Skip to content
OpenAdvisories

Weakness (CWE)

CWE-755: Improper Handling of Exceptional Conditions

Class Incomplete Mapping discouraged

The product does not handle or incorrectly handles an exceptional condition.

Source: MITRE CWE-755

All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-109619 Exploited Public exploit EPSS 100%

    RCE via stale global state

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
    KEV Oct 26, 2026
  • Critical 9.2
    CVE-2026-109618 Exploited Public exploit EPSS 100%

    RCE via OOM corruption

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
    KEV Oct 26, 2026
  • High 7.5
    CVE-2026-52856 Public exploit

    Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

    Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

    pterodactyl wings github.com/pterodactyl/wings Go
  • High 7.5
    CVE-2025-43864 Public exploit EPSS 20%

    React Router allows a DoS via cache poisoning by forcing SPA mode

    React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes a…

    remix-run react-router react-router npm
  • High 7.5
    CVE-2024-21907 Public exploit EPSS 33%

    Improper Handling of Exceptional Conditions in Newtonsoft.Json

    Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending…

    Newtonsoft.Json newtonsoft-json Ubuntu NuGet
  • Medium 5.5
    CVE-2023-3280 Public exploit

    Cortex XDR Agent: Local Windows User Can Disable the Agent

    A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent.

    Palo Alto Networks Cortex XDR Agent Network devices
  • High 8.8
    CVE-2021-38003 Exploited Public exploit EPSS 39%

    Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially expl…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • High 7.5
    CVE-2021-28165 Public exploit EPSS 54%

    Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

    In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  • High 7.5
    CVE-2020-26160 Public exploit

    Authorization bypass in github.com/dgrijalva/jwt-go

    jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…

    gitea golang-github-coreos-discovery-etcd-io github.com/dgrijalva/jwt-go/v4 golang-github-dgrijalva-jwt-go Debian Ubuntu Alpine Go
  • Critical 9.8
    CVE-2020-7247 Exploited Public exploit EPSS 99%

    smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to…

    opensmtpd opensmtpd opensmtpd Debian Ubuntu Alpine
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2019-17195 Public exploit EPSS 11%

    Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT

    Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

    com.nimbusds:nimbus-jose-jwt Maven
  • High 7.5
    CVE-2019-10742 Public exploit

    Denial of Service in axios

    Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

    axios axios node-axios axios Debian npm
  • High 8.1
    CVE-2018-8039 Public exploit

    Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.*

    It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the Ho…

    Apache Software Foundation Apache CXF org.apache.cxf:apache-cxf org.apache.cxf:cxf-rt-transports-http Maven
  • Critical 9.8
    CVE-2017-5638 Exploited · Ransomware Public exploit EPSS 100%

    Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021