CWE-441 · Unintended Proxy or Intermediary (Confused Deputy)

123 CVEs classified under CWE-441 (Unintended Proxy or Intermediary (Confused Deputy)). Browse by severity and year.

Top CVEs for CWE-441
CVESeverityScorePublishedSummary
CVE-2026-83548Critical10.02026-09-01A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticat…
CVE-2026-42933Critical10.02026-07-23Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, whi…
CVE-2026-39906Critical10.02026-04-14Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attac…
CVE-2026-67567Critical9.92026-08-20A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resou…
CVE-2026-72526Critical9.92026-08-12A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Applic…
CVE-2025-62718Critical9.92026-04-09Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when check…
CVE-2026-23751Critical9.82026-04-23Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 24…
CVE-2025-64123Critical9.82026-01-02Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack…
CVE-2021-20042Critical9.82021-12-08An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affec…
CVE-2026-70398Critical9.62026-08-12A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, refer…
CVE-2026-53513Critical9.62026-07-15Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/upda…
CVE-2025-25306Critical9.32025-03-10Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url`…
CVE-2026-44945Critical9.12026-08-05A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the de…
CVE-2026-7381Critical9.12026-04-29Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation se…
CVE-2015-2947Critical9.12017-04-13KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic.
CVE-2026-36608High8.82026-06-03Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by acc…
CVE-2022-39361High8.82022-10-26Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow…
CVE-2026-16158High8.72026-07-18Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source pat…
CVE-2026-44494High8.72026-06-11Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget…
CVE-2025-11393High8.72025-12-15A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the clus…
All CVEs classified under CWE-441 — newest first (page 1 of 2)
CVESeverityScorePublishedSummary
CVE-2026-84329Medium5.32026-09-02Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process…
CVE-2026-83548Critical10.02026-09-01A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticat…
CVE-2026-77348High8.22026-08-31Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP…
CVE-2026-67567Critical9.92026-08-20A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resou…
CVE-2026-636432026-08-18MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an at…
CVE-2026-73424Medium6.52026-08-17Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypo…
CVE-2026-72640Medium6.52026-08-13The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorde…
CVE-2026-73266High7.12026-08-13A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating…
CVE-2026-72526Critical9.92026-08-12A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Applic…
CVE-2026-70398Critical9.62026-08-12A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, refer…
CVE-2026-73079High8.52026-08-11Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys i…
CVE-2026-16456Medium6.52026-08-10A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecre…
CVE-2026-44964Medium6.52026-08-07In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed ap…
CVE-2026-44945Critical9.12026-08-05A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the de…
CVE-2026-54663Medium6.12026-07-29swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchem…
CVE-2026-43910High8.22026-07-28Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnec…
CVE-2026-17107High8.52026-07-24A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE)…
CVE-2026-42933Critical10.02026-07-23Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, whi…
CVE-2026-13062Medium6.52026-07-22An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are int…
CVE-2026-47122Medium4.22026-07-21Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforc…
CVE-2026-16158High8.72026-07-18Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source pat…
CVE-2026-53514High7.72026-07-15Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside…
CVE-2026-53513Critical9.62026-07-15Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/upda…
CVE-2026-151832026-07-14Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth cl…
CVE-2026-56675High8.32026-07-109Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host r…
CVE-2026-128792026-07-09An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated…
CVE-2026-55430Medium5.82026-07-08Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app…
CVE-2026-49086Medium6.52026-07-06Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub cons…
CVE-2026-46592High7.52026-07-06Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selec…
CVE-2026-539312026-06-23NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP…
CVE-2026-50169Medium6.12026-06-22Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2…
CVE-2026-9595Medium5.32026-06-15Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and…
CVE-2026-44494High8.72026-06-11Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget…
CVE-2026-49821High7.72026-06-10Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version…
CVE-2026-36608High8.82026-06-03Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by acc…
CVE-2026-0098High7.82026-06-01In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escal…
CVE-2025-48570High7.82026-06-01In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to…
CVE-2026-48522Medium4.22026-05-28PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python…
CVE-2026-3160Medium5.82026-05-14GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a…
CVE-2026-45003Medium5.02026-05-11OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers wi…
CVE-2026-44992Medium5.02026-05-11OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Att…
CVE-2026-42313High8.32026-05-11pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) i…
CVE-2026-45182Low2.22026-05-09GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimizati…
CVE-2026-7381Critical9.12026-04-29Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation se…
CVE-2026-41365Medium5.42026-04-28OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread mess…
CVE-2026-6993Medium5.32026-04-25A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component…
CVE-2026-42043High7.22026-04-24Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request…
CVE-2026-23751Critical9.82026-04-23Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 24…
CVE-2026-39906Critical10.02026-04-14Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attac…
CVE-2026-39961Medium6.82026-04-09Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission…
CVE-2025-62718Critical9.92026-04-09Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when check…
CVE-2026-27124Medium6.12026-04-03FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authe…
CVE-2026-33768Medium6.52026-03-24Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to…
CVE-2026-0107High8.42026-03-10In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. This could lead to local escalation of pr…
CVE-2026-30225Medium5.32026-03-06OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in Resta…
CVE-2026-0021High8.42026-03-02In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to loca…
CVE-2026-0013High8.42026-03-02In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local esca…
CVE-2026-0008High8.42026-03-02In multiple locations, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional…
CVE-2025-48646High7.82026-03-02In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with…
CVE-2025-48579High8.42026-03-02In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local es…
CVE-2026-27624High7.22026-02-25Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip"…
CVE-2023-31313High7.22026-02-12An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages to the system mana…
CVE-2026-244712026-02-02continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an…
CVE-2026-24470High8.12026-01-26Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permiss…
CVE-2025-641252026-01-03A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (…
CVE-2025-64123Critical9.82026-01-02Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack…
CVE-2025-68944Medium5.02025-12-26Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
CVE-2025-686672025-12-23Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to f…
CVE-2025-11393High8.72025-12-15A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the clus…
CVE-2025-36889Medium5.52025-12-11In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with n…
CVE-2025-48628High7.82025-12-08In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalatio…
CVE-2025-48598Medium6.62025-12-08In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalatio…
CVE-2025-48586High7.82025-12-08In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to l…
CVE-2025-48555High7.82025-12-08In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local…
CVE-2025-48536High7.82025-12-08In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused…
CVE-2025-22420High7.82025-12-08In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privil…
CVE-2025-66415Medium5.42025-12-01fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could a…
CVE-2025-61780Medium5.82025-10-10Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sen…
CVE-2025-32320High7.82025-09-05In System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional…
CVE-2025-32317Medium5.52025-09-05In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional executio…
CVE-2025-48560Medium5.52025-09-04In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This could lead to local information disclosure w…
CVE-2025-48551Medium5.02025-09-04In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. This could lead to local infor…
CVE-2025-48545High7.12025-09-04In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a confused deputy. This could lead to local p…
CVE-2025-48532High7.32025-09-04In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a confused deputy. This could lead…
CVE-2025-48529Medium5.52025-09-04In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local infor…
CVE-2025-32346High7.82025-09-04In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This could lead to local…
CVE-2025-32326High7.82025-09-04In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. This could lead to lo…
CVE-2025-32324High7.82025-09-04In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation o…
CVE-2025-32321High7.82025-09-04In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local…
CVE-2025-26454High7.82025-09-04In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could…
CVE-2025-22441High7.32025-09-04In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to…
CVE-2025-26452High7.82025-09-04In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. This could lead to loc…
CVE-2025-22418High7.82025-09-02In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional executio…
CVE-2025-22416High7.82025-09-02In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of priv…
CVE-2025-48710Medium4.12025-06-04kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary co…
CVE-2025-47269High8.32025-05-09code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result…
CVE-2025-25061Medium5.82025-04-04Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated a…
CVE-2025-25306Critical9.32025-03-10Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url`…
CVE-2024-9870Medium4.32025-02-12An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 al…
CVE-2025-232172025-02-06mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmpro…