CWE-349 · 46 records

Acceptance of Extraneous Untrusted Data With Trusted Data

CVEs in this class

46 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2019-9535No exploit	iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command executioniterm2 · iterm2 · CWE-349 pre-auth RCE	Critical9.8	—	2.4%	Oct 9, 2019
39Monitor	CVE-2026-41120No exploit	Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilitdell · wyse management suite · CWE-349 pre-auth RCE	Critical9.8	—	0.3%	Jun 25, 2026
39Monitor	CVE-2023-51655No exploit	In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specifiedjetbrains · intellij idea · CWE-349 Pre-auth	Critical9.8	—	0.3%	Dec 21, 2023
36Monitor	CVE-2026-45602No exploit	Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerabilitymicrosoft · windows 10 1607 · CWE-349 Pre-auth	Critical9.1	—	0.4%	Jun 9, 2026
35Monitor	CVE-2018-1131No exploit	Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.infinispan · infinispan · CWE-349 Deserialization	High8.8	—	1.2%	May 15, 2018
34Monitor	CVE-2025-40778Proof of concept	Cache poisoning attacks with unsolicited RRsisc · bind 9 · CWE-349 Pre-auth	High8.6	—	0.6%	Oct 22, 2025
34Monitor	CVE-2023-44317No exploit	A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAsiemens · scalance xb208 \(e\/ip\) firmware · CWE-349	High8.6	—	0.3%	Nov 14, 2023
34Monitor	CVE-2025-40776No exploit	Birthday Attack against Resolvers supporting ECSisc · bind 9 · CWE-349 Pre-auth	High8.6	—	0.2%	Jul 16, 2025
34Monitor	CVE-2025-5994No exploit	Cache poisoning via the ECS-enabled Rebirthday Attacknlnet labs · unbound · CWE-349 Pre-auth	High8.7	—	0.2%	Jul 16, 2025
34Monitor	CVE-2026-48100No exploit	Payy: agg_agg trailing message slots are unconstrained and allow forged burn messagespolybase · payy · CWE-349 Pre-auth	High8.7	—	0.1%	Sep 28, 2026
34Monitor	CVE-2026-95985No exploit	Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspacesamazon · kiro ide · CWE-349 Pre-auth	High8.6	—	0.1%	Sep 24, 2026
33Monitor	CVE-2026-32162No exploit	Windows COM Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-349 Local privilege escalation	High8.4	—	0.2%	Apr 14, 2026
33Monitor	CVE-2026-35641No exploit	OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installationopenclaw · openclaw · CWE-349 RCE	High8.4	—	0.1%	Apr 10, 2026
32Monitor	CVE-2026-1642No exploit	A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers.f5 · nginx gateway fabric · CWE-349 Pre-auth	High8.2	—	0.3%	Feb 4, 2026
32Monitor	GHSA-5xr6-xhww-33m4No exploit	Artifact poisoning vulnerability in action-download-artifact v5 and earlierGitHub Actions · dawidd6/action-download-artifact · CWE-349 Pre-auth	High8.0	—	—	Nov 25, 2024
31Monitor	CVE-2020-8023No exploit	Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2suse · enterprise storage · CWE-349 Local privilege escalation	High7.8	—	0.4%	Sep 1, 2020
31Monitor	CVE-2024-52555No exploit	In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer scriptjetbrains · webstorm · CWE-349	High7.8	—	0.1%	Nov 15, 2024
30Monitor	CVE-2025-29816No exploit	Microsoft Word Security Feature Bypass Vulnerabilitymicrosoft · 365 apps · CWE-349 Pre-auth	High7.5	—	0.4%	Apr 8, 2025
30Monitor	CVE-2025-29842No exploit	UrlMon Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 · CWE-349 Pre-auth	High7.5	—	0.4%	May 13, 2025
30Monitor	CVE-2025-27415Proof of concept	Nuxt allows DOS via cache poisoning with payload rendering responsenuxt · nuxt · CWE-349 Pre-auth Denial of service	High7.5	—	0.3%	Mar 19, 2025
30Monitor	CVE-2026-33612No exploit	ZoneToCache can poison the cachepowerdns · recursor · CWE-349 Pre-auth	High7.5	—	0.1%	Jun 25, 2026
28Monitor	CVE-2024-41924No exploit	Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series.ec-cube co.,ltd. · ec-cube 4 series · CWE-349	High7.2	—	0.2%	Jul 30, 2024
28Monitor	CVE-2024-53848No exploit	check-jsonschema default caching for remote schemas allows for cache confusionpython-jsonschema · check-jsonschema · CWE-349	High7.1	—	0.1%	Nov 29, 2024
27Monitor	CVE-2025-48804Proof of concept	Windows BitLocker Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 · CWE-349	Medium6.8	—	0.6%	Jul 8, 2025
27Monitor	CVE-2026-102527No exploit	Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesnuxt-modules · og-image · CWE-349 Pre-auth	Medium6.9	—	0.1%	3 days ago

CVE-2019-9535
40Plan
iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
iterm2 · iterm2Oct 9, 2019
CVE-2026-41120
39Monitor
Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilit
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
dell · wyse management suiteJun 25, 2026
CVE-2023-51655
39Monitor
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
jetbrains · intellij ideaDec 21, 2023
CVE-2026-45602
36Monitor
Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
microsoft · windows 10 1607Jun 9, 2026
CVE-2018-1131
35Monitor
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.
HighCVSS 8.8No exploitEPSS 1%
- Deserialization
infinispan · infinispanMay 15, 2018
CVE-2025-40778
34Monitor
Cache poisoning attacks with unsolicited RRs
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
isc · bind 9Oct 22, 2025
CVE-2023-44317
34Monitor
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NA
HighCVSS 8.6No exploitEPSS 0%
siemens · scalance xb208 \(e\/ip\) firmwareNov 14, 2023
CVE-2025-40776
34Monitor
Birthday Attack against Resolvers supporting ECS
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
isc · bind 9Jul 16, 2025
CVE-2025-5994
34Monitor
Cache poisoning via the ECS-enabled Rebirthday Attack
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
nlnet labs · unboundJul 16, 2025
CVE-2026-48100
34Monitor
Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
polybase · payySep 28, 2026
CVE-2026-95985
34Monitor
Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
amazon · kiro ideSep 24, 2026
CVE-2026-32162
33Monitor
Windows COM Elevation of Privilege Vulnerability
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
microsoft · windows 10 1809Apr 14, 2026
CVE-2026-35641
33Monitor
OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation
HighCVSS 8.4No exploitEPSS 0%
- RCE
openclaw · openclawApr 10, 2026
CVE-2026-1642
32Monitor
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers.
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
f5 · nginx gateway fabricFeb 4, 2026
GHSA-5xr6-xhww-33m4
32Monitor
Artifact poisoning vulnerability in action-download-artifact v5 and earlier
HighCVSS 8.0No exploit
- Pre-auth
GitHub Actions · dawidd6/action-download-artifactNov 25, 2024
CVE-2020-8023
31Monitor
Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
suse · enterprise storageSep 1, 2020
CVE-2024-52555
31Monitor
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script
HighCVSS 7.8No exploitEPSS 0%
jetbrains · webstormNov 15, 2024
CVE-2025-29816
30Monitor
Microsoft Word Security Feature Bypass Vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
microsoft · 365 appsApr 8, 2025
CVE-2025-29842
30Monitor
UrlMon Security Feature Bypass Vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
microsoft · windows 10 1507May 13, 2025
CVE-2025-27415
30Monitor
Nuxt allows DOS via cache poisoning with payload rendering response
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
nuxt · nuxtMar 19, 2025
CVE-2026-33612
30Monitor
ZoneToCache can poison the cache
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
powerdns · recursorJun 25, 2026
CVE-2024-41924
28Monitor
Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series.
HighCVSS 7.2No exploitEPSS 0%
ec-cube co.,ltd. · ec-cube 4 seriesJul 30, 2024
CVE-2024-53848
28Monitor
check-jsonschema default caching for remote schemas allows for cache confusion
HighCVSS 7.1No exploitEPSS 0%
python-jsonschema · check-jsonschemaNov 29, 2024
CVE-2025-48804
27Monitor
Windows BitLocker Security Feature Bypass Vulnerability
MediumCVSS 6.8Proof of conceptEPSS 0%
microsoft · windows 10 1507Jul 8, 2025
CVE-2026-102527
27Monitor
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
nuxt-modules · og-image3 days ago

All vulnerability classes