CWE-441 · Unintended Proxy or Intermediary (Confused Deputy)
103 CVEs classified under CWE-441 (Unintended Proxy or Intermediary (Confused Deputy)). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39906 | Critical | 10.0 | 2026-04-14 | Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attac… |
CVE-2025-62718 | Critical | 9.9 | 2026-04-09 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when check… |
CVE-2026-23751 | Critical | 9.8 | 2026-04-23 | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 24… |
CVE-2025-64123 | Critical | 9.8 | 2026-01-02 | Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack… |
CVE-2021-20042 | Critical | 9.8 | 2021-12-08 | An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affec… |
CVE-2026-53513 | Critical | 9.6 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/upda… |
CVE-2025-25306 | Critical | 9.3 | 2025-03-10 | Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url`… |
CVE-2026-7381 | Critical | 9.1 | 2026-04-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation se… |
CVE-2015-2947 | Critical | 9.1 | 2017-04-13 | KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic. |
CVE-2026-36608 | High | 8.8 | 2026-06-03 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by acc… |
CVE-2022-39361 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow… |
CVE-2026-16158 | High | 8.7 | 2026-07-18 | Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source pat… |
CVE-2026-44494 | High | 8.7 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget… |
CVE-2025-11393 | High | 8.7 | 2025-12-15 | A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the clus… |
CVE-2024-30128 | High | 8.6 | 2024-09-25 | HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may… |
CVE-2021-32783 | High | 8.5 | 2021-07-23 | Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to acc… |
CVE-2026-0107 | High | 8.4 | 2026-03-10 | In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. This could lead to local escalation of pr… |
CVE-2026-0021 | High | 8.4 | 2026-03-02 | In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to loca… |
CVE-2026-0013 | High | 8.4 | 2026-03-02 | In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local esca… |
CVE-2026-0008 | High | 8.4 | 2026-03-02 | In multiple locations, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional… |