CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- langflow-ai langflowLangflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write7.1 High
- mitel mivoice office 400Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution8.5 High
- invariant-systems-ai aiirinvariant-systems-ai aiir Policy Gate signature verification6.9 Medium
- legion of the bouncy castle inc. bc-javaOpenPGP data signature accepted from a signing subkey without cross-certification8.2 High
- legion of the bouncy castle inc. bc-fja, bc-java, bc-lts-java +2 moreOpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check8.2 High
- zcashfoundation zebraZebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite8.7 High
- zcashfoundation zebraZebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes6.3 Medium
- apache software foundation directory ldap apiApache Directory LDAP API: Injection of plaintext responses during StartTLS7.5 High
- authlibCVE-2026-1040569.8 Critical
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Insufficient Verification of Data Authenticity4.9 Medium
- shrec ultrafastsecp256k1UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding5.9 Medium
- apache wss4jApache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection9.1 Critical
- grafana enterprise, oss +1 moreEditor can forge file-provisioning provenance on dashboards via the dashboard API5.4 Medium
- jupyter notebook, jupyterlab, jupyterlab jupyterlite-core +2 moreJupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard8.1 High
- electronElectron: Sandboxed preload code cache can be poisoned by a compromised renderer7.8 High
- eclipse foundation threadxOut-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader6.9 Medium
- trusted domain project opendmarcTrusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation5.3 Medium
- jpadilla pyjwtPyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion6.5 Medium
- jpadilla pyjwtPyJWT: PyJWKClient follows redirects when fetching JWKS7.4 High
- soft8soft llc verge3d publishing and e-commerceVerge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done5.3 Medium
- unknown paymatticPaymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent5.3 Medium
- syliusSylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite8.7 High
- cordea oauthFriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider9.8 Critical
- botslab g980hBotslab G980H Dashcams Insufficient Verification of Data Authenticity9.2 Critical
- goauthentik authentikauthentik: Authentication bypass via assertion confusion in SAML sources7.4 High
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback5.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions4.6 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Remote Code Execution Vulnerability9.8 Critical
- notepad-plus-plusNotepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog6.7 Medium
- gitroomhq postiz-appUnauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key7.1 High
- laurent22 joplinJoplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName7.1 High
- eclipse foundation open vsxUrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no che…9.1 Critical
- easy payment payment gateway for paypal on woocommercePayment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion5.3 Medium
- jordy meow meow galleryMeow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route6.5 Medium
- anycableAnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body5.9 Medium
- microsoft azure billingAzure Billing Elevation of Privilege Vulnerability10.0 Critical
- mythicalltd mythicaldashMythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up7.1 High
- wpengine faustjsFaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope8.8 High
- midnightbsd mportmport mirror-selection ping accepts insufficiently validated ICMP replies2.3 Low
- midnightbsd mportmport permits repository and package mirror fetches over insecure transport6.0 Medium
- midnightbsd mportmport bootstrap index fetch can continue after hash verification failure8.3 High
- libp2p js-libp2plibp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses8.2 High
- libp2p js-libp2plibp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID7.5 High
- dell smartfabric managerDell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data...8.1 High
- unknown fluentauthWordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability5.3 Medium
- robokassa payment gateway for woocommerce, unknown robokassa payment gateway for woocommerce +1 moreRobokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback3.7 Low
- djust-org djustdjust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)8.1 High
- modelcontextprotocol rust-sdkRMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery8.2 High
- jenkins project bitbucket server integration pluginThe OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier...4.2 Medium
- isc bind 9checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof5.9 Medium
- Show moreLoading…