CWE-754 Improper Check for Unusual or Exceptional Conditions

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

Backstage has incorrect authorization in search engine permission filtering

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

undici vulnerable to Denial of Service via WebSocketStream unclean close

Potential buffer overflow in psd-tools

socket.io has an unhandled 'error' event

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Phoenix: Presence keys colliding with `Object.prototype` members break existence checks

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Socket.IO: Zero-attachment Memory Exhaustion

protobufjs : Schema-derived names can shadow runtime-significant properties

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

Duplicate Advisory: uutils coreutils has an Improper Check for Unusual or Exceptional Conditions

kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)

zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required

SurrealDB has unauthenticated remote DoS via malformed RPC `use` call

Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

Clerk has an authorization bypass when combining organization, billing, or reverification checks