CWE-348 · Cryptography
Use of Less Trusted Source
100CVEs
SortMost likely exploited
100 CVEs with CWE-348 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-59951Termix' official Docker image contains an authentication bypass vulnerabilityLukeGus · Termix · CVSS 9.2 · 2025-10-01 | 9.2 | 4.9% | 2025-10-01 |
| CVE-2022-31813mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache Software Foundation · Apache HTTP Server · 2022-06-08 | – | 3.5% | 2022-06-08 |
| CVE-2024-45410HTTP client can remove the X-Forwarded headers in Traefiktraefik · traefik · CVSS 9.8 · 2024-09-19 | 9.8 | 1.5% | 2024-09-19 |
| CVE-2021-21373Nimble falls back to insecure http url when fetching packagesnim-lang · security · CVSS 7.5 · 2021-03-26 | 7.5 | 1.2% | 2021-03-26 |
| CVE-2021-21374Nimble fails to validate certificates due to insecure httpClient defaultsnim-lang · security · CVSS 8.1 · 2021-03-26 | 8.1 | 1.0% | 2021-03-26 |
| CVE-2022-2255A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the tar…Modwsgi · mod_wsgi · 2022-08-25 | – | 1.0% | 2022-08-25 |
| CVE-2022-4539Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypasscyberlord92 · Web Application Firewall – website security · CVSS 5.3 · 2024-08-31 | 5.3 | 0.6% | 2024-08-31 |
| CVE-2026-44046Apache APISIX: wolf-rbac plugin Identity SpoofingApache Software Foundation · Apache APISIX · CVSS 2.3 · 2026-06-19 | 2.3 | 0.5% | 2026-06-19 |
| CVE-2025-48865Fabio allows HTTP clients to manipulate custom headers it addsfabiolb · fabio · CVSS 9.1 · 2025-05-30 | 9.1 | 0.5% | 2025-05-30 |
| CVE-2024-23105A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass…Fortinet · FortiPortal · CVSS 7.1 · 2024-05-14 | 7.1 | 0.4% | 2024-05-14 |
| CVE-2024-10977PostgreSQL libpq retains an error message from man-in-the-middlePostgresql · PostgreSQL · CVSS 3.1 · 2024-11-14 | 3.1 | 0.4% | 2024-11-14 |
| CVE-2026-58122Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofingnesquena · hermes-webui · CVSS 9.1 · 2026-07-09 | 9.1 | 0.4% | 2026-07-09 |
| CVE-2026-126083Action Pack: Possible IP spoofing in Action Dispatch RemoteIprails · rails · CVSS 7.4 · 2026-11-10 | 7.4 | 0.4% | 2026-11-10 |
| CVE-2024-27773Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted SourceUnitronics · Unistream Unilogic · CVSS 8.8 · 2024-03-18 | 8.8 | 0.4% | 2024-03-18 |
| CVE-2022-4534Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypasswp-buy · Limit Login Attempts (Spam Protection) · CVSS 5.3 · 2024-10-08 | 5.3 | 0.3% | 2024-10-08 |
| CVE-2026-100653vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagationvllm-project · vllm · CVSS 6.5 · 2026-09-26 | 6.5 | 0.3% | 2026-09-26 |
| CVE-2022-4537Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypassjohndarrel · WP Ghost (Hide My WP Ghost) – Security & Firewall · CVSS 6.5 · 2023-05-09 | 6.5 | 0.3% | 2023-05-09 |
| CVE-2026-64619FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headersvastsa · FileCodeBox · CVSS 7.5 · 2026-07-20 | 7.5 | 0.3% | 2026-07-20 |
| CVE-2026-63770Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypassglanceapp · glance · CVSS 7.5 · 2026-07-20 | 7.5 | 0.3% | 2026-07-20 |
| CVE-2023-2897Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypassthemefusecom · Brizy – Page Builder · CVSS 3.7 · 2023-06-09 | 3.7 | 0.3% | 2023-06-09 |
| CVE-2026-9561Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclip…Eclipse Foundation · Eclipse Kura · CVSS 8.8 · 2026-07-14 | 8.8 | 0.3% | 2026-07-14 |
| CVE-2026-26927URL (HTTP Origin) call location spoofing in Szafir SDK WebKrajowa Izba Rozliczeniowa · Szafir SDK Web · CVSS 5.1 · 2026-04-02 | 5.1 | 0.3% | 2026-04-02 |
| CVE-2026-97404In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker w…OpenStack · Zaqar · CVSS 9.2 · 2026-09-24 | 9.2 | 0.3% | 2026-09-24 |
| CVE-2022-44593WordPress Solid Security plugin <= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerabilitySolidWP · Solid Security · CVSS 3.7 · 2024-06-21 | 3.7 | 0.3% | 2024-06-21 |
| CVE-2024-0789WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypassflorent73 · WP Maintenance · CVSS 5.3 · 2024-06-19 | 5.3 | 0.3% | 2024-06-19 |
| CVE-2025-15154PbootCMS Header handle.php get_user_ip less trusted sourcePbootcms · PbootCMS · CVSS 5.3 · 2025-12-28 | 5.3 | 0.3% | 2025-12-28 |
| CVE-2024-6171Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypassunitecms · Unlimited Elements For Elementor · CVSS 5.3 · 2024-07-09 | 5.3 | 0.2% | 2024-07-09 |
| CVE-2022-4536IP Vault – WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypassyoutag · Two-factor authentication (formerly IP Vault) · CVSS 5.3 · 2024-08-31 | 5.3 | 0.2% | 2024-08-31 |
| CVE-2026-43634HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Headerhestiacp · hestiacp · CVSS 7.5 · 2026-05-19 | 7.5 | 0.2% | 2026-05-19 |
| CVE-2026-93483In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP reques…Znuny · Znuny · CVSS 9.5 · 2026-10-15 | 9.5 | 0.2% | 2026-10-15 |
| CVE-2026-57942LibreTranslate - IP Spoofing via X-Forwarded-For HeaderLibreTranslate · LibreTranslate · CVSS 5.3 · 2026-06-29 | 5.3 | 0.2% | 2026-06-29 |
| CVE-2026-46415Caddy Defender trusted proxy client IP bypassJasonLovesDoggo · caddy-defender · CVSS 8.2 · 2026-07-20 | 8.2 | 0.2% | 2026-07-20 |
| CVE-2026-123339Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Requestsensiolabs · symfony · CVSS 2.3 · 2026-11-06 | 2.3 | 0.2% | 2026-11-06 |
| CVE-2026-48772ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACLsysown · proxysql · CVSS 10 · 2026-06-19 | 10.0 | 0.2% | 2026-06-19 |
| CVE-2025-13694AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Headeraaextensions · AA Block country · CVSS 5.3 · 2026-01-07 | 5.3 | 0.2% | 2026-01-07 |
| CVE-2022-4529Security, Antivirus, Firewall – S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypassmsoftplugins · Security, Antivirus, Firewall – S.A.F · CVSS 5.3 · 2024-09-05 | 5.3 | 0.2% | 2024-09-05 |
| CVE-2026-25552Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For HeaderTryGhost · Ghost-CLI · CVSS 3.7 · 2026-07-31 | 3.7 | 0.2% | 2026-07-31 |
| CVE-2026-86041ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` headermayswind · ezbookkeeping · CVSS 5.3 · 2026-11-04 | 5.3 | 0.2% | 2026-11-04 |
| CVE-2026-119711PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Headerpipeshub-ai · pipeshub-ai · CVSS 5.3 · 2026-10-30 | 5.3 | 0.2% | 2026-10-30 |
| CVE-2026-77463Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deploymentumputun · remark42 · CVSS 6.5 · 2026-11-05 | 6.5 | 0.2% | 2026-11-05 |
| CVE-2022-4533Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypassdevfelixmoira · Limit Login Attempts Plus – WordPress Limit Login Attempts By Felix · CVSS 5.3 · 2024-09-19 | 5.3 | 0.2% | 2024-09-19 |
| CVE-2026-16272Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS ModulePayTR Payment and Electronic Money Institution Inc. · PayTR Virtual Pos iFrame API WHMCS Module · CVSS 9.1 · 2026-09-09 | 9.1 | 0.2% | 2026-09-09 |
| CVE-2022-4532LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypasskrut1 · LOGIN AND REGISTRATION ATTEMPTS LIMIT · CVSS 6.5 · 2024-08-17 | 6.5 | 0.2% | 2024-08-17 |
| CVE-2026-108736Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofingalexjustesen · speedtest-tracker · CVSS 3.7 · 2026-10-11 | 3.7 | 0.2% | 2026-10-11 |
| CVE-2026-110726In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded…Eclipse Foundation · Eclipse Connected Services Platform · CVSS 6.5 · 2026-10-15 | 6.5 | 0.2% | 2026-10-15 |
| CVE-2026-101277Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted sourceTrusted Domain Project · OpenDKIM · CVSS 6.5 · 2026-09-28 | 6.5 | 0.2% | 2026-09-28 |
| CVE-2025-27913Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name…Passbolt · API · CVSS 7.5 · 2025-03-10 | 7.5 | 0.2% | 2025-03-10 |
| CVE-2020-37248OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and…OfflineIMAP · OfflineIMAP · CVSS 6.5 · 2026-06-08 | 6.5 | 0.2% | 2026-06-08 |
| CVE-2025-53522Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.Six Apart Ltd. · Movable Type (Software Edition) · CVSS 6.9 · 2025-08-20 | 6.9 | 0.2% | 2025-08-20 |
| CVE-2026-126934Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-Fordiced · zipline · CVSS 6.5 · 2026-11-11 | 6.5 | 0.2% | 2026-11-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.