Skip to content
OpenAdvisories

Weakness (CWE)

CWE-345: Insufficient Verification of Data Authenticity

Class Draft Mapping discouraged

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE-345

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-114612 Public exploit

    LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authen…

    BerriAI litellm litellm PyPI
  • Critical 9.3
    CVE-2026-39324 Public exploit

    Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

    Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default deco…

    rack rack-session rack-session ruby-rack-session Debian Ubuntu RubyGems
  • Critical 9.4
    CVE-2025-59934 Public exploit

    Formbricks missing JWT signature verification

    Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both…

    formbricks formbricks
  • Critical 9.1
    CVE-2025-27558 Public exploit

    IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected A…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Critical 9.8
    CVE-2024-45410 Public exploit

    HTTP client can remove the X-Forwarded headers in Traefik

    Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it sho…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Alpine Go
  • Critical 9.1
    CVE-2022-20829 Public exploit

    Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution Vulnerability

    A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker with administrative privileges to upl…

    Cisco Cisco Adaptive Security Appliance (ASA) Software Network devices