The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Volume of CVEs assigned to CWE-349 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
39 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-41120CRITICAL Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote | Jun 25, 2026 | 9.8 | 43 | NO | NO |
CVE-2026-42960CRITICAL NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies i | May 20, 2026 | 10.0 | 41 | NO | NO |
CVE-2026-50252CRITICAL In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When | Jul 22, 2026 | 9.3 | 38 | NO | NO |
CVE-2026-45602CRITICAL No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network. | Jun 9, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-33612HIGH A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning. | Jun 25, 2026 | 7.5 | 35 | NO | NO |
CVE-2025-40778HIGH Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.
This issue affects BIND 9 versions | Oct 22, 2025 | 8.6 | 33 | NO | NO |
CVE-2019-9535CRITICAL A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the te | Oct 9, 2019 | 9.8 | 31 | NO | NO |
CVE-2026-32162HIGH Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally. | Apr 14, 2026 | 8.4 | 29 | NO | NO |
CVE-2026-35641HIGH OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .np | Apr 10, 2026 | 7.8 | 27 | NO | NO |
CVE-2025-40776HIGH A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.
This issue affects BIND 9 versions 9.11.3-S1 t | Jul 16, 2025 | 8.6 | 27 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.