CWE-349 · Cryptography
Acceptance of Extraneous Untrusted Data With Trusted Data
48CVEs
SortMost likely exploited
48 CVEs with CWE-349 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-9535iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command executioniTerm2 · iTerm2 · 2019-10-09 | – | 2.5% | 2019-10-09 |
| CVE-2026-32162Windows COM Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8.4 · 2026-04-14 | 8.4 | 2.0% | 2026-04-14 |
| CVE-2018-1131Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could…Red Hat, Inc. · infinispan · 2018-05-15 | – | 1.2% | 2018-05-15 |
| CVE-2025-48804Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 6.8 · 2025-07-08 | 6.8 | 0.8% | 2025-07-08 |
| CVE-2025-40778Cache poisoning attacks with unsolicited RRsISC · BIND 9 · CVSS 8.6 · 2025-10-22 | 8.6 | 0.8% | 2025-10-22 |
| CVE-2024-21094Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected…Oracle Corporation · Java SE JDK and JRE · CVSS 3.7 · 2024-04-16 | 3.7 | 0.8% | 2024-04-16 |
| CVE-2025-29816Microsoft Word Security Feature Bypass VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 7.5 · 2025-04-08 | 7.5 | 0.5% | 2025-04-08 |
| CVE-2025-29842UrlMon Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.5 · 2025-05-13 | 7.5 | 0.4% | 2025-05-13 |
| CVE-2020-8023Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2SUSE · SUSE Enterprise Storage 5 · CVSS 7.7 · 2020-09-01 | 7.7 | 0.4% | 2020-09-01 |
| CVE-2024-25638DNSJava DNSSEC Bypassdnsjava · dnsjava · CVSS 8.9 · 2024-07-22 | 8.9 | 0.4% | 2024-07-22 |
| CVE-2025-27415Nuxt allows DOS via cache poisoning with payload rendering responsenuxt · nuxt · CVSS 7.5 · 2025-03-19 | 7.5 | 0.4% | 2025-03-19 |
| CVE-2026-41120Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remot…Dell · Wyse Management Suite · CVSS 9.8 · 2026-06-25 | 9.8 | 0.4% | 2026-06-25 |
| CVE-2026-1642NGINX vulnerabilityF5 · NGINX Open Source · CVSS 5.9 · 2026-02-04 | 5.9 | 0.4% | 2026-02-04 |
| CVE-2023-44317A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions <…Siemens · RUGGEDCOM RM1224 LTE(4G) EU · CVSS 7.2 · 2023-11-14 | 7.2 | 0.4% | 2023-11-14 |
| CVE-2026-45602Windows Dynamic Host Configuration Protocol (DHCP) Tampering VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 9.1 · 2026-06-09 | 9.1 | 0.4% | 2026-06-09 |
| CVE-2020-10751A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The…The Linux Foundation · kernel · CVSS 6.1 · 2020-05-26 | 6.1 | 0.3% | 2020-05-26 |
| CVE-2023-51655In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configurationJetBrains · IntelliJ IDEA · CVSS 6.3 · 2023-12-21 | 6.3 | 0.3% | 2023-12-21 |
| CVE-2025-11411Possible domain hijacking via promiscuous records in the authority sectionNLnet Labs · Unbound · CVSS 5.7 · 2025-10-22 | 5.7 | 0.3% | 2025-10-22 |
| CVE-2023-5548Moodle: cache poisoning risk with endpoint revision numbersMoodle · Moodle · CVSS 3.3 · 2023-11-09 | 3.3 | 0.3% | 2023-11-09 |
| CVE-2024-42483ESP-NOW Replay Attacks Vulnerabilityespressif · esp-now · CVSS 6.5 · 2024-09-12 | 6.5 | 0.3% | 2024-09-12 |
| CVE-2026-44572Next.js: Middleware / Proxy redirects can be cache-poisonedvercel · next.js · CVSS 3.7 · 2026-05-13 | 3.7 | 0.3% | 2026-05-13 |
| CVE-2024-41924Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative…EC-CUBE CO.,LTD. · EC-CUBE 4 series · CVSS 7.2 · 2024-07-30 | 7.2 | 0.3% | 2024-07-30 |
| CVE-2026-42960Possible cache poisoning via promiscuous records for the authority sectionNLnet Labs · Unbound · CVSS 5.7 · 2026-05-20 | 5.7 | 0.3% | 2026-05-20 |
| CVE-2026-112256Logon bypass (trust of attacker-controlled completed-methods list)OpenText · Advanced Authentication Server · CVSS 9.2 · 2026-10-29 | 9.2 | 0.2% | 2026-10-29 |
| CVE-2026-19033Unauthenticated IXFR deltas are applied to the live zone before TSIG verificationISC · BIND 9 · CVSS 6.5 · 2026-09-16 | 6.5 | 0.2% | 2026-09-16 |
| CVE-2025-11703WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoningwpgmaps · WP Go Maps (formerly WP Google Maps) · CVSS 5.3 · 2025-10-18 | 5.3 | 0.2% | 2025-10-18 |
| CVE-2024-34083STARTTLS unencrypted commands injectionaio-libs · aiosmtpd · CVSS 5.4 · 2024-05-18 | 5.4 | 0.2% | 2024-05-18 |
| CVE-2025-40776Birthday Attack against Resolvers supporting ECSISC · BIND 9 · CVSS 8.6 · 2025-07-16 | 8.6 | 0.2% | 2025-07-16 |
| CVE-2025-5994Cache poisoning via the ECS-enabled Rebirthday AttackNLnet Labs · Unbound · CVSS 8.7 · 2025-07-16 | 8.7 | 0.2% | 2025-07-16 |
| CVE-2026-15387Acceptance of Extraneous Untrusted Data With Trusted Data in GitLabGitLab · GitLab · CVSS 4.3 · 2026-08-26 | 4.3 | 0.2% | 2026-08-26 |
| CVE-2026-78301Out-of-zone database nodes can become authoritative zone cutsISC · BIND 9 · CVSS 5.8 · 2026-09-16 | 5.8 | 0.2% | 2026-09-16 |
| CVE-2025-20255A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manipulate cached HTTP responses within the meeting join service…Cisco · Cisco Webex Meetings · CVSS 4.3 · 2025-05-21 | 4.3 | 0.2% | 2025-05-21 |
| CVE-2025-1680An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges t…Moxa · TN-4500A Series · CVSS 0 · 2025-10-23 | 0.0 | 0.2% | 2025-10-23 |
| CVE-2026-102527Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesnuxt-modules · og-image · CVSS 6.9 · 2026-10-15 | 6.9 | 0.2% | 2026-10-15 |
| CVE-2025-46339FreshRSS vulnerable to favicon cache poisoning via proxyFreshRSS · FreshRSS · CVSS 4.3 · 2025-06-04 | 4.3 | 0.2% | 2025-06-04 |
| CVE-2026-54625django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)django-cms · django-cms · CVSS 4.8 · 2026-08-20 | 4.8 | 0.2% | 2026-08-20 |
| CVE-2026-48100Payy: agg_agg trailing message slots are unconstrained and allow forged burn messagespolybase · payy · CVSS 8.7 · 2026-09-28 | 8.7 | 0.2% | 2026-09-28 |
| CVE-2026-50252Possible cache poisoning attack by mapping source port population per threadNLnet Labs · Unbound · CVSS 5.7 · 2026-07-22 | 5.7 | 0.2% | 2026-07-22 |
| CVE-2026-59263Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.Apache Software Foundation · Apache OpenOffice · CVSS 1.9 · 2026-11-04 | 1.9 | 0.2% | 2026-11-04 |
| CVE-2026-74916WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersWP Fastest Cache · CVSS 6.5 · 2026-09-01 | 6.5 | 0.2% | 2026-09-01 |
| CVE-2026-33612ZoneToCache can poison the cachePowerDNS · Recursor · CVSS 7.5 · 2026-06-25 | 7.5 | 0.1% | 2026-06-25 |
| CVE-2024-53848check-jsonschema default caching for remote schemas allows for cache confusionpython-jsonschema · check-jsonschema · CVSS 7.1 · 2024-11-29 | 7.1 | 0.1% | 2024-11-29 |
| CVE-2026-35641OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook InstallationOpenClaw · OpenClaw · CVSS 7.8 · 2026-04-10 | 7.8 | 0.1% | 2026-04-10 |
| CVE-2023-3749VideoEdge configSensormatic Electronics, a subsidiary of Johnson Controls,… · VideoEdge · CVSS 7.1 · 2023-08-03 | 7.1 | 0.1% | 2023-08-03 |
| CVE-2026-123583Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responseshickory-dns · hickory-dns · CVSS 3.7 · 2026-11-08 | 3.7 | 0.1% | 2026-11-08 |
| CVE-2024-52555In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer scriptJetBrains · WebStorm · CVSS 6.3 · 2024-11-15 | 6.3 | 0.1% | 2024-11-15 |
| CVE-2025-68269In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSHJetBrains · IntelliJ IDEA · CVSS 5.4 · 2025-12-16 | 5.4 | 0.1% | 2025-12-16 |
| CVE-2026-100755Acceptance of Extraneous Untrusted Data With Trusted Data in GitLabGitLab · GitLab · CVSS 4.6 · 2026-10-13 | 4.6 | 0.1% | 2026-10-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.