Weakness (CWE)
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Source: MITRE CWE-345
278 results · Clear filters · Feed
-
High 7.5
WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-p…
-
High 7.4
Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else
Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.update_or_create_u…
-
High 8.1
Insecure XFT Transport in Progress WS_FTP Server
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
-
High 8.8
Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for name…
-
High 8.8
Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3
Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap an…
-
High 8.9
WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body…
-
High 7.5
Emerson Ovation Insufficient Verification of Data Authenticity
Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.
-
High 7.5
Unauthenticated Missing Integrity Verification in HPE Networking Fabric Composer
A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
-
High 8.0
Authenticated Missing Integrity Verification in API of HPE Networking Fabric Composer
A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged authenticated attacker to gain elevated privileges on the affected system.
-
High 7.5
Munshi Payment Bypass via Unauthenticated Webhook Endpoint
Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independen…
-
High 7.1
Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by …
-
High 8.8
Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges vi…
-
High 7.5
mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers s…
-
High 8.2
Yoosee GM8135S Camera Secure Boot signature verification
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. …
-
High 7.5
Unauthenticated payment reuse allows unpaid orders to be marked as paid
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried …
-
High 7.4
Goobi viewer: OpenID JWT audience not enforced by the verifier
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build(…
-
High 8.8
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as ap…
-
High 7.5
vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder …
-
High 8.8
Insufficient verification of data authenticity in Variations in Google Chrome prior to 156.0.8078.47 allowed an adjacen…
-
High 8.6
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware…
-
High 8.5
Lack of integrity checks in Mobatek’s MobaXterm
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious librar…
-
High 7.4
Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootabl…
-
High 8.6
Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor an…
-
High 7.4
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and co…
-
High 8.1
FileRise OIDC login can bind an attacker identity to an existing local account
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require emai…
-
High 8.2
OmniFaces: Forged combined-resource IDs and related output/push boundaries
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued i…
-
High 8.6
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be u…
-
High 8.9
Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying compo…
-
High 7.7
Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history…
-
High 7.5CVE-2026-62367 Public exploit
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+…
-
High 7.1
Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or curren…
-
High 7.5
Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orde…
-
High 7.5CVE-2026-104850 Public exploit
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authoriza…
-
High 7.1
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowe…
-
High 8.5
Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the b…
-
High 8.2
OpenPGP data signature accepted from a signing subkey without cross-certification
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature, in the case where that binding omits a…
-
High 8.2
OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check
In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext o…
-
High 7.5
Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 trans…
-
High 7.5
Apache Directory LDAP API: Injection of plaintext responses during StartTLS
Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This iss…
-
High 8.1
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the sys…