CWE-755: Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
198 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-10156 — PickleScan Security Bypass via Bad CRC in ZIP Archive
- CVE-2026-21906 — Junos OS: SRX Series: With GRE performance acceleration enabled, receipt of a specific ICMP packet causes the PFE to crash
- CVE-2025-9437 — Rockwell Automation ArmorStart® AOP Denial-of-Service Vulnerability
- CVE-2025-68274 — SIPGO library has response DoS vulnerability via nil pointer dereference
- CVE-2024-39555 — Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP update causes the session to reset
- CVE-2024-39552 — Junos OS and Junos OS Evolved: Malformed BGP UPDATE causes RPD crash
- CVE-2024-39547 — Junos OS and Junos OS Evolved: cRPD: Receipt of crafted TCP traffic can trigger high CPU utilization
- CVE-2024-39525 — Junos OS and Junos OS Evolved: When BGP traceoptions is enabled, receipt of specially crafted BGP packet causes RPD crash
- CVE-2024-0108 — NVIDIA Jetson Linux contains a vulnerability in NvGPU where error handling paths in GPU MMU mapping code fail to clean u
- CVE-2025-52948 — Junos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabled
- CVE-2024-47491 — Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP path attribute leads to an RPD crash
- CVE-2025-54634 — Vulnerability of improper processing of abnormal conditions in huge page separation. Impact: Successful exploitation of
- CVE-2025-46733 — REE userspace code can panic TAs, leading to fTPM PCR reset and data disclosure
- CVE-2025-59530 — quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame
- CVE-2025-58047 — Volto affected by possible DoS by invoking specific URL by anonymous user
- CVE-2025-43864 — React Router allows a DoS via cache poisoning by forcing SPA mode
- CVE-2024-32652 — @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed
- CVE-2026-28542 — Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability m
- CVE-2026-49235 — Routinator crashes on specifically crafted RRDP XML files
- CVE-2026-49232 — Routinator exits when accepting an incoming HTTP or RTR connection fails
Recently published
- CVE-2026-49305 — Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability
- CVE-2026-45819 — baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input para
- CVE-2026-52856 — Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
- CVE-2026-59952 — Valibot: record() issue paths can make flatten() throw for inherited Object property names
- CVE-2026-42792 — epmd permanent DoS via EMFILE on accept(2) in erts
- CVE-2026-48036 — Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
- CVE-2026-16730 — Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
- CVE-2026-62994 — CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
- CVE-2026-59162 — Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
- CVE-2026-54775 — CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.
- CVE-2026-59927 — Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
- CVE-2026-55577 — ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder
- CVE-2026-44505 — Nimiq network-libp2p: Untrusted peer can wedge DHT
- CVE-2026-49235 — Routinator crashes on specifically crafted RRDP XML files
- CVE-2026-49232 — Routinator exits when accepting an incoming HTTP or RTR connection fails
- CVE-2026-9516 — Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws
- CVE-2026-48524 — PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
- CVE-2026-44319 — free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)
- CVE-2026-44325 — free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)
- CVE-2026-44902 — opentelemetry-js: Prometheus exporter process crash via malformed HTTP request
More specific weaknesses
- CWE-274 — Improper Handling of Insufficient Privileges
- CWE-280 — Improper Handling of Insufficient Permissions or Privileges
- CWE-390 — Detection of Error Condition Without Action
- CWE-392 — Missing Report of Error Condition
- CWE-544 — Missing Standardized Error Handling Mechanism
- CWE-756 — Missing Custom Error Page