Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation.
This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and prior, network-libp2p discovery accepts signed PeerContact updates from untrusted peers and stores them in a peer contact book, eventually leading to address book crash. A PeerContact can legally contain an empty addresses list (no intrinsic validation enforces non-empty). Later, PeerContactBook::known_peers builds an address book by taking addresses.first().expect("every peer should have at least one address"). If the attacker has inserted a signed peer contact with addresses=[], any call to get_address_book (RPC/web client) can panic and crash the node/RPC task depending on panic settings. This issue has been fixed in version 1.4.0.
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`.
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing.
This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.
CVE-2026-47315 is a medium severity vulnerability in Samsung Open Source Escargot caused by improper checking for unusual or exceptional conditions. This flaw allows input data manipulation but does not impact confidentiality or integrity, only availability. It affects a specific Escargot version identified by commit 590345cc6258317c5da850d846ce6baaf2afc2d3. No official patch or remediation guidance is currently available, and no known exploits exist in the wild.
Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.
A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control policies.
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic.
Panorama and Cloud NGFW are not impacted by these vulnerabilities.
Clerk JavaScript is the official JavaScript repository for Clerk authentication.has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.
A vulnerability in Admidio prior to version 5.0.9 allows an administrator to remove the last remaining other administrator, resulting in a lockout from administrative access. The issue arises because the current Role::stopMembership() function does not check if removing a user leaves zero administrators, unlike the deprecated Membership::stopMembership() which included this safety check. This flaw has been fixed in version 5.0.9.
An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections.
A vulnerability in nimiq-blockchain versions prior to 1.3.0 allows a remote peer to cause a panic via improper input validation in the HistoryStore component. Specifically, the function put_historic_txns uses an assert to enforce block number invariants, which can be violated by a malformed history list during history synchronization, leading to a denial of service. The issue is fixed in version 1.3.0. No known workarounds exist.
The printenv utility in uutils coreutils does not display environment variables containing invalid UTF-8 byte sequences, silently skipping them instead. This behavior deviates from POSIX standards, which allow arbitrary bytes in environment strings. As a result, malicious environment variables with invalid UTF-8 can evade inspection by administrators or security tools, potentially hiding attacks such as library injection. The vulnerability affects version 0 of uutils coreutils and has a medium severity rating with a CVSS score of 4.4.
CVE-2026-40343 is a medium severity vulnerability in free5GC's user data repository (UDR) component up to version 1.4.2. The flaw involves improper handling of errors in the POST handler for the /nudr-dr/v2/policy-data/subs-to-notify endpoint, where the service continues processing requests despite failures in request body retrieval or deserialization. This can lead to unintended creation of policy data notification subscriptions with invalid or incomplete input. No patch or official remediation is available at the time of publication.
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.
CVE-2026-21009 is a medium severity vulnerability in Samsung Mobile Devices involving an improper check for exceptional conditions in the Recents feature prior to the SMR April 2026 Release 1. This flaw allows a physical attacker to bypass the App Pinning security feature. The vulnerability has a CVSS 4.1 score, indicating a moderate risk. No official patch or remediation level has been confirmed yet. There are no known exploits in the wild at this time.
CVE-2026-21007 is a medium severity vulnerability affecting Samsung Mobile Devices. It involves an improper check for exceptional conditions in the Device Care component prior to the SMR April 2026 Release 1. This flaw allows physical attackers to bypass the Knox Guard security feature. The vulnerability has a CVSS 4.4 score, indicating a moderate risk. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.
An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an attacker sending a specific, malformed ICMPv6 packet to cause the srxpfe process to crash and restart. Continued receipt and processing of these packets will repeatedly crash the srxpfe process and sustain the Denial of Service (DoS) condition.
During NAT64 translation, receipt of a specific, malformed ICMPv6 packet destined to the device will cause the srxpfe process to crash and restart.
This issue cannot be triggered using IPv4 nor other IPv6 traffic.
This issue affects Junos OS on SRX Series:
* all versions before 21.2R3-S10,
* all versions of 21.3,
* from 21.4 before 21.4R3-S12,
* all versions of 22.1,
* from 22.2 before 22.2R3-S8,
* all versions of 22.4,
* from 22.4 before 22.4R3-S9,
* from 23.2 before 23.2R2-S6,
* from 23.4 before 23.4R2-S7,
* from 24.2 before 24.2R2-S3,
* from 24.4 before 24.4R2-S3,
* from 25.2 before 25.2R1-S2, 25.2R2.