Skip to content
BackEsc
Sign in

CWE-940 · weakness in Access Control

Improper Verification of Source of a Communication Channel

66 CVEs · 1 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1

Every one of the 66 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitra…CVE-2025-61932MOTEX Inc. · CVSS 9.3 · 2.8% likely

    MOTEX Inc.

  2. TAIWAN-CA(TWCA) JCICSecurityTool - Improper Input ValidationCVE-2023-48387TAIWAN-CA(TWCA) · CVSS 8.8 · 1.0% likely
  3. IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spoof and route arbitra…CVE-2025-23018IETF · CVSS 5.4 · 1.0% likely

    IETF

  4. CODESYS: Missing integrity check in CODESYS Development SystemCVE-2023-3663CODESYS · CVSS 8.8 · 1.0% likely

    CODESYS

  5. IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface.CVE-2025-23019IETF · CVSS 5.4 · 1.0% likely

    IETF

  6. Chunghwa Telecom NOKIA G-040W-Q - Improper Input ValidationCVE-2023-41355Chunghwa Telecom · CVSS 9.8 · 0.8% likely

    Chunghwa Telecom

  7. Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()CVE-2026-112408AWS · CVSS 8.1 · 0.7% likely

    AWS

  8. In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().CVE-2021-41038The Eclipse Foundation · 0.7% likely

    Eclipse Foundation

  9. Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNetCVE-2023-41094Silicon Labs · CVSS 10 · 0.7% likely

    Silicon Labs

  10. Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address…CVE-2025-13086OpenVPN · CVSS 4.6 · 0.7% likely

    OpenVPN

  11. An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute arbitrary code via the Routing functionality.CVE-2024-40515Tenda · CVSS 9.8 · 0.7% likely

    Tenda

  12. An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic Injection attack du…CVE-2024-38886Horizoncloud · CVSS 9.8 · 0.6% likely
  13. Le-yan｜Medical Practice Management System - Remote Code ExecutionCVE-2026-78685Le-yan · CVSS 8.8 · 0.6% likely

    Le-yan

  14. Improper Verification of Source of a Communication Channel in usememos/memosCVE-2022-4800usememos · CVSS 8.6 · 0.6% likely

    Usememos

  15. A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All versions), SIPLUS NET CP 343-1 (6AG134…CVE-2023-51440Siemens · CVSS 7.5 · 0.6% likely

    Siemens

  16. Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of sourceCVE-2026-2967Cesanta · CVSS 3.7 · 0.6% likely

    Cesanta

  17. Improper Verification of Source of a Communication Channel in usememos/memosCVE-2022-4848usememos · CVSS 8.6 · 0.6% likely

    Usememos

  18. Easy Chat Server 3.1 Denial of Service via message ParameterCVE-2019-25613Echatserver · CVSS 7.5 · 0.5% likely
  19. An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, 6.4 all versions may allow a…CVE-2024-36506Fortinet · CVSS 3.5 · 0.5% likely

    Fortinet

  20. Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote a…CVE-2025-40820Siemens · CVSS 7.5 · 0.5% likely

    Siemens

  21. U.S. GAO EPDS and CBCA EDS network access control bypassCVE-2026-54106Government Accountability Office · CVSS 4.7 · 0.5% likely
  22. Element Android Intent RedirectionCVE-2024-26131element-hq · CVSS 8.4 · 0.5% likely

    Element-Hq

  23. Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have all…CVE-2026-23866Facebook · CVSS 4.3 · 0.5% likelycovered by CyberSIXT

    Meta (Facebook)

  24. Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information. User interaction is…CVE-2025-58488Samsung Mobile · CVSS 4.5 · 0.5% likely

    Samsung

  25. In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requestsCVE-2024-49579JetBrains · CVSS 8.1 · 0.4% likely

    JetBrains

  26. Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service VulnerabilityCVE-2024-20390Cisco · CVSS 5.3 · 0.4% likely

    Cisco

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in