Skip to content
OpenAdvisories

Weakness (CWE)

CWE-420: Unprotected Alternate Channel

Base Draft

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.

Source: MITRE CWE-420

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2026-40217 Public exploit EPSS 17%

    LiteLLM has a sandbox escape in custom-code guardrail

    LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

    BerriAI litellm litellm PyPI
  • Medium 4.3
    CVE-2026-25916 Public exploit

    Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

    Roundcube Webmail roundcube roundcube Debian Ubuntu
  • High 7.5
    CVE-2025-67303 Public exploit

    ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

    An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web…

    comfyui-manager PyPI
  • Critical 9.3
    CVE-2025-13315 Public exploit EPSS 31%

    Unauthenticated log access in Twonky Server

    Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

    Lynxtechnology Twonky Server
  • Critical 9.0
    CVE-2025-54309 Exploited Public exploit EPSS 93%

    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation an…

    CrushFTP CrushFTP
    KEV Jul 22, 2025
  • Critical 10.0
    CVE-2023-20198 Exploited Public exploit EPSS 100%

    Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IO…

    Cisco Cisco IOS XE Software iOS Network devices
    KEV Oct 16, 2023
  • Medium 5.4
    CVE-2020-8558 Public exploit

    Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

    The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network …

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go