Skip to content
OpenAdvisories

Weakness (CWE)

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data

Base Draft

The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Source: MITRE CWE-349

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-123583

    Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses

    The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bail…

    hickory-dns hickory-dns rust-hickory-resolver rust-hickory-resolver Debian Ubuntu
  • Low 1.9
    CVE-2026-59263

    Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.

    A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this…

    Apache Software Foundation Apache OpenOffice
  • Low 2.3
    CVE-2026-62364

    wlc may disclose API tokens to project-configured URLs

    wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a…

    WeblateOrg wlc wlc wlc Debian Ubuntu PyPI
  • Low 2.3
    CVE-2026-46342

    Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

    Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint acc…

    nuxt nuxt nuxt @nuxt/nitro-server npm
  • Low 3.7
    CVE-2026-44572

    Next.js: Middleware / Proxy redirects can be cache-poisoned

    Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happen…

    vercel next.js next npm
  • Low 3.7
    CVE-2026-41354

    OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys

    OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message…

    OpenClaw OpenClaw openclaw npm
  • Low 3.7
    CVE-2024-21094

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

    Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine
  • Low 3.3
    CVE-2023-5548

    Moodle: cache poisoning risk with endpoint revision numbers

    Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.

    moodle/moodle moodle Web / CMS Ubuntu Packagist