CWE-345 · Insufficient Verification of Data Authenticity (page 4)
Page 4 of 9 — CVEs classified under CWE-345, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-30792 | High | 8.1 | 2026-03-05 | A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config op… |
CVE-2026-2836 | High | 8.1 | 2026-03-05 | A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP… |
CVE-2025-63910 | High | 7.2 | 2026-03-03 | An authenticated arbitrary file upload vulnerability in Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows attackers with Administrator privi… |
CVE-2025-15598 | Low | 3.7 | 2026-03-03 | A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the… |
CVE-2026-2428 | High | 7.5 | 2026-02-27 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1… |
CVE-2026-27510 | Critical | 9.6 | 2026-02-26 | Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code exec… |
CVE-2025-71057 | High | 8.2 | 2026-02-26 | Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing th… |
CVE-2026-27804 | Critical | 9.1 | 2026-02-26 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthent… |
CVE-2026-27700 | High | 8.2 | 2026-02-25 | Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/a… |
CVE-2026-2968 | Low | 3.7 | 2026-02-23 | A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of the file /src/tls_chacha20.c of the comp… |
CVE-2026-2385 | Medium | 5.3 | 2026-02-22 | The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Ve… |
CVE-2026-26327 | Medium | 6.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Discovery beacons (Bonjour/mDNS and DNS-SD) include TXT records such as `lanHost`, `tailnetDns`, `gatewayPort`, and `gatew… |
CVE-2026-25474 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may… |
CVE-2025-14444 | Medium | 5.3 | 2026-02-18 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insuf… |
CVE-2026-26007 | Medium | 6.5 | 2026-02-10 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or Ellipt… |
CVE-2026-21527 | Medium | 6.5 | 2026-02-10 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59024 | Medium | 6.5 | 2026-02-09 | Crafted delegations or IP fragments can poison cached delegations in Recursor. |
CVE-2026-1642 | Medium | 5.9 | 2026-02-04 | A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-m… |
CVE-2026-24775 | Medium | 6.3 | 2026-01-28 | OpenProject is an open-source, web-based project management software. In the new editor for collaborative documents based on BlockNote, OpenProject maintainers… |
CVE-2026-24772 | High | 8.9 | 2026-01-28 | OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchro… |
CVE-2026-23966 | Critical | 9.1 | 2026-01-22 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2… |
CVE-2026-1195 | Medium | 5.0 | 2026-01-20 | A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This man… |
CVE-2026-0939 | Medium | 5.3 | 2026-01-16 | The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all vers… |
CVE-2026-22703 | Medium | 5.5 | 2026-01-10 | Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully veri… |
CVE-2025-15385 | Critical | 9.8 | 2026-01-06 | Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.B… |
CVE-2025-15154 | Medium | 5.3 | 2025-12-28 | A security vulnerability has been detected in PbootCMS up to 3.2.12. The affected element is the function get_user_ip of the file core/function/handle.php of t… |
CVE-2025-66570 | Critical | 10.0 | 2025-12-05 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to i… |
CVE-2025-59700 | Low | 3.9 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-66225 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username su… |
CVE-2025-66255 | Critical | 9.8 | 2025-11-26 | Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1… |
CVE-2025-66016 | | 2025-11-25 | CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. P… | |
CVE-2025-12752 | Medium | 5.3 | 2025-11-22 | The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due… |
CVE-2025-34337 | | 2025-11-19 | eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses… | |
CVE-2025-12295 | Medium | 6.6 | 2025-10-27 | A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing… |
CVE-2025-12080 | | 2025-10-27 | On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto… | |
CVE-2025-12245 | Medium | 5.3 | 2025-10-27 | A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFr… |
CVE-2025-56438 | Medium | 6.8 | 2025-10-24 | An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers to escalate privil… |
CVE-2024-58267 | High | 8.0 | 2025-10-02 | A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The cu… |
CVE-2025-59951 | Critical | 9.1 | 2025-10-01 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1… |
CVE-2025-11195 | Low | 3.3 | 2025-09-30 | Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in th… |
CVE-2025-59934 | Critical | 9.4 | 2025-09-26 | Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a t… |
CVE-2025-59420 | High | 7.5 | 2025-09-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unkno… |
CVE-2025-59160 | | 2025-09-16 | Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor… | |
CVE-2025-0092 | Medium | 6.5 | 2025-08-26 | In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI. This could lead to remote (proxim… |
CVE-2025-9379 | High | 7.2 | 2025-08-24 | A vulnerability was determined in Belkin AX1800 1.1.00.016. Affected by this vulnerability is an unknown functionality of the component Firmware Update Handler… |
CVE-2025-8980 | Medium | 6.6 | 2025-08-14 | A vulnerability has been found in Tenda G1 16.01.7.8(3660). Affected by this issue is the function check_upload_file of the component Firmware Update Handler… |
CVE-2025-8979 | Medium | 6.6 | 2025-08-14 | A vulnerability was identified in Tenda AC15 15.13.07.13. Affected by this vulnerability is the function check_fw_type/split_fireware/check_fw of the component… |
CVE-2025-8978 | Medium | 6.6 | 2025-08-14 | A vulnerability was determined in D-Link DIR-619L 6.02CN02. Affected is the function FirmwareUpgrade of the component boa. The manipulation leads to insufficie… |
CVE-2025-54792 | Medium | 6.8 | 2025-08-01 | LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In version… |
CVE-2024-48916 | High | 8.1 | 2025-07-30 | Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by… |
CVE-2025-6504 | High | 8.4 | 2025-07-29 | In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-con… |
CVE-2025-8038 | Critical | 9.8 | 2025-07-22 | Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141… |
CVE-2025-51471 | Medium | 6.9 | 2025-07-22 | Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access contr… |
CVE-2025-30192 | High | 7.5 | 2025-07-21 | An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version… |
CVE-2025-7884 | Low | 3.3 | 2025-07-20 | A vulnerability classified as problematic was found in Eluktronics Control Center 5.23.51.41. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-53548 | High | 7.5 | 2025-07-09 | Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting i… |
CVE-2025-7096 | High | 8.1 | 2025-07-06 | A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_updat… |
CVE-2025-5833 | Medium | 6.8 | 2025-06-25 | Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attackers to b… |
CVE-2025-5832 | Medium | 6.8 | 2025-06-25 | Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attack… |
CVE-2025-6426 | High | 8.8 | 2025-06-24 | The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of… |
CVE-2025-52484 | | 2025-06-20 | RISC Zero is a general computing platform based on zk-STARKs and the RISC-V microarchitecture. Due to a missing constraint in the rv32im circuit, any 3-registe… | |
CVE-2025-49199 | High | 8.8 | 2025-06-12 | The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows… |
CVE-2025-48865 | Critical | 9.1 | 2025-05-30 | Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (ex… |
CVE-2025-5320 | Low | 3.7 | 2025-05-29 | A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Han… |
CVE-2025-27558 | Critical | 9.1 | 2025-05-21 | IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equi… |
CVE-2025-29842 | High | 7.5 | 2025-05-13 | Acceptance of extraneous untrusted data with trusted data in UrlMon allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-43865 | High | 8.2 | 2025-04-25 | React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the r… |
CVE-2025-27735 | Medium | 6.0 | 2025-04-08 | Insufficient verification of data authenticity in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security featur… |
CVE-2025-30144 | Medium | 6.5 | 2025-03-19 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519… |
CVE-2025-2346 | Medium | 5.6 | 2025-03-16 | A vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308 and classified as problematic. This vulnerability affects unknown code of th… |
CVE-2025-0149 | Medium | 6.5 | 2025-03-11 | Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access. |
CVE-2025-27616 | High | 8.5 | 2025-03-10 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webho… |
CVE-2025-1945 | Critical | 9.8 | 2025-03-10 | picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specifi… |
CVE-2025-1944 | Medium | 6.5 | 2025-03-10 | picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives… |
CVE-2025-27257 | Medium | 6.1 | 2025-03-10 | Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. T… |
CVE-2025-27680 | Critical | 9.1 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insufficient Verification… |
CVE-2025-24903 | High | 8.5 | 2025-02-13 | libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior… |
CVE-2024-39805 | High | 7.8 | 2025-02-12 | Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authenticated user to potentially enable escal… |
CVE-2025-24807 | High | 7.1 | 2025-02-11 | eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10… |
CVE-2025-25188 | | 2025-02-10 | Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5… | |
CVE-2025-1108 | High | 8.6 | 2025-02-07 | Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of ema… |
CVE-2025-23415 | Low | 3.1 | 2025-02-05 | An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass end… |
CVE-2025-0510 | Medium | 6.5 | 2025-02-04 | Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vu… |
CVE-2024-10237 | High | 7.2 | 2025-02-04 | There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC i… |
CVE-2025-24882 | Medium | 5.2 | 2025-01-29 | regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnera… |
CVE-2024-55929 | Medium | 5.3 | 2025-01-23 | A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sourc… |
CVE-2025-21606 | | 2025-01-17 | stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of… | |
CVE-2024-54111 | Medium | 5.7 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-12369 | Medium | 4.2 | 2024-12-09 | A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authori… |
CVE-2024-52548 | Medium | 6.7 | 2024-12-03 | An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This v… |
CVE-2024-53259 | Medium | 6.5 | 2024-12-02 | quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used… |
CVE-2022-33861 | Medium | 5.1 | 2024-11-25 | IPP software versions prior to v1.71 do not sufficiently verify the authenticity of data, in a way that causes it to accept invalid data. |
CVE-2024-11666 | Critical | 9.0 | 2024-11-24 | Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure cha… |
CVE-2024-8356 | High | 7.8 | 2024-11-22 | Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability. This vulnerability allows local attack… |
CVE-2024-10977 | Low | 3.1 | 2024-11-14 | Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq… |
CVE-2024-43428 | High | 7.7 | 2024-11-07 | To address a cache poisoning risk in Moodle, additional validation for local storage was required. |
CVE-2024-7847 | High | 7.7 | 2024-10-14 | VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabi… |
CVE-2024-47867 | High | 7.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which… |
CVE-2024-47079 | Medium | 6.4 | 2024-10-07 | Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmwa… |
CVE-2024-47123 | Medium | 5.3 | 2024-09-26 | The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages mal… |