Skip to content
BackEsc
Sign in

CWE-345 · weakness in Cryptography

Insufficient Verification of Data Authenticity

729 CVEs · 1 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
check available
2
likely to be exploited
5

Every one of the 729 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execu…CVE-2022-26871Trend Micro · CVSS 9.8 · 19% likely

    Trend Micro

  2. Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/exportCVE-2019-172281.3% likely
  3. New API < v0.12.10 - Stripe Webhook BypassCVE-2026-41432QuantumNous · CVSS 7.1 · 0.9% likely

    QuantumNous

  4. client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-…CVE-2016-455380% likely
  5. mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host head…CVE-2016-455439% likely
  6. ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass VulnerabilityCVE-2023-35719ManageEngine · CVSS 6.8 · 25% likely

    Zoho (ManageEngine)

  7. The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle a…CVE-2014-493617% likely
  8. Filter bypass in filter_var (FILTER_VALIDATE_URL)CVE-2024-5458PHP Group · CVSS 5.3 · 12% likely

    PHP

  9. The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response vari…CVE-2017-7674Apache Software Foundation · 8.0% likely

    Apache

  10. The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protoco…CVE-2015-02517.9% likely
  11. Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium se…CVE-2023-5482Google · CVSS 8.8 · 7.3% likely

    Google

  12. IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof the…CVE-2020-11985Apache HTTP Server · 7.1% likely
  13. The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to s…CVE-2014-03646.2% likely
  14. Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 prot…CVE-2017-111035.1% likely
  15. Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution VulnerabilityCVE-2022-20829Cisco · CVSS 9.1 · 3.7% likely

    Cisco

  16. FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve be…CVE-2019-112353.6% likely
  17. MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet InjectionCVE-2026-85431themoos · CVSS 7.5 · 3.4% likely

    Themoos

  18. Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via…CVE-2020-289003.1% likely
  19. JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.CVE-2018-199713.0% likely
  20. An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE…CVE-2019-0805Microsoft · 2.8% likely

    Microsoft

  21. scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialize…CVE-2014-81652.8% likely
  22. Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other opti…CVE-2023-517642.6% likely
  23. The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is i…CVE-2021-43616CVSS 9 · 2.6% likely
  24. An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially…CVE-2019-5161Wago · 2.5% likely

    WAGO

  25. Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.CVE-2021-374212.5% likely
  26. Cisco Nexus 9000 Series Fabric Switches ACI Mode Multi-Pod and Multi-Site TCP Denial of Service VulnerabilityCVE-2021-1586Cisco · CVSS 8.6 · 2.5% likely

    Cisco

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in