# CWE-754. Every Advisory and CVE whose sources give the weakness CWE-754, newest first. ## Records, newest first (an older page) - [Improper check for unusual conditions in ELECOM CO.,LTD. WAB-BE187-M and others](https://agentprime.io/advisories/CVE-2026-42950.md) `CVE-2026-42950` · CVE record: ELECOM CO.,LTD. WAB-BE187-M and 3 more · CVSS 5.1 Medium · Not analysed yet · Published 13 May 2026 · Tags: CWE-754 - [Improper check for unusual conditions in Intel(R) NPU Drivers](https://agentprime.io/advisories/CVE-2026-20754.md) `CVE-2026-20754` · CVE record: Intel(R) NPU Drivers · CVSS 6.9 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-754 - [free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)](https://agentprime.io/advisories/GHSA-jqfc-gwj5-3w63.md) `GHSA-jqfc-gwj5-3w63`, `CVE-2026-44324`, `GO-2026-5478` · Go `github.com/free5gc/udr`: affected `<1.4.3`, fixed in `1.4.3` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-704, CWE-754 - [free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference](https://agentprime.io/advisories/GHSA-j59f-x285-69jx.md) `GHSA-j59f-x285-69jx`, `CVE-2026-44322`, `GO-2026-5447` · Go `github.com/free5gc/nef`: affected `<1.2.3`, fixed in `1.2.3` · CVSS 7.5 High · Not analysed yet · Published 8 May 2026 · Tags: Memory corruption, CWE-754 - [free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference](https://agentprime.io/advisories/GHSA-wwqh-7jm5-gj7w.md) `GHSA-wwqh-7jm5-gj7w`, `CVE-2026-44317`, `GO-2026-5731` · Go `github.com/free5gc/pcf`: affected `<1.4.3`, fixed in `1.4.3` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: Memory corruption, CWE-754 - [free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference](https://agentprime.io/advisories/GHSA-wr8j-6chw-gm6p.md) `GHSA-wr8j-6chw-gm6p`, `CVE-2026-44316`, `GO-2026-5720` · Go `github.com/free5gc/pcf`: affected `<1.4.2`, fixed in `1.4.2` · CVSS 7.5 High · Not analysed yet · Published 8 May 2026 · Tags: Memory corruption, CWE-754 - [Incorrect boundary conditions in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-8091.md) `CVE-2026-8091` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption, CWE-754 - [net: consume xmit errors of GSO frames](https://agentprime.io/advisories/CVE-2026-43194.md) `CVE-2026-43194` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-754 - [KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation](https://agentprime.io/advisories/CVE-2026-43133.md) `CVE-2026-43133` · CVE record: Linux Linux · CVSS 7.9 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-628, CWE-754 - [net-imap vulnerable to STARTTLS stripping via invalid response timing](https://agentprime.io/advisories/GHSA-vcgp-9326-pqcp.md) `GHSA-vcgp-9326-pqcp`, `CVE-2026-42246` · RubyGems `net-imap`: affected `<0.3.10 || >=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.3.10`, `0.4.24`, `0.5.14`, `0.6.4` · CVSS 7.6 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-325, CWE-392, CWE-393, CWE-636 - [Clerk has an authorization bypass when combining organization, billing, or reverification checks](https://agentprime.io/advisories/GHSA-w24r-5266-9c3c.md) `GHSA-w24r-5266-9c3c`, `CVE-2026-42349` · npm `@clerk/astro` and 16 more: affected `>=2.0.0, <2.17.11 || >=3.0.0, <3.0.18`, fixed in `2.17.11`, `3.0.18` · CVSS 7.6 High · Not analysed yet · Published 30 Apr 2026 · Tags: Broken access control, CWE-754 - [Admidio Missing Minimum Administrator Check in Role Membership Removal](https://agentprime.io/advisories/GHSA-c7xm-r6vj-8vg6.md) `GHSA-c7xm-r6vj-8vg6`, `CVE-2026-41662`, `PKSA-c3x4-7b97-m7w3` · Packagist `admidio/admidio`: affected `<5.0.9`, fixed in `5.0.9` · CVSS 5.2 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-754 - [btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()](https://agentprime.io/advisories/CVE-2026-31666.md) `CVE-2026-31666` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-754 - [rxrpc: reject undecryptable rxkad response tickets](https://agentprime.io/advisories/CVE-2026-31637.md) `CVE-2026-31637` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-754 - [Improper timeout handling in CODESYS EtherNetIP](https://agentprime.io/advisories/CVE-2026-35225.md) `CVE-2026-35225` · CVE record: CODESYS CODESYS EtherNetIP · CVSS 8.7 High · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-754 - [nimiq-blockchain: Peer-triggerable panic during history sync](https://agentprime.io/advisories/GHSA-j99g-7rqw-q9jg.md) `GHSA-j99g-7rqw-q9jg`, `CVE-2026-34066` · crates.io `nimiq-blockchain`: affected `<=0.2.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Denial of service, CWE-20, CWE-754 - [Duplicate Advisory: uutils coreutils has an Improper Check for Unusual or Exceptional Conditions](https://agentprime.io/advisories/GHSA-7259-cwhx-3xx3.md) `GHSA-7259-cwhx-3xx3` · crates.io `coreutils`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.4 Medium · Withdrawn · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-754 - [free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation](https://agentprime.io/advisories/GHSA-jwch-w7wh-gqjm.md) `GHSA-jwch-w7wh-gqjm`, `CVE-2026-40343`, `GO-2026-5482` · Go `github.com/free5gc/udr`: affected `<=1.4.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-6772.md) `CVE-2026-6772` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-6766.md) `CVE-2026-6766` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-754 - [Improper check for unusual conditions in Dell PowerScale OneFS](https://agentprime.io/advisories/CVE-2025-43883.md) `CVE-2025-43883` · CVE record: Dell PowerScale OneFS · CVSS 4.1 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-754 - [free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors](https://agentprime.io/advisories/GHSA-gx38-8h33-pmxr.md) `GHSA-gx38-8h33-pmxr`, `CVE-2026-40249`, `GO-2026-5407` · Go `github.com/free5gc/udr`: affected `<=1.4.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-636, CWE-754 - [Junos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and restart.](https://agentprime.io/advisories/CVE-2026-33790.md) `CVE-2026-33790` · CVE record: Juniper Networks Junos OS · CVSS 8.7 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-754 - [Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashes](https://agentprime.io/advisories/CVE-2026-33787.md) `CVE-2026-33787` · CVE record: Juniper Networks Junos OS · CVSS 6.8 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-754 - [Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passed](https://agentprime.io/advisories/CVE-2026-33781.md) `CVE-2026-33781` · CVE record: Juniper Networks Junos OS · CVSS 7.1 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-754 - [Junos OS: MX Series: Firewall filters on lo0.\ in the default routing instance are not in effect](https://agentprime.io/advisories/CVE-2026-33774.md) `CVE-2026-33774` · CVE record: Juniper Networks Junos OS · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-754 - [Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes](https://agentprime.io/advisories/CVE-2026-33786.md) `CVE-2026-33786` · CVE record: Juniper Networks Junos OS · CVSS 6.8 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-754 - [bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts](https://agentprime.io/advisories/GHSA-9hfr-gw99-8rhx.md) `GHSA-9hfr-gw99-8rhx`, `CVE-2026-40069` · RubyGems `bsv-sdk`: affected `>=0.1.0, <0.8.2`, fixed in `0.8.2` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-754 - [Cosign's verify-blob-attestation reports false positive when payload parsing fails](https://agentprime.io/advisories/GHSA-w6c6-c85g-mmv6.md) `GHSA-w6c6-c85g-mmv6`, `BIT-cosign-2026-39395`, `CVE-2026-39395`, `GO-2026-5694` · Go `github.com/sigstore/cosign`: affected `<2.6.3 || >=3.0.0, <3.0.6`, fixed in `2.6.3`, `3.0.6` · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-754 - [Incorrect Failure Handling in RSA KEM RSASVE Encapsulation](https://agentprime.io/advisories/CVE-2026-31790.md) `CVE-2026-31790` · CVE record: OpenSSL OpenSSL · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-754 - [OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)](https://agentprime.io/advisories/GHSA-cwq8-6f96-g3q4.md) `GHSA-cwq8-6f96-g3q4`, `CVE-2026-41377` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 5.1 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-636, CWE-754 - [pf silently ignores certain rules](https://agentprime.io/advisories/CVE-2026-4748.md) `CVE-2026-4748` · CVE record: FreeBSD FreeBSD · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-480, CWE-754, CWE-1023 - [Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation](https://agentprime.io/advisories/GHSA-9cx6-37pm-9jff.md) `GHSA-9cx6-37pm-9jff`, `CVE-2026-33939` · npm `handlebars`: affected `>=4.0.0, <4.7.9`, fixed in `4.7.9` · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-248, CWE-754 - [Missing timestamp validation in Zoom webhook handler](https://agentprime.io/advisories/CVE-2026-3109.md) `CVE-2026-3109` · CVE record: Mattermost Mattermost · CVSS 2.2 Low · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-754 - [Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds](https://agentprime.io/advisories/GHSA-86vc-mg26-fj6x.md) `GHSA-86vc-mg26-fj6x`, `CVE-2026-20719`, `GO-2026-5245` · Go `github.com/mattermost/mattermost/server/v8`: affected `>=8.0.0-20260105080200-d27a2195068d, <8.0.0-20260217110922-b7d4a1f1f59b || >=10.11.0-rc1, <10.11.2 || >=11.2.0-rc1, <11.2.4 || >=11.3.0-rc1, <11.3.2 || >=11.4.0-rc1, <11.4.1`, fixed in `8.0.0-20260217110922-b7d4a1f1f59b`, `10.11.2`, `11.2.4`, `11.3.2`, `11.4.1` · CVSS 4.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-754 - [@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling](https://agentprime.io/advisories/GHSA-8g29-8xwr-qmhr.md) `GHSA-8g29-8xwr-qmhr` · npm `@grackle-ai/server`: affected `<0.70.6`, fixed in `0.70.6` · CVSS 4.0, no score published · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-4714.md) `CVE-2026-4714` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Graphics component](https://agentprime.io/advisories/CVE-2026-4713.md) `CVE-2026-4713` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Audio/Video: GMP component](https://agentprime.io/advisories/CVE-2026-4709.md) `CVE-2026-4709` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Graphics component](https://agentprime.io/advisories/CVE-2026-4708.md) `CVE-2026-4708` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4707.md) `CVE-2026-4707` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4706.md) `CVE-2026-4706` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the Layout: Text and Fonts component](https://agentprime.io/advisories/CVE-2026-4699.md) `CVE-2026-4699` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754 - [Incorrect boundary conditions in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-4697.md) `CVE-2026-4697` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754 - [Incorrect boundary conditions in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-4695.md) `CVE-2026-4695` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754 - [Incorrect boundary conditions, integer overflow in the Graphics component](https://agentprime.io/advisories/CVE-2026-4694.md) `CVE-2026-4694` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754 - [Incorrect boundary conditions in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-4693.md) `CVE-2026-4693` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754, CWE-823 - [Incorrect boundary conditions in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4686.md) `CVE-2026-4686` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754 - [Incorrect boundary conditions in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4685.md) `CVE-2026-4685` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-754 - [socket.io allows an unbounded number of binary attachments](https://agentprime.io/advisories/GHSA-677m-j7p3-52f9.md) `GHSA-677m-j7p3-52f9`, `CVE-2026-33151` · npm `socket.io-parser`: affected `<3.3.5 || >=3.4.0, <3.4.4 || >=4.0.0, <4.2.6`, fixed in `3.3.5`, `3.4.4`, `4.2.6` · CVSS 8.7 High · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-20, CWE-754 - [Cortex XDR Agent: Local Administrator can disable the agent on macOS](https://agentprime.io/advisories/CVE-2026-0230.md) `CVE-2026-0230` · CVE record: Palo Alto Networks Cortex XDR Agent · CVSS 4.0 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-754 - [Zoom Workplace Clients for Windows - Improper Check](https://agentprime.io/advisories/CVE-2026-30900.md) `CVE-2026-30900` · CVE record: Zoom Communications Inc. Zoom Workplace · CVSS 7.8 High · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-754 - [RustSec Advisory](https://agentprime.io/advisories/GHSA-9c4h-pwmf-m6fj.md) `GHSA-9c4h-pwmf-m6fj`, `CVE-2026-30960`, `RUSTSEC-2026-0038` · crates.io `rssn`: affected `>=0.1.20, <0.2.9`, fixed in `0.2.9` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Mar 2026 · Tags: Code injection, Privilege escalation, CWE-695, CWE-754 - [Improper check for unusual conditions in Dell Device Management Agent (DDMA)](https://agentprime.io/advisories/CVE-2026-22760.md) `CVE-2026-22760` · CVE record: Dell Device Management Agent (DDMA) · CVSS 3.3 Low · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-754 - [Incorrect boundary conditions in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-2801.md) `CVE-2026-2801` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-754 - [free5GC has Improper Error Handling in UDM, Leading to Information Exposure](https://agentprime.io/advisories/CVE-2025-69250.md) `CVE-2025-69250` · CVE record: free5gc udm · CVSS 6.6 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: CWE-20, CWE-754 - [PAN-OS: Denial of Service in Advanced DNS Security Feature](https://agentprime.io/advisories/CVE-2026-0229.md) `CVE-2026-0229` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 6.6 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-754 - [Improper check for unusual conditions in Intel(R) NPU Drivers](https://agentprime.io/advisories/CVE-2025-35992.md) `CVE-2025-35992` · CVE record: Intel(R) NPU Drivers · CVSS 5.7 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-754 - [Improper check for unusual conditions in Intel(R) NPU Drivers](https://agentprime.io/advisories/CVE-2025-33030.md) `CVE-2025-33030` · CVE record: Intel(R) NPU Drivers · CVSS 2.0 Low · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-754 - [Improper check for unusual conditions in Intel(R) Graphics Drivers and Intel LTS kernels](https://agentprime.io/advisories/CVE-2025-32739.md) `CVE-2025-32739` · CVE record: Intel(R) Graphics Drivers and Intel LTS kernels · CVSS 2.0 Low · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-754 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .