CWE-807: Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 4.3 Medium
- umputun remark42 Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment 6.5 Medium
- aws aws-nitro-enclaves-sdk-c Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint 8.2 High
- yunaiv yudao-cloud yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header 7.1 High
- authlib Authlib: ID token can disable its own nonce validation via the nonce_supported claim 4.2 Medium
- nlnet labs unbound Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. 6.5 Medium
- aio-libs aiohttp AIOHTTP: Absolute-form request targets can spoof Request.scheme 6.3 Medium
- makeplane plane makeplane API Endpoint reliance on untrusted inputs in a security decision 6.9 Medium
- microsoft 365 apps, 365 apps for enterprise, office 365 for mac +7 more +9 more Microsoft Office Word Security Feature Bypass Vulnerability 7.8 High
- eclipse foundation connected services platform In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver... 6.5 Medium
- gitea Gitea required Actions check bypass through skipped workflows 6.5 Medium
- microsoft powershell, powershell 7.6, microsoft powershell 7.4 +1 more +3 more Microsoft PowerShell Remote Code Execution Vulnerability 8.8 High
- microsoft 365 apps, 365 apps for enterprise, office 365 for mac +6 more +8 more Microsoft Office Word Security Feature Bypass Vulnerability 7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows IKE Extension Spoofing Vulnerability 8.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Microsoft PowerShell Remote Code Execution Vulnerability 8.8 High
- microsoft visual studio code Visual Studio Code Security Feature Bypass Vulnerability 7.4 High
- gitlab Reliance on Untrusted Inputs in a Security Decision in GitLab 4.3 Medium
- ph7software ph7builder pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID 6.9 Medium
- progressive robot ltd hmailserver Reliance on Untrusted Inputs in a Security Decision in hMailServer 7.8 High
- katex KaTeX: Existing prototype pollution can bypass trust restrictions 2.1 Low
- tryghost ghost Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite 5.3 Medium
- genians, inc genian nac 4.0.175 release, genian nac 5.0.65 lts release, genian nac 5.0.75 lts release +6 more +8 more Genians, Inc Genian NAC/ZTNA Remote Code Execution 5.9 Medium
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Remote Code Execution 7.2 High
- deepseek-ai deepseek-harness deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision 4.8 Medium
- agentverus agentverus-scanner agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision 2.4 Low
- goauthentik authentik authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage 8.9 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 more Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisionin… 9.9 Critical
- decolua 9router 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header 5.3 Medium
- decolua 9router 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header 7.3 High
- mailu helm-charts, mailu +1 more Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust 9.8 Critical
- temporal technologies, inc. server Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization 7.2 High
- syslifters sysreptor SysReptor: Host header injection might allow account takeover 8.1 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 more pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode 9.3 Critical
- go github.com/neuvector/neuvector Admission Control Bypass via Hardcoded Sidecar Image Exemption 5.3 Medium
- joomshaper.com sp page builder (pro) extension for joomla Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 6.9 Medium
- joomshaper.com sp page builder (pro) extension for joomla Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 6.9 Medium
- traefik Traefik entrypoint header-name sanitization bypassed via request trailers 7.0 High
- ncarlier webhookd webhookd: Unrestricted HTTP Header to Shell Variable Injection 6.5 Medium
- google chrome Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a... 8.3 High
- deepseek harness DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing 9.4 Critical
- sap se netweaver (sap gui for java) Improper Access Control in SAP NetWeaver (SAP GUI for Java) 9.0 Critical
- getgrav grav-plugin-form Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass 9.3 Critical
- apache apisix Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers 5.3 Medium
- goauthentik authentik authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView 8.6 High
- rsyncproject rsync rsync < 3.5.0 Arbitrary File Deletion via Malicious File List 7.1 High
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 more Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision 5.3 Medium
- grokability snipe-it Snipe-IT Checkout Request Cancellation IDOR 5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 more Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data 7.1 High
- sap approuter, sap se business ai platform (approuter) +1 more Multiple vulnerabilities in SAP Business AI Platform (Approuter) 3.7 Low
- ibm langflow oss, langflow +1 more Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features 8.5 High
- Show olderLoading…