CWE-754.

Improper check for unusual conditions in Samsung Semiconductor Exynos 1280 and others

• Samsung Semiconductor Exynos 1280
• Samsung Semiconductor Exynos 2200
• CWE-754

Improper check for unusual conditions in Samsung Semiconductor Exynos 850 and others

• Samsung Semiconductor Exynos 850
• Samsung Semiconductor Exynos 2100
• CWE-754

Improper check for unusual conditions in Samsung Semiconductor Exynos 2200 and others

• Samsung Semiconductor Exynos 2200
• Samsung Semiconductor Exynos 1480
• CWE-754

Improper check for unusual conditions in Samsung Semiconductor Exynos 1080 and others

• Samsung Semiconductor Exynos 1080
• Samsung Semiconductor Exynos 9110
• CWE-754

Improper check for unusual conditions in Samsung Semiconductor Exynos 1080 and others

• Samsung Semiconductor Exynos 1080
• Samsung Semiconductor Exynos 9110
• CWE-754

Improper check for unusual conditions in Samsung Semiconductor Exynos 1080 and others

• Samsung Semiconductor Exynos 1080
• Samsung Semiconductor Exynos 9110
• CWE-754

Improper check for unusual conditions in Samsung Semiconductor Exynos 850 and others

• Samsung Semiconductor Exynos 850
• Samsung Semiconductor Exynos 1080
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping

• darylldoyle svg-sanitizer
• CWE-754

SD JWT JS: Tampered disclosures silently dropped instead of rejected

• CWE-176
• CWE-754

<0.20.0 · fixed in 0.20.0

jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not

• CWE-754

>=0.1.0, <0.26.2 · fixed in 0.26.2

OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification

• openvm
• CWE-754

Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

• Drupal Permissions by Term
• CWE-754

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

• parse-community parse-server
• CWE-754

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

• CWE-248
• CWE-754

>=8.11.0, <8.11.2 · fixed in 8.11.2

Insufficient length validation when parsing Zoom chat transcriptions

• Mattermost
• CWE-754

Null condition in Playbooks import crashes the plugin

• Mattermost
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

server-set cookie erases cookie jar

• curl
• CWE-754

Improper check for unusual conditions in Signal RingRTC

• Signal RingRTC
• CWE-754

libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS

• mz-automation libiec61850
• Memory corruption
• CWE-129

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

• CWE-754

<0.148.0 · fixed in 0.148.0

PAN-OS: Denial of Service Vulnerability

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• CWE-754

PAN-OS: Denial of Service (DoS) on Panorama

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• CWE-754

PAN-OS: Improper Input Handling Vulnerability

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• CWE-754

PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• CWE-754

Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to resource leaks and eventually traffic stops

• Juniper Networks Junos OS
• CWE-754

RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation

• rabbitmq-server
• CWE-20
• CWE-248

Improper check for unusual conditions in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• CWE-754

@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

• @fastify/jwt
• Authentication bypass
• CWE-390

Backstage has incorrect authorization in search engine permission filtering

• Broken access control
• CWE-754

<2.1.6 · fixed in 2.1.6

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

• CWE-754

>=1.0.0, <3.2.1 · fixed in 3.2.1

Guest can panic host through filesystem timestamp before the epoch on wasip3

• CWE-754

>=46.0.0, <48.0.4 || >=49.0.0, <49.0.2 · fixed in 48.0.4, 49.0.2

Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response

• ZcashFoundation zebra
• CWE-754

Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

• Anjvision YSSD-RTMP-H5
• CWE-754

undici vulnerable to Denial of Service via WebSocketStream unclean close

• CWE-248
• CWE-754

>=7.0.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 7.29.1, 8.10.2

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters

• envoy
• CWE-754

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

• nivocart
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

• CWE-754

<1.13.0 · fixed in 1.13.0

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

• Mattermost
• CWE-754

Boards plugin denial of service via unvalidated block fields.properties

• Mattermost
• CWE-754

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

• CWE-754
• CWE-1287

>=0.9.0, <0.11.1 · fixed in 0.11.1

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

• CWE-475
• CWE-754

>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final · fixed in 4.2.17.Final, 4.1.137.Final

XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook

• XenForo
• CWE-754

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

• CWE-248
• CWE-754

<0.0.0-20260617230736-314b6783e196 · fixed in 0.0.0-20260617230736-314b6783e196

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

Improper check for unusual conditions in Google Chrome

• Google Chrome
• CWE-754

cpu: hotplug: Preserve per instance callback errors

• Linux kernel
• CWE-754