CWE-754 · Input Validation and Logic
Improper Check for Unusual or Exceptional Conditions
603CVEs
4exploited
0with a public check
5likely (EPSS 10%+)
SortMost likely exploited
603 CVEs with CWE-754 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-3393In CISA KEVExploitedPAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted PacketPalo Alto Networks · Cloud NGFW · CVSS 8.7 · 2024-12-27 | 8.7 | 30% | 2024-12-27 |
| CVE-2023-41993In CISA KEVExploitedThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that…Apple · macOS · CVSS 8.8 · 2023-09-21 | 8.8 | 24% | 2023-09-21 |
| CVE-2023-41992In CISA KEVExploitedThe issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate the…Apple · macOS · CVSS 7.8 · 2023-09-21 | 7.8 | 12% | 2023-09-21 |
| CVE-2025-39682In CISA KEVExploitedtls: fix handling of zero-length records on the rx_listLinux · Linux · CVSS 9.8 · 2025-09-05 | 9.8 | 3.3% | 2025-09-05 |
| CVE-2024-4367A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox E…Mozilla · Firefox · CVSS 5.6 · 2024-05-14 | 5.6 | 71% | 2024-05-14 |
| CVE-2022-39288Denial of service in Fastify via Content-Type headerfastify · fastify · CVSS 7.5 · 2022-10-10 | 7.5 | 59% | 2022-10-10 |
| CVE-2024-43044Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar`…Jenkins Project · Jenkins · CVSS 8.8 · 2024-08-07 | 8.8 | 29% | 2024-08-07 |
| CVE-2017-17085In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length.Wireshark · Wireshark · 2017-12-01 | – | 17% | 2017-12-01 |
| CVE-2018-7287An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1. If the HTTP server is enabled (default is disabled), WebSocket payloads of size 0 are mishandled (…Digium · Asterisk · 2018-02-22 | – | 11% | 2018-02-22 |
| CVE-2026-40343free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creationfree5gc · udr · CVSS 6.9 · 2026-04-21 | 6.9 | 8.6% | 2026-04-21 |
| CVE-2022-20130In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additiona…Google · Android · 2022-06-15 | – | 8.5% | 2022-06-15 |
| CVE-2020-28037is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a n…Wordpress · Wordpress · 2020-10-31 | – | 8.1% | 2020-10-31 |
| CVE-2022-23712A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically…Elastic · elasticsearch · 2022-06-06 | – | 7.5% | 2022-06-06 |
| CVE-2019-19646pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.Sqlite · Sqlite · 2019-12-09 | – | 7.4% | 2019-12-09 |
| CVE-2017-11144In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could…Php · Php · 2017-07-10 | – | 6.2% | 2017-07-10 |
| CVE-2019-20175An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_…Qemu · Qemu · 2019-12-31 | – | 3.4% | 2019-12-31 |
| CVE-2022-38152An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation…Wolfssl · Wolfssl · 2022-08-31 | – | 2.9% | 2022-08-31 |
| CVE-2021-27568An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by…Json-Smart Project · Json-Smart-V1 · 2021-02-23 | – | 2.9% | 2021-02-23 |
| CVE-2022-21676Uncaught Exception in engine.iosocketio · engine.io · CVSS 7.5 · 2022-01-12 | 7.5 | 2.9% | 2022-01-12 |
| CVE-2021-32946An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper va…Opendesign · Drawings SDK · 2021-06-17 | – | 2.8% | 2021-06-17 |
| CVE-2018-7789An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0)…Schneider Electric SE · Modicon M221, all references, all versions prior to firmware V1.6.2.0 · CVSS 4.8 · 2018-08-29 | 4.8 | 2.8% | 2018-08-29 |
| CVE-2026-25639Axios affected by Denial of Service via __proto__ Key in mergeConfigaxios · axios · CVSS 7.5 · 2026-02-09 | 7.5 | 2.8% | 2026-02-09 |
| CVE-2019-11779In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters,…The Eclipse Foundation · Eclipse Mosquitto · 2019-09-19 | – | 2.7% | 2019-09-19 |
| CVE-2017-17084In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length.Wireshark · Wireshark · 2017-12-01 | – | 2.7% | 2017-12-01 |
| CVE-2017-17083In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed in epan/dissectors/packet-netbios.c by ensuring that write operations are bo…Wireshark · Wireshark · 2017-12-01 | – | 2.7% | 2017-12-01 |
| CVE-2018-7855A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service whe…Schneider-Electric · Modicon M580 Modicon M340 Modicon Quantum Modicon Premium · 2019-05-22 | – | 2.6% | 2019-05-22 |
| CVE-2019-9633gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting enumeration, which allows remote attacke…Gnome · Glib · 2019-03-08 | – | 2.3% | 2019-03-08 |
| CVE-2020-35931An issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF before 9.7.5 and 10.x before 10.1.1 (and before 4.1.1 on macOS). An attacker can s…Foxitsoftware · Foxit Reader · 2020-12-31 | – | 2.3% | 2020-12-31 |
| CVE-2020-6385Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page.Google · Chrome · 2020-02-11 | – | 2.3% | 2020-02-11 |
| CVE-2018-7854A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service whe…Schneider-Electric · Modicon M580 Modicon M340 Modicon Quantum Modicon Premium · 2019-05-22 | – | 2.2% | 2019-05-22 |
| CVE-2019-7167Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven st…Z.cash · Zcash · 2019-03-27 | – | 2.2% | 2019-03-27 |
| CVE-2019-10051An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft.new_chunk }" item, then the program enters an smb/files.rs…Suricata-Ids · Suricata · 2019-08-28 | – | 2.1% | 2019-08-28 |
| CVE-2017-12119An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted JSON requests can cause an unhandled exception resulting in de…Talos · CPP-Ethereum · CVSS 7.5 · 2018-01-19 | 7.5 | 2.1% | 2018-01-19 |
| CVE-2019-6813A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions) and Modicon M340 controlle…CVE-2019-6813 · BMXNOR0200H Ethernet / Serial RTU module · 2019-09-17 | – | 2.1% | 2019-09-17 |
| CVE-2020-3421Cisco IOS XE Software Zone-Based Firewall Denial of Service VulnerabilitiesCisco · Cisco IOS XE Software · CVSS 8.6 · 2020-09-24 | 8.6 | 1.9% | 2020-09-24 |
| CVE-2018-7853A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when…Schneider-Electric · Modicon M580 Modicon M340 Modicon Quantum Modicon Premium · 2019-05-22 | – | 1.8% | 2019-05-22 |
| CVE-2020-36382OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of…Openvpn · OpenVPN Access Server · 2021-06-04 | – | 1.8% | 2021-06-04 |
| CVE-2017-13142In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files.Imagemagick · Imagemagick · 2017-08-23 | – | 1.8% | 2017-08-23 |
| CVE-2020-10571An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.Psd-Tools Project · Psd-Tools · 2020-03-14 | – | 1.8% | 2020-03-14 |
| CVE-2022-31093Improper Handling of `callbackUrl` parameter in next-authnextauthjs · next-auth · CVSS 7.5 · 2022-06-27 | 7.5 | 1.7% | 2022-06-27 |
| CVE-2021-41135Authz Module Non-Determinismcosmos · cosmos-sdk · CVSS 6.5 · 2021-10-20 | 6.5 | 1.7% | 2021-10-20 |
| CVE-2021-39162Incorrect handling of H2 GOAWAY + SETTINGS framespomerium · pomerium · CVSS 8.6 · 2021-09-09 | 8.6 | 1.6% | 2021-09-09 |
| CVE-2019-6857A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for…Schneider Electric SE · Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security noti… · CVSS 7.5 · 2020-01-06 | 7.5 | 1.6% | 2020-01-06 |
| CVE-2019-6856A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for…Schneider Electric SE · Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security noti… · CVSS 7.5 · 2020-01-06 | 7.5 | 1.6% | 2020-01-06 |
| CVE-2019-5763Failure to check error conditions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · 2019-02-19 | – | 1.6% | 2019-02-19 |
| CVE-2018-7857A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of S…Schneider-Electric · Modicon M580 Modicon M340 Modicon Quantum Modicon Premium · 2019-05-22 | – | 1.6% | 2019-05-22 |
| CVE-2018-7856A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of S…Schneider-Electric · Modicon M580 Modicon M340 Modicon Quantum Modicon Premium · 2019-05-22 | – | 1.6% | 2019-05-22 |
| CVE-2021-43801Uncaught Exception in mercuriusmercurius-js · mercurius · CVSS 7.5 · 2021-12-13 | 7.5 | 1.6% | 2021-12-13 |
| CVE-2021-1446Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service VulnerabilityCisco · Cisco IOS XE Software · CVSS 8.6 · 2021-03-24 | 8.6 | 1.5% | 2021-03-24 |
| CVE-2020-8986lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with…Zend · Zendto · 2020-03-24 | – | 1.5% | 2020-03-24 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.