CWE-940 · Access Control
Improper Verification of Source of a Communication Channel
66CVEs
SortMost likely exploited
66 CVEs with CWE-940 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-61932In CISA KEVExploitedLanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitra…MOTEX Inc. · Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agen… · CVSS 9.3 · 2025-10-20 | 9.3 | 2.8% | 2025-10-20 |
| CVE-2023-48387TAIWAN-CA(TWCA) JCICSecurityTool - Improper Input ValidationTAIWAN-CA(TWCA) · JCICSecurityTool · CVSS 8.8 · 2023-12-15 | 8.8 | 1.0% | 2023-12-15 |
| CVE-2025-23018IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spoof and route arbitra…IETF · IPv6 · CVSS 5.4 · 2025-01-14 | 5.4 | 1.0% | 2025-01-14 |
| CVE-2023-3663CODESYS: Missing integrity check in CODESYS Development SystemCODESYS · CODESYS Development System · CVSS 8.8 · 2023-08-03 | 8.8 | 1.0% | 2023-08-03 |
| CVE-2025-23019IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface.IETF · IPv6 · CVSS 5.4 · 2025-01-14 | 5.4 | 1.0% | 2025-01-14 |
| CVE-2023-41355Chunghwa Telecom NOKIA G-040W-Q - Improper Input ValidationChunghwa Telecom · NOKIA G-040W-Q · CVSS 9.8 · 2023-11-03 | 9.8 | 0.8% | 2023-11-03 |
| CVE-2026-112408Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()AWS · Amazon SageMaker Python SDK · CVSS 8.1 · 2026-10-21 | 8.1 | 0.7% | 2026-10-21 |
| CVE-2021-41038In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().The Eclipse Foundation · @theia/plugin-ext · 2021-11-10 | – | 0.7% | 2021-11-10 |
| CVE-2023-41094Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNetSilicon Labs · Ember ZNet · CVSS 10 · 2023-10-04 | 10.0 | 0.7% | 2023-10-04 |
| CVE-2025-13086Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address…OpenVPN · OpenVPN · CVSS 4.6 · 2025-12-03 | 4.6 | 0.7% | 2025-12-03 |
| CVE-2024-40515An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute arbitrary code via the Routing functionality.Tenda · Ax2 Pro Firmware · CVSS 9.8 · 2024-07-16 | 9.8 | 0.7% | 2024-07-16 |
| CVE-2024-38886An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic Injection attack du…Horizoncloud · Caterease · CVSS 9.8 · 2024-08-02 | 9.8 | 0.6% | 2024-08-02 |
| CVE-2026-78685Le-yan｜Medical Practice Management System - Remote Code ExecutionLe-yan · Medical Practice Management System · CVSS 8.8 · 2026-08-25 | 8.8 | 0.6% | 2026-08-25 |
| CVE-2022-4800Improper Verification of Source of a Communication Channel in usememos/memosusememos · usememos/memos · CVSS 8.6 · 2022-12-28 | 8.6 | 0.6% | 2022-12-28 |
| CVE-2023-51440A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All versions), SIPLUS NET CP 343-1 (6AG134…Siemens · SIMATIC CP 343-1 · CVSS 7.5 · 2024-02-13 | 7.5 | 0.6% | 2024-02-13 |
| CVE-2026-2967Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of sourceCesanta · Mongoose · CVSS 3.7 · 2026-02-23 | 3.7 | 0.6% | 2026-02-23 |
| CVE-2022-4848Improper Verification of Source of a Communication Channel in usememos/memosusememos · usememos/memos · CVSS 8.6 · 2022-12-29 | 8.6 | 0.6% | 2022-12-29 |
| CVE-2019-25613Easy Chat Server 3.1 Denial of Service via message ParameterEchatserver · Easy Chat · CVSS 7.5 · 2026-03-22 | 7.5 | 0.5% | 2026-03-22 |
| CVE-2024-36506An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, 6.4 all versions may allow a…Fortinet · FortiClientEMS · CVSS 3.5 · 2025-01-14 | 3.5 | 0.5% | 2025-01-14 |
| CVE-2025-40820Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote a…Siemens · SIDOOR ATD430W · CVSS 7.5 · 2025-12-09 | 7.5 | 0.5% | 2025-12-09 |
| CVE-2026-54106U.S. GAO EPDS and CBCA EDS network access control bypassGovernment Accountability Office · Electronic Protest Docketing System (EPDS) · CVSS 4.7 · 2026-06-18 | 4.7 | 0.5% | 2026-06-18 |
| CVE-2024-26131Element Android Intent Redirectionelement-hq · element-android · CVSS 8.4 · 2024-02-20 | 8.4 | 0.5% | 2024-02-20 |
| CVE-2026-23866Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have all…Facebook · WhatsApp for Android · CVSS 4.3 · 2026-05-01 | 4.3 | 0.5% | 2026-05-01 |
| CVE-2025-58488Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information. User interaction is…Samsung Mobile · SmartTouchCall · CVSS 4.5 · 2025-12-02 | 4.5 | 0.5% | 2025-12-02 |
| CVE-2024-49579In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requestsJetBrains · YouTrack · CVSS 8.1 · 2024-10-17 | 8.1 | 0.4% | 2024-10-17 |
| CVE-2024-20390Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service VulnerabilityCisco · Cisco IOS XR Software · CVSS 5.3 · 2024-09-11 | 5.3 | 0.4% | 2024-09-11 |
| CVE-2026-87705Windows Hyper-V Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.4 · 2026-10-13 | 7.4 | 0.4% | 2026-10-13 |
| CVE-2026-119568vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijackingvsftpd · vsftpd · CVSS 7.4 · 2026-10-30 | 7.4 | 0.4% | 2026-10-30 |
| CVE-2024-40503An issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet handling.Tenda · Ax12 Firmware · CVSS 6.5 · 2024-07-16 | 6.5 | 0.4% | 2024-07-16 |
| CVE-2026-85085The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicat…Canva · Canva · CVSS 9.6 · 2026-09-04 | 9.6 | 0.4% | 2026-09-04 |
| CVE-2024-37662TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic between the victim and an…Tp-Link · Tl-7dr5130 Firmware · CVSS 6.3 · 2024-06-17 | 6.3 | 0.4% | 2024-06-17 |
| CVE-2024-37664Redmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic between the victim and any…Mi · Redmi Ax6s Firmware · CVSS 5.2 · 2024-06-17 | 5.2 | 0.4% | 2024-06-17 |
| CVE-2026-35643OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterfaceOpenClaw · OpenClaw · CVSS 8.8 · 2026-04-10 | 8.8 | 0.4% | 2026-04-10 |
| CVE-2024-1621uniFLOW Online device registration susceptible to compromiseNT-ware · uniFLOW Online · CVSS 8.3 · 2024-09-02 | 8.3 | 0.4% | 2024-09-02 |
| CVE-2026-89178Howyar｜WeenyGenius - Origin Validation ErrorHowyar · WeenyGenius · CVSS 8.8 · 2026-09-11 | 8.8 | 0.4% | 2026-09-11 |
| CVE-2026-0325PAN-OS: GlobalProtect Authorization Bypass VulnerabilityPalo Alto Networks · Cloud NGFW · CVSS 1.3 · 2026-11-11 | 1.3 | 0.4% | 2026-11-11 |
| CVE-2024-7322Dos in ZigBee device due to unsolicited encrypted rejoin responsesilabs.com · EmberZNet · CVSS 5.8 · 2025-01-15 | 5.8 | 0.3% | 2025-01-15 |
| CVE-2026-85125The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information…YAMAP INC. · YAMAP -Social Trekking GPS App · CVSS 5.1 · 2026-09-14 | 5.1 | 0.3% | 2026-09-14 |
| CVE-2024-40516An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality.No vendor recorded · CVSS 8.8 · 2024-07-16 | 8.8 | 0.3% | 2024-07-16 |
| CVE-2025-61730Handshake messages may be processed at the incorrect encryption level in crypto/tlsGo standard library · crypto/tls · CVSS 5.3 · 2026-01-28 | 5.3 | 0.3% | 2026-01-28 |
| CVE-2026-48745Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetrytraccar · traccar-client · CVSS 9.3 · 2026-06-16 | 9.3 | 0.3% | 2026-06-16 |
| CVE-2026-43880WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From AddressWWBN · AVideo · CVSS 5.3 · 2026-05-11 | 5.3 | 0.3% | 2026-05-11 |
| CVE-2024-37663Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the victim and any remot…Mi · Redmi Ax6s Firmware · CVSS 4.1 · 2024-06-17 | 4.1 | 0.3% | 2024-06-17 |
| CVE-2026-33875Authenticator Vulnerable to Authentication Flow Hijackgematik · app-Authenticator · CVSS 9.3 · 2026-03-27 | 9.3 | 0.3% | 2026-03-27 |
| CVE-2026-102551Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handlingFreeRTOS · FreeRTOS-Plus-TCP · CVSS 7.7 · 2026-10-16 | 7.7 | 0.3% | 2026-10-16 |
| CVE-2026-89409Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End NodesSilicon Labs · Z-Wave SDK · CVSS 5.3 · 2026-10-22 | 5.3 | 0.3% | 2026-10-22 |
| CVE-2025-59159SillyTavern Web Interface Vulnerable to DNS RebindingSillyTavern · SillyTavern · CVSS 9.7 · 2025-10-06 | 9.7 | 0.3% | 2025-10-06 |
| CVE-2025-25305SSL validation for outgoing requests in Home Assistant Core and used libs not correcthome-assistant · core · CVSS 7 · 2025-02-18 | 7.0 | 0.3% | 2025-02-18 |
| CVE-2026-73419NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themnextauthjs · next-auth · CVSS 6.8 · 2026-08-12 | 6.8 | 0.2% | 2026-08-12 |
| CVE-2026-66279Dis-connect vulnerability in Connect StackSilicon Labs · Connect SDK · CVSS 7.2 · 2026-10-22 | 7.2 | 0.2% | 2026-10-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.