CWE-348 · 82 records
Use of Less Trusted Source
CVEs in this class
84 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2022-31813Proof of concept | mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismapache · http server · CWE-348 | Critical9.8 | — | 3.5% | Jun 9, 2022 |
40Plan | CVE-2026-48772No exploit | ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACLproxysql · proxysql · CWE-348 | Critical10.0 | — | 0.2% | Jun 19, 2026 |
38Monitor | CVE-2026-93483No exploit | In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functionsznuny · znuny · CWE-348 | Critical9.5 | — | 0.2% | 6 days ago |
37Monitor | CVE-2026-58122No exploit | Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofingnesquena · hermes-webui · CWE-348 | Critical9.3 | — | 0.3% | Jul 9, 2026 |
36Monitor | CVE-2026-97404No exploit | In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.openstack · zaqar · CWE-348 | Critical9.2 | — | 0.2% | Sep 24, 2026 |
36Monitor | CVE-2026-16272No exploit | Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Modulepaytr payment and electronic money institution inc. · paytr virtual pos iframe api (v9x) whmcs module · CWE-348 | Critical9.1 | — | 0.1% | Sep 9, 2026 |
36Monitor | CVE-2026-12249No exploit | Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollmentcanonical · ubuntu 20.04 lts · CWE-348 | Critical9.0 | — | 0.1% | Jun 22, 2026 |
35Monitor | CVE-2024-27773No exploit | Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Sourceunitronics · unilogic · CWE-348 | High8.8 | — | 0.3% | Mar 18, 2024 |
34Monitor | CVE-2026-43634No exploit | HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Headerhestiacp · hestiacp · CWE-348 | High8.7 | — | 0.3% | May 19, 2026 |
34Monitor | CVE-2026-64619No exploit | FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headersvastsa · filecodebox · CWE-348 | High8.7 | — | 0.2% | Jul 20, 2026 |
34Monitor | CVE-2026-35391No exploit | Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgerybulwarkmail · webmail · CWE-348 | High8.7 | — | 0.1% | Apr 6, 2026 |
33Monitor | CVE-2026-100653No exploit | vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagationvllm · vllm · CWE-348 | High8.3 | — | 0.2% | Sep 26, 2026 |
32Monitor | CVE-2021-21374No exploit | Nimble fails to validate certificates due to insecure httpClient defaultsnim-lang · nim · CWE-348 | High8.1 | — | 1.0% | Mar 26, 2021 |
32Monitor | CVE-2026-63770No exploit | Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypassglanceapp · glance · CWE-348 | High8.2 | — | 0.2% | Jul 20, 2026 |
32Monitor | CVE-2025-55292No exploit | In Meshtastic, an attacker can spoof licensed amateur flag for a nodemeshtastic · meshtastic firmware · CWE-348 | High8.2 | — | 0.1% | Jan 27, 2026 |
30Monitor | CVE-2022-2255No exploit | A vulnerability was found in mod_wsgi.modwsgi · mod wsgi · CWE-348 | High7.5 | — | 0.9% | Aug 25, 2022 |
30Monitor | CVE-2024-23105No exploit | A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allfortinet · fortiportal · CWE-348 | High7.5 | — | 0.4% | May 14, 2024 |
30Monitor | CVE-2026-107567No exploit | Use of Less Trusted Source in hMailServerprogressive robot ltd · hmailserver · CWE-348 | High7.5 | — | 0.1% | 2 days ago |
30Monitor | CVE-2026-59999No exploit | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.openbsd · openssh · CWE-348 | High7.5 | — | 0.1% | Jul 7, 2026 |
30Monitor | CVE-2025-69240No exploit | Header Poisoning in Raytha CMSraytha · raytha · CWE-348 | High7.5 | — | 0.1% | Mar 16, 2026 |
28Monitor | CVE-2025-47424No exploit | Retool (self-hosted) before 3.196.0 allows Host header injection.retool · retool · CWE-348 | High7.1 | — | 0.1% | May 9, 2025 |
27Monitor | CVE-2026-57942No exploit | LibreTranslate - IP Spoofing via X-Forwarded-For Headerlibretranslate · libretranslate · CWE-348 | Medium6.9 | — | 0.2% | Jun 29, 2026 |
27Monitor | CVE-2026-108162No exploit | Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-Forsmp46 · pingvin-share-x · CWE-348 | Medium6.9 | — | 0.1% | Oct 10, 2026 |
27Monitor | CVE-2026-103592No exploit | simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauCWE-348 | Medium6.9 | — | 0.1% | Sep 30, 2026 |
27Monitor | CVE-2025-53522No exploit | Movable Type contains an issue with use of less trusted source.six apart ltd. · movable type (software edition) · CWE-348 | Medium6.9 | — | 0.1% | Aug 20, 2025 |
- CVE-2022-3181340Plan
mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
CriticalCVSS 9.8Proof of conceptEPSS 3%apache · http serverJun 9, 2022
- CVE-2026-4877240Plan
ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL
CriticalCVSS 10.0No exploitEPSS 0%proxysql · proxysqlJun 19, 2026
- CVE-2026-9348338Monitor
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions
CriticalCVSS 9.5No exploitEPSS 0%znuny · znuny6 days ago
- CVE-2026-5812237Monitor
Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing
CriticalCVSS 9.3No exploitEPSS 0%nesquena · hermes-webuiJul 9, 2026
- CVE-2026-9740436Monitor
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.
CriticalCVSS 9.2No exploitEPSS 0%openstack · zaqarSep 24, 2026
- CVE-2026-1627236Monitor
Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module
CriticalCVSS 9.1No exploitEPSS 0%paytr payment and electronic money institution inc. · paytr virtual pos iframe api (v9x) whmcs moduleSep 9, 2026
- CVE-2026-1224936Monitor
Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment
CriticalCVSS 9.0No exploitEPSS 0%canonical · ubuntu 20.04 ltsJun 22, 2026
- CVE-2024-2777335Monitor
Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source
HighCVSS 8.8No exploitEPSS 0%unitronics · unilogicMar 18, 2024
- CVE-2026-4363434Monitor
HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header
HighCVSS 8.7No exploitEPSS 0%hestiacp · hestiacpMay 19, 2026
- CVE-2026-6461934Monitor
FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
HighCVSS 8.7No exploitEPSS 0%vastsa · filecodeboxJul 20, 2026
- CVE-2026-3539134Monitor
Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery
HighCVSS 8.7No exploitEPSS 0%bulwarkmail · webmailApr 6, 2026
- CVE-2026-10065333Monitor
vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation
HighCVSS 8.3No exploitEPSS 0%vllm · vllmSep 26, 2026
- CVE-2021-2137432Monitor
Nimble fails to validate certificates due to insecure httpClient defaults
HighCVSS 8.1No exploitEPSS 1%nim-lang · nimMar 26, 2021
- CVE-2026-6377032Monitor
Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
HighCVSS 8.2No exploitEPSS 0%glanceapp · glanceJul 20, 2026
- CVE-2025-5529232Monitor
In Meshtastic, an attacker can spoof licensed amateur flag for a node
HighCVSS 8.2No exploitEPSS 0%meshtastic · meshtastic firmwareJan 27, 2026
- CVE-2022-225530Monitor
A vulnerability was found in mod_wsgi.
HighCVSS 7.5No exploitEPSS 0%modwsgi · mod wsgiAug 25, 2022
- CVE-2024-2310530Monitor
A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 all
HighCVSS 7.5No exploitEPSS 0%fortinet · fortiportalMay 14, 2024
- CVE-2026-10756730Monitor
Use of Less Trusted Source in hMailServer
HighCVSS 7.5No exploitEPSS 0%progressive robot ltd · hmailserver2 days ago
- CVE-2026-5999930Monitor
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
HighCVSS 7.5No exploitEPSS 0%openbsd · opensshJul 7, 2026
- CVE-2025-6924030Monitor
Header Poisoning in Raytha CMS
HighCVSS 7.5No exploitEPSS 0%raytha · raythaMar 16, 2026
- CVE-2025-4742428Monitor
Retool (self-hosted) before 3.196.0 allows Host header injection.
HighCVSS 7.1No exploitEPSS 0%retool · retoolMay 9, 2025
- CVE-2026-5794227Monitor
LibreTranslate - IP Spoofing via X-Forwarded-For Header
MediumCVSS 6.9No exploitEPSS 0%libretranslate · libretranslateJun 29, 2026
- CVE-2026-10816227Monitor
Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For
MediumCVSS 6.9No exploitEPSS 0%smp46 · pingvin-share-xOct 10, 2026
- CVE-2026-10359227Monitor
simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unau
MediumCVSS 6.9No exploitEPSS 0%Sep 30, 2026
- CVE-2025-5352227Monitor
Movable Type contains an issue with use of less trusted source.
MediumCVSS 6.9No exploitEPSS 0%six apart ltd. · movable type (software edition)Aug 20, 2025