CWE-754: Unchecked Error Condition vulnerabilities

CVE-2026-0321 is a medium severity denial of service vulnerability in Palo Alto Networks PAN-OS software affecting certain versions. An unauthenticated attacker with network access can send specially crafted traffic to cause the firewall to enter maintenance mode, disrupting service. Cloud NGFW and Panorama products are not affected by this issue.

CVE-2026-102077 is a high-severity vulnerability in Juniper Networks Junos OS on MX Series with SPC3 line-cards. It involves improper handling of malformed IPv6 packets when source NAT is configured, causing the device to allocate NAT resources unnecessarily. This leads to session or resource exhaustion, resulting in a denial-of-service (DoS) condition that requires a device reboot to recover.

CVE-2026-67416 is an improper input validation vulnerability in the AMQP 1.0 server_mode parser of rabbitmq-server versions 4.0.0 up to but not including 4.0.24, 4.1.15, 4.2.10, and 4.3.4. An authenticated AMQP 1.0 publisher with write permission can submit a crafted descriptor that causes RabbitMQ to misclassify message bodies, leading to consumer termination during decoding. The broker remains operational and routing or authorization is not bypassed. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Protection mechanism bypass.

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the session's privilege level, so any authenticated user can trigger it.

CVE-2026-73549 is a medium severity vulnerability in Envoy proxy prior to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. It involves improper handling of scoped IPv6 addresses in certain network paths, which can cause the process to terminate unexpectedly due to exceptions or aborts. This affects deployments using kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy setups and certain QUIC connection paths. The issue is fixed in the specified versions.

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the operation as successful and continues parsing from the wrong offset. A malicious or compromised broker can provide an oversized longstr in a table field and desynchronize subsequent AMQP parsing, causing attacker-controlled trailing bytes to be interpreted as later fields or frames and disrupting connection integrity and availability. This issue is fixed in version 1.13.0.

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.

ALOS HTTP, a Go web framework and application server, has a vulnerability where a malformed request path starting with a question mark can cause an out-of-bounds panic. This occurs because the code accesses an array element without checking if the array is empty, leading to server process termination. The issue is fixed in version 0.0.0-20260617230736-314b6783e196.

CVE-2026-75595 is a critical vulnerability in the Netty network application framework affecting versions prior to 4.1.137.Final and 4.2.17.Final. The flaw arises from an improper check of the TLS handshake header offset in SslClientHelloHandler#decode, which can cause an IndexOutOfBoundsException and lead to the selection of a default SSL context instead of the intended SNI-specific context. This behavior allows an unauthenticated remote attacker to bypass mutual TLS authentication requirements in certain deployment configurations where client authentication is enforced solely by per-SNI settings. The issue is fixed in Netty versions 4.1.137.Final and 4.2.17.Final.

This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758.

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an all-zero shared secret, after which compute_exchange_hash calls encode_mpint in russh/src/kex/mod.rs and indexes beyond the end of the input while skipping leading zero bytes. The resulting panic occurs before authentication and terminates the server key-exchange task. This issue is fixed in version 0.62.4.

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_secret function in russh/src/kex/curve25519.rs passes the decoded exchange.server_ephemeral value to clone_from_slice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality.

SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity.

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency.

Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency.

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11012302; Issue ID: MSV-7833.