Semiconductor Exynos 850 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Samsung Semiconductor Exynos 2200 and others](https://agentprime.io/advisories/CVE-2026-69066.md)
  `CVE-2026-69066` · CVE record: Samsung Semiconductor Exynos 2200 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Samsung Semiconductor Exynos 1080 and others](https://agentprime.io/advisories/CVE-2025-66368.md)
  `CVE-2025-66368` · CVE record: Samsung Semiconductor Exynos 1080 and 2 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Samsung Semiconductor Exynos 1080 and others](https://agentprime.io/advisories/CVE-2026-35495.md)
  `CVE-2026-35495` · CVE record: Samsung Semiconductor Exynos 1080 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Samsung Semiconductor Exynos 1080 and others](https://agentprime.io/advisories/CVE-2025-66365.md)
  `CVE-2025-66365` · CVE record: Samsung Semiconductor Exynos 1080 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Samsung Semiconductor Exynos 850 and others](https://agentprime.io/advisories/CVE-2025-66364.md)
  `CVE-2025-66364` · CVE record: Samsung Semiconductor Exynos 850 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-121054.md)
  `CVE-2026-121054` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-121237.md)
  `CVE-2026-121237` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-121098.md)
  `CVE-2026-121098` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-754
- [svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping](https://agentprime.io/advisories/CVE-2026-121445.md)
  `CVE-2026-121445` · CVE record: darylldoyle svg-sanitizer · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-754
- [SD JWT JS: Tampered disclosures silently dropped instead of rejected](https://agentprime.io/advisories/GHSA-f9j6-8p6x-r9j6.md)
  `GHSA-f9j6-8p6x-r9j6`, `CVE-2026-62374` · npm `@sd-jwt/core` and 1 more: affected `<0.20.0`, fixed in `0.20.0` · CVSS 7.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-176, CWE-754
- [jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not](https://agentprime.io/advisories/GHSA-cvmg-hgv6-jqcp.md)
  `GHSA-cvmg-hgv6-jqcp`, `CVE-2026-117680`, `EEF-CVE-2026-117680` · Hex `jsv`: affected `>=0.1.0, <0.26.2`, fixed in `0.26.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-754
- [OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification](https://agentprime.io/advisories/CVE-2026-62334.md)
  `CVE-2026-62334` · CVE record: openvm-org openvm · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-754
- [Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214](https://agentprime.io/advisories/CVE-2026-107311.md)
  `CVE-2026-107311` · CVE record: Drupal Permissions by Term · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-754
- [Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys](https://agentprime.io/advisories/CVE-2026-119126.md)
  `CVE-2026-119126` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-754
- [undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake](https://agentprime.io/advisories/GHSA-qq8j-7v2v-3rwp.md)
  `GHSA-qq8j-7v2v-3rwp`, `CVE-2026-109855` · npm `undici`: affected `>=8.11.0, <8.11.2`, fixed in `8.11.2` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-248, CWE-754
- [Insufficient length validation when parsing Zoom chat transcriptions](https://agentprime.io/advisories/CVE-2026-116516.md)
  `CVE-2026-116516` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-754
- [Null condition in Playbooks import crashes the plugin](https://agentprime.io/advisories/CVE-2026-13411.md)
  `CVE-2026-13411` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-113260.md)
  `CVE-2026-113260` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-113344.md)
  `CVE-2026-113344` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-754
- [server-set cookie erases cookie jar](https://agentprime.io/advisories/CVE-2026-86412.md)
  `CVE-2026-86412` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Signal RingRTC](https://agentprime.io/advisories/CVE-2026-113380.md)
  `CVE-2026-113380` · CVE record: Signal RingRTC · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-754
- [libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS](https://agentprime.io/advisories/CVE-2026-48741.md)
  `CVE-2026-48741` · CVE record: mz-automation libiec61850 · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, CWE-129, CWE-252, CWE-754
- [kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path](https://agentprime.io/advisories/GHSA-rj39-cv6w-8wv7.md)
  `GHSA-rj39-cv6w-8wv7`, `CVE-2026-100352`, `GO-2026-6795` · Go `github.com/getkin/kin-openapi`: affected `<0.148.0`, fixed in `0.148.0` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-754
- [PAN-OS: Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-0317.md)
  `CVE-2026-0317` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 1.2 Low · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-754
- [PAN-OS: Denial of Service (DoS) on Panorama](https://agentprime.io/advisories/CVE-2026-0318.md)
  `CVE-2026-0318` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 4.6 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-754
- [PAN-OS: Improper Input Handling Vulnerability](https://agentprime.io/advisories/CVE-2026-0319.md)
  `CVE-2026-0319` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-754
- [PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services](https://agentprime.io/advisories/CVE-2026-0321.md)
  `CVE-2026-0321` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 6.6 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-754
- [Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to resource leaks and eventually traffic stops](https://agentprime.io/advisories/CVE-2026-102077.md)
  `CVE-2026-102077` · CVE record: Juniper Networks Junos OS · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-754
- [RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation](https://agentprime.io/advisories/CVE-2026-67416.md)
  `CVE-2026-67416` · CVE record: rabbitmq rabbitmq-server · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-20, CWE-248, CWE-754
- [Improper check for unusual conditions in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-78017.md)
  `CVE-2026-78017` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 3.8 Low · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-754
- [@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed](https://agentprime.io/advisories/CVE-2026-107275.md)
  `CVE-2026-107275` · CVE record: @fastify/jwt @fastify/jwt · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-390, CWE-754
- [Backstage has incorrect authorization in search engine permission filtering](https://agentprime.io/advisories/GHSA-9325-vq29-gp3v.md)
  `GHSA-9325-vq29-gp3v`, `CVE-2026-106562` · npm `@backstage/plugin-search-backend` and 1 more: affected `<2.1.6`, fixed in `2.1.6` · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-106343.md)
  `CVE-2026-106343` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-106346.md)
  `CVE-2026-106346` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-754
- [@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header](https://agentprime.io/advisories/GHSA-x8mw-p69m-v3mx.md)
  `GHSA-x8mw-p69m-v3mx`, `CVE-2026-19481` · npm `@fastify/busboy`: affected `>=1.0.0, <3.2.1`, fixed in `3.2.1` · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-754
- [Guest can panic host through filesystem timestamp before the epoch on wasip3](https://agentprime.io/advisories/GHSA-mr2v-56j5-cmfc.md)
  `GHSA-mr2v-56j5-cmfc`, `CVE-2026-115385`, `RUSTSEC-2026-0324` · crates.io `wasmtime-wasi`: affected `>=46.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-754
- [Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response](https://agentprime.io/advisories/CVE-2026-104432.md)
  `CVE-2026-104432` · CVE record: ZcashFoundation zebra · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-754
- [Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5](https://agentprime.io/advisories/CVE-2026-100296.md)
  `CVE-2026-100296` · CVE record: Anjvision YSSD-RTMP-H5 · CVSS 7.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-754
- [undici vulnerable to Denial of Service via WebSocketStream unclean close](https://agentprime.io/advisories/GHSA-rx4f-c7p8-82vq.md)
  `GHSA-rx4f-c7p8-82vq`, `CVE-2026-85014` · npm `undici`: affected `>=7.0.0, <7.29.1 || >=8.0.0, <8.10.2`, fixed in `7.29.1`, `8.10.2` · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-248, CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-95330.md)
  `CVE-2026-95330` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-754
- [Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters](https://agentprime.io/advisories/CVE-2026-73549.md)
  `CVE-2026-73549` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-754
- [NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller](https://agentprime.io/advisories/CVE-2026-94105.md)
  `CVE-2026-94105` · CVE record: nivocart nivocart · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-93387.md)
  `CVE-2026-93387` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-754
- [RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr](https://agentprime.io/advisories/GHSA-c5pq-fr2g-9jpf.md)
  `GHSA-c5pq-fr2g-9jpf`, `CVE-2026-77411`, `GO-2026-6496` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-91733.md)
  `CVE-2026-91733` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-754
- [Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.](https://agentprime.io/advisories/CVE-2026-10556.md)
  `CVE-2026-10556` · CVE record: Mattermost Mattermost · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-754
- [Boards plugin denial of service via unvalidated block fields.properties](https://agentprime.io/advisories/CVE-2026-13417.md)
  `CVE-2026-13417` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-754
- [Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value](https://agentprime.io/advisories/GHSA-v39v-59xw-j98g.md)
  `GHSA-v39v-59xw-j98g`, `CVE-2026-87012`, `PYSEC-2026-4126` · PyPI `open-webui`: affected `>=0.9.0, <0.11.1`, fixed in `0.11.1` · CVSS 4.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-754, CWE-1287
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-87656.md)
  `CVE-2026-87656` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-87532.md)
  `CVE-2026-87532` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-87548.md)
  `CVE-2026-87548` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-87645.md)
  `CVE-2026-87645` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-754
- [Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext](https://agentprime.io/advisories/GHSA-c4c3-7fpv-j4q5.md)
  `GHSA-c4c3-7fpv-j4q5`, `CVE-2026-75595` · Maven `io.netty:netty-handler`: affected `>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final`, fixed in `4.2.17.Final`, `4.1.137.Final` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-475, CWE-754
- [XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook](https://agentprime.io/advisories/CVE-2026-73314.md)
  `CVE-2026-73314` · CVE record: XenForo XenForo · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-754
- [alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server](https://agentprime.io/advisories/GHSA-hr6j-w4mw-g9mj.md)
  `GHSA-hr6j-w4mw-g9mj`, `CVE-2026-55484`, `GO-2026-6321` · Go `github.com/guno1928/alos-http`: affected `<0.0.0-20260617230736-314b6783e196`, fixed in `0.0.0-20260617230736-314b6783e196` · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-248, CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-79073.md)
  `CVE-2026-79073` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-754
- [Improper check for unusual conditions in Google Chrome](https://agentprime.io/advisories/CVE-2026-79072.md)
  `CVE-2026-79072` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-754
- [cpu: hotplug: Preserve per instance callback errors](https://agentprime.io/advisories/CVE-2026-72067.md)
  `CVE-2026-72067` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 15 Aug 2026 · Tags: CWE-754

Older: <https://agentprime.io/advisories/tag/cwe-754.md?cursor=WyIyMDI2LTA4LTE1VDA1OjUyOjIwLjI2ODAwMFoiLCJDVkUtMjAyNi03MjA2NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-754>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-754/>. Everything for agents: <https://agentprime.io/llms.txt>.