CWE-940 · Improper Verification of Source of a Communication Channel

58 CVEs classified under CWE-940 (Improper Verification of Source of a Communication Channel). Browse by severity and year.

Top CVEs for CWE-940
CVESeverityScorePublishedSummary
CVE-2023-41094Critical10.02023-10-04TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifet…
CVE-2025-61932Critical9.82025-10-20Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacke…
CVE-2024-38886Critical9.82024-08-02An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic…
CVE-2024-40515Critical9.82024-07-16An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute arbitrary code via the Routing functionality.
CVE-2023-41355Critical9.82023-11-03Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can ex…
CVE-2026-85085Critical9.62026-09-04The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user i…
CVE-2026-2611Critical9.62026-05-19In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote atta…
CVE-2025-59159Critical9.62025-10-06SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-…
CVE-2026-48745Critical9.32026-06-17Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and belo…
CVE-2026-33875Critical9.32026-03-27Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hij…
CVE-2026-78685High8.82026-08-25Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS com…
CVE-2026-35643High8.82026-04-10OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted page…
CVE-2024-40516High8.82024-07-16An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality.
CVE-2023-48387High8.82023-12-15TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario wh…
CVE-2023-3663High8.82023-08-03In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipula…
CVE-2025-23222High8.42025-01-24An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs…
CVE-2024-26131High8.42024-02-29Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious…
CVE-2026-44698High8.32026-05-29Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home A…
CVE-2026-40434High8.12026-04-17Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or…
CVE-2024-49579High8.12024-10-17In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests
All CVEs classified under CWE-940 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-85085Critical9.62026-09-04The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user i…
CVE-2026-78685High8.82026-08-25Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS com…
CVE-2026-73419Medium6.82026-08-12NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF che…
CVE-2026-556602026-07-01Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-…
CVE-2026-54106Medium4.72026-06-18The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing S…
CVE-2026-6734High7.52026-06-17Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the reque…
CVE-2026-48745Critical9.32026-06-17Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and belo…
CVE-2026-44894High7.52026-06-12Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does…
CVE-2026-44698High8.32026-05-29Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home A…
CVE-2026-45353High7.82026-05-28electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.
CVE-2026-2611Critical9.62026-05-19In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote atta…
CVE-2026-45245High7.42026-05-18Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacke…
CVE-2026-43880Medium5.32026-05-11WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contac…
CVE-2026-23866Medium4.32026-05-01Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26…
CVE-2026-40434High8.12026-04-17Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or…
CVE-2026-35643High8.82026-04-10OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted page…
CVE-2026-33875Critical9.32026-03-27Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hij…
CVE-2019-25613High7.52026-03-22Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the application by sending oversized data in the message…
CVE-2026-2967Low3.72026-02-23A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TC…
CVE-2026-22269Medium4.72026-02-19Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST A…
CVE-2025-62439Medium4.22026-02-10An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 thro…
CVE-2025-40820High7.52025-12-09Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unau…
CVE-2025-13086High7.52025-12-03Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a d…
CVE-2024-32388Medium5.32025-12-01Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets. This allows an attacker to by…
CVE-2025-61932Critical9.82025-10-20Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacke…
CVE-2025-43280Medium4.72025-10-15The issue was resolved by not loading remote images. This issue is fixed in iOS 18.6 and iPadOS 18.6. Forwarding an email could display remote images in Mail i…
CVE-2025-59159Critical9.62025-10-06SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-…
CVE-2025-20365Medium4.32025-09-24A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to mod…
CVE-2025-99992025-09-05Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an atta…
CVE-2025-42978Low3.52025-07-08The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used…
CVE-2025-0036Low3.22025-06-10In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrect…
CVE-2025-25305High7.02025-02-18Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle…
CVE-2025-23222High8.42025-01-24An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs…
CVE-2024-7322Medium5.82025-01-15A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes D…
CVE-2025-23019Medium5.42025-01-14IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface.
CVE-2025-23018Medium5.42025-01-14IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spo…
CVE-2024-36506Low3.72025-01-14An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, 6.4 all v…
CVE-2024-49579High8.12024-10-17In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests
CVE-2024-20390Medium5.32024-09-11A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS)…
CVE-2024-1621High7.52024-09-02The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on t…
CVE-2024-38886Critical9.82024-08-02An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic…
CVE-2024-40515Critical9.82024-07-16An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute arbitrary code via the Routing functionality.
CVE-2024-40516High8.82024-07-16An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality.
CVE-2024-40503Medium6.52024-07-16An issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet handling.
CVE-2024-37664Medium5.22024-06-17Redmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic betwee…
CVE-2024-37663Medium4.12024-06-17Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the…
CVE-2024-37662Medium6.32024-06-17TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic betwe…
CVE-2023-7004Medium6.52024-03-15The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device…
CVE-2024-26131High8.42024-02-29Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious…
CVE-2024-0009Medium6.32024-02-14An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credenti…
CVE-2023-51440High7.52024-02-13A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All versions), SIPLUS…
CVE-2023-48387High8.82023-12-15TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario wh…
CVE-2023-41355Critical9.82023-11-03Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can ex…
CVE-2023-41094Critical10.02023-10-04TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifet…
CVE-2023-3663High8.82023-08-03In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipula…
CVE-2022-4848Medium5.72022-12-29Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-4800Medium6.52022-12-28Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVE-2021-41038Medium6.12021-11-10In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().