The product does not properly verify that the source of data or communication is valid.
Volume of CVEs assigned to CWE-346 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
627 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-34291HIGH Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_ | Dec 5, 2025 | 8.8 | 97 | YES | YES |
CVE-2015-4495HIGH The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitr | Aug 8, 2015 | 8.8 | 96 | YES | YES |
CVE-2009-1185HIGH udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space. | Apr 17, 2009 | 7.2 | 84 | NO | YES |
CVE-2020-16952HIGH <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully e | Oct 16, 2020 | 8.6 | 80 | NO | YES |
CVE-2024-23898HIGH Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, r | Jan 24, 2024 | 8.8 | 66 | NO | NO |
CVE-2023-29711CRITICAL An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. | Jun 22, 2023 | 9.8 | 62 | NO | NO |
CVE-2026-54069CRITICAL SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting Rol | Jun 24, 2026 | 9.2 | 49 | NO | YES |
CVE-2026-47691CRITICAL Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficient | Jun 12, 2026 | 10.0 | 42 | NO | NO |
CVE-2026-45674CRITICAL Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to valid | Jun 12, 2026 | 10.0 | 42 | NO | NO |
CVE-2026-42901CRITICAL Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. | May 22, 2026 | 10.0 | 42 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.