CWE-754.

Improper check for unusual conditions in Forcepoint F1E mac

• Forcepoint F1E mac
• CWE-754

RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

• rustfs
• CWE-693
• CWE-754

Improper check for unusual conditions in Intel(R) NPU Driver

• Intel(R) NPU Driver
• CWE-754

Improper check for unusual conditions in Intel(R) PROSet/Wireless WiFi Software

• Intel(R) PROSet/Wireless WiFi Software
• CWE-754

Improper check for unusual conditions in Intel(R) NPU Driver

• Intel(R) NPU Driver
• CWE-754

Improper check for unusual conditions in Intel(R) PROSet/Wireless WiFi Software

• Intel(R) PROSet/Wireless WiFi Software
• CWE-754

Improper check for unusual conditions in Intel(R) PROSet/Wireless WiFi Software for Windows

• Intel(R) PROSet/Wireless WiFi Software for Windows
• CWE-754

Improper check for unusual conditions in Siemens Desigo DXR2 and others

• Siemens Desigo DXR2
• Siemens Desigo PXC3
• CWE-754

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

• SAP_SE SAP Business AI Platform (Approuter)
• CWE-754

Signature validation vulnerability affecting DigiDoc applications

• Estonian Information System Authority (RIA) libdigidocpp
• Estonian Information System Authority (RIA) DigiDoc4
• Weak cryptography or TLS
• CWE-754

In CPDLC, False Emergency or Status Messages Will be Accepted as Legitimate

• ATN-B1 CPDLC
• CWE-754

In CPDLC, Malformed or Out of Sequence Frames Can Cause Resets

• ATN-B1 CPDLC
• CWE-754

epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition

• epsilla-cloud vectordb
• CWE-754

Socket.IO: Zero-attachment Memory Exhaustion

• CWE-20
• CWE-754

<3.3.6 || >=3.4.0, <3.4.5 || >=4.0.0, <4.2.7 · fixed in 3.3.6, 3.4.5, 4.2.7

Improper check for unusual conditions in MediaTek, Inc. MediaTek chipset

• MediaTek, Inc. MediaTek chipset
• CWE-754

Improper check for unusual conditions in Schneider Electric SCADAPack 47x and others

• Schneider Electric SCADAPack 47x
• Schneider Electric SCADAPack 47xi
• CWE-754

Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

• CWE-704
• CWE-754

<0.62.4 · fixed in 0.62.4

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

• CWE-754

<0.62.4 · fixed in 0.62.4

DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

• cure53 DOMPurify
• CWE-754

Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated

• NLnet Labs Unbound
• CWE-754

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

• HTTP request smuggling
• CWE-754

<0.27.26 · fixed in 0.27.26

Insufficient Input Validation in DevOps Loop

• HCLSoftware DevOps Loop
• CWE-754

Posting a malicious markdown image crashes the Mattermost Desktop App

• Mattermost
• CWE-754

Junos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effect

• Juniper Networks Junos OS
• CWE-754

Junos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash the PFE

• Juniper Networks Junos OS
• CWE-754

Junos OS: QFX10000 Series: IPv6 multicast traffic received on non-IRB interfaces causes a multicast flood

• Juniper Networks Junos OS
• CWE-754

Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-754

Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crash

• Juniper Networks Junos OS Evolved
• CWE-754

PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• CWE-754

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

• CWE-754

>=1.2.0-rc.0, <1.5.15 || >=1.6.0-rc.0, <1.6.17 || >=1.7.0-rc.0, <1.7.24 || >=1.8.0-rc.0, <1.8.9 · fixed in 1.5.15, 1.6.17, 1.7.24, 1.8.9

FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment

• FOSSBilling
• CWE-754
• CWE-1284

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

• CWE-116
• CWE-754

<0.6.0 · fixed in 0.6.0

kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)

• CWE-20
• CWE-754

<0.6.0 · fixed in 0.6.0

zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

• Denial of service
• CWE-20

<4.5.0 · fixed in 4.5.0

SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required

• CWE-754

<3.1.0 · fixed in 3.1.0

SurrealDB has unauthenticated remote DoS via malformed RPC `use` call

• CWE-248
• CWE-754

<3.1.0 · fixed in 3.1.0

ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder

• ImageMagick
• Memory corruption
• CWE-754

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

• CWE-248
• CWE-754

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

protobufjs : Schema-derived names can shadow runtime-significant properties

• Denial of service
• CWE-754

<7.6.3 || >=8.0.0, <8.6.0 · fixed in 7.6.3, 8.6.0

Typesense: Unauthenticated Denial of Service in the Typesense /multi_search Endpoint

• typesense
• CWE-754

PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• CWE-754

Nimiq network-libp2p: DHT query poisoning via first-record verification failure

• nimiq core-rs-albatross
• CWE-754

Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot

• Indian Motorcycle Scout Bobber + Tech
• CWE-636
• CWE-696

Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot

• Indian Motorcycle Scout Bobber + Tech
• CWE-636
• CWE-696

Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown

• Indian Motorcycle Scout Bobber + Tech
• CWE-440
• CWE-693

Indian Scout Bobber 2025 WCM voltage-based shutdown

• Indian Motorcycle Scout Bobber + Tech
• CWE-693
• CWE-754

SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031

• Drupal SAML SSO - Service Provider
• CWE-754

Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP

• Lakeside Software, LLC. SysTrack Agent
• Memory corruption
• CWE-754

Improper check for unusual conditions in Synology DiskStation Manager (DSM)

• Synology DiskStation Manager (DSM)
• CWE-754

Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing

• CWE-754

>=10.11.0, <10.11.15 || >=11.4.0, <11.4.5 || >=11.5.0, <11.5.4 || >=11.6.0, <11.6.1 · fixed in 10.11.15, 11.4.5, 11.5.4, 11.6.1

nimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addresses

• nimiq core-rs-albatross
• CWE-754

Invalid handling of CLASS != IN

• ISC BIND 9
• Memory corruption
• Denial of service

Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034

• Drupal Node View Permissions
• CWE-754

Improper check for unusual conditions in Samsung Open Source Escargot

• Samsung Open Source Escargot
• CWE-754

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

• CWE-20
• CWE-754

<0.9.0 · fixed in 0.9.0

Calling window.close() from server-side content causes crash in the Mattermost Desktop App

• Mattermost
• CWE-754

Mattermost doesn't validate the response body of proxied images

• CWE-754

>=0.0.0-20250731163400-5b955468ea1e, <0.0.0-20260414103857-b21ef302025e || >=11.4.0, <11.4.4 || >=11.5.0, <11.5.2 · fixed in 0.0.0-20260414103857-b21ef302025e, 11.4.4, 11.5.2

Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities

• Palo Alto Networks Trust Protection Foundation
• CWE-754

Prisma Browser: Access and Data Rule Bypass

• Palo Alto Networks Prisma Browser
• CWE-754

PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• CWE-754