Skip to content
Noroxi

CWE-807 · 96 records

Reliance on Untrusted Inputs in a Security Decision

CVEs in this class

96 records

  • CVE-2026-21509
    82Now

    Microsoft Office Security Feature Bypass Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 70%

    microsoft · 365 appsJan 26, 2026

  • CVE-2026-21514
    61This week

    Microsoft Word Security Feature Bypass Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · 365 appsFeb 10, 2026

  • CVE-2026-84474
    39Monitor

    Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and

    CriticalCVSS 9.9No exploitEPSS 0%

    red hat · red hat ansible automation platform 2.4 for rhel 8Sep 23, 2026

  • CVE-2025-12487
    39Monitor

    oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    oobabooga · text-generation-webuiNov 6, 2025

  • CVE-2025-12488
    39Monitor

    oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    oobabooga · text-generation-webuiNov 6, 2025

  • CVE-2026-82533
    37Monitor

    DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

    CriticalCVSS 9.4No exploitEPSS 1%

    deepseek · deepseek harnessSep 8, 2026

  • CVE-2026-64827
    37Monitor

    Telenia TVox 26.5.3 Authentication Bypass via set_env.php

    CriticalCVSS 9.3No exploitEPSS 0%

    telenia software · tvoxAug 3, 2026

  • CVE-2024-51561
    37Monitor

    Authentication bypass Vulnerability in Aero

    CriticalCVSS 9.3No exploitEPSS 0%

    63moons · aeroNov 4, 2024

  • CVE-2025-13926
    37Monitor

    Contemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security Decision

    CriticalCVSS 9.3No exploitEPSS 0%

    contemporary controls · bascontrol20Apr 9, 2026

  • CVE-2026-85602
    37Monitor

    Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass

    CriticalCVSS 9.3No exploitEPSS 0%

    getgrav · grav-plugin-formSep 4, 2026

  • CVE-2025-1126
    37Monitor

    Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).

    CriticalCVSS 9.3No exploitEPSS 0%

    lexmark · lexmark print management clientFeb 11, 2025

  • CVE-2025-49827
    36Monitor

    Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator

    CriticalCVSS 9.1No exploitEPSS 1%

    cyberark · conjurJul 15, 2025

  • CVE-2026-66768
    36Monitor

    Improper Access Control in SAP NetWeaver (SAP GUI for Java)

    CriticalCVSS 9.0No exploitEPSS 0%

    sap_se · sap netweaver (sap gui for java)Sep 7, 2026

  • CVE-2021-31999
    35Monitor

    Rancher: Privilege escalation vulnerability via malicious Connection header

    HighCVSS 8.8No exploitEPSS 1%

    rancher · rancherJul 15, 2021

  • CVE-2021-36777
    35Monitor

    login-proxy sends password to attacker-provided domain

    HighCVSS 8.8No exploitEPSS 0%

    opensuse · open build serviceMar 9, 2022

  • CVE-2026-85817
    35Monitor

    Microsoft PowerShell Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · windows 10 16073 days ago

  • CVE-2026-96251
    35Monitor

    Microsoft PowerShell Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · powershell 7.43 days ago

  • CVE-2024-55354
    35Monitor

    Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism fai

    HighCVSS 8.8No exploitEPSS 0%

    lucee · lucee serverApr 8, 2025

  • CVE-2024-13974
    34Monitor

    A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers contro

    HighCVSS 8.1No exploitEPSS 7%

    sophos · firewall firmwareJul 21, 2025

  • CVE-2026-9077
    34Monitor

    Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features

    HighCVSS 8.5No exploitEPSS 0%

    langflow · langflowAug 5, 2026

  • CVE-2026-13059
    34Monitor

    Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

    HighCVSS 8.6No exploitEPSS 0%

    mongodb · mongodbJul 22, 2026

  • CVE-2026-87479
    33Monitor

    Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rend

    HighCVSS 8.3No exploitEPSS 0%

    google · chromeSep 8, 2026

  • CVE-2024-29039
    32Monitor

    Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state

    HighCVSS 8.1No exploitEPSS 0%

    tpm2-tools project · tpm2-toolsJun 28, 2024

  • CVE-2026-83522
    32Monitor

    Windows IKE Extension Spoofing Vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    microsoft · windows 10 version 16073 days ago

  • CVE-2026-81179
    32Monitor

    SysReptor: Host header injection might allow account takeover

    HighCVSS 8.1No exploitEPSS 0%

    syslifters · sysreptorSep 18, 2026

All vulnerability classes