CWE-940 · 58 records

Improper Verification of Source of a Communication Channel

CVEs in this class

58 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
68This week	CVE-2025-61932Weaponized	Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, motex · lanscope endpoint manager · CWE-940 pre-auth RCE	Critical9.3	KEV	2.7%	Oct 20, 2025
39Monitor	CVE-2023-41094No exploit	Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNetsilabs · emberznet · CWE-940 Pre-auth Auth bypass	Critical9.8	—	0.6%	Oct 4, 2023
39Monitor	CVE-2024-40515No exploit	An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute arbitrary code via the Routintenda · ax2 pro firmware · CWE-940 pre-auth RCE	Critical9.8	—	0.6%	Jul 16, 2024
39Monitor	CVE-2024-38886No exploit	An issue in Horizon Business Services Inc.horizoncloud · caterease · CWE-940 Pre-auth	Critical9.8	—	0.6%	Aug 2, 2024
39Monitor	CVE-2023-41355No exploit	Chunghwa Telecom NOKIA G-040W-Q - Improper Input Validationnokia · g-040w-q firmware · CWE-940 Pre-auth	Critical9.8	—	0.6%	Nov 3, 2023
38Monitor	CVE-2026-85085No exploit	The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView.canva · canva · CWE-940 Pre-auth	Critical9.6	—	0.3%	Sep 4, 2026
37Monitor	CVE-2026-33875No exploit	Authenticator Vulnerable to Authentication Flow Hijackgematik · authenticator · CWE-940 Pre-auth	Critical9.3	—	0.4%	Mar 27, 2026
37Monitor	CVE-2026-48745No exploit	Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetrytraccar · traccar-client · CWE-940 Pre-auth	Critical9.3	—	0.4%	Jun 17, 2026
37Monitor	CVE-2026-112408No exploit	Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()aws · amazon sagemaker python sdk · CWE-940 Pre-auth	Critical9.4	—	—	Today
36Monitor	CVE-2026-102551No exploit	Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handlingfreertos · freertos-plus-tcp · CWE-940 Pre-auth	Critical9.2	—	0.2%	5 days ago
35Monitor	CVE-2023-48387No exploit	TAIWAN-CA(TWCA) JCICSecurityTool - Improper Input Validationtwca · jcicsecuritytool · CWE-940 pre-auth RCE	High8.8	—	1.0%	Dec 15, 2023
35Monitor	CVE-2023-3663No exploit	CODESYS: Missing integrity check in CODESYS Development Systemcodesys · development system · CWE-940 Pre-auth	High8.8	—	1.0%	Aug 3, 2023
35Monitor	CVE-2024-40516No exploit	An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the RoutingCWE-940 pre-auth RCE	High8.8	—	0.3%	Jul 16, 2024
34Monitor	CVE-2026-78685No exploit	Le-yan｜Medical Practice Management System - Remote Code Executionle-yan · medical practice management system · CWE-940 pre-auth RCE	High8.6	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-35643No exploit	OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterfaceopenclaw · openclaw · CWE-940 pre-auth RCE	High8.6	—	0.5%	Apr 10, 2026
34Monitor	CVE-2019-25613No exploit	Easy Chat Server 3.1 Denial of Service via message Parameterechatserver · easy chat server · CWE-940 Pre-auth	High8.7	—	0.5%	Mar 22, 2026
34Monitor	CVE-2025-40820No exploit	Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range.siemens · sidoor atd430w · CWE-940 Pre-auth	High8.7	—	0.4%	Dec 9, 2025
34Monitor	CVE-2026-89178No exploit	Howyar｜WeenyGenius - Origin Validation Errorhowyar · weenygenius · CWE-940 Pre-auth	High8.7	—	0.3%	Sep 11, 2026
33Monitor	CVE-2024-1621No exploit	uniFLOW Online device registration susceptible to compromisent-ware · uniflow online · CWE-940 Pre-auth	High8.3	—	0.3%	Sep 2, 2024
33Monitor	CVE-2025-23222No exploit	An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root.deepin · dde-api-proxy · CWE-940 Local privilege escalation	High8.4	—	0.2%	Jan 24, 2025
32Monitor	CVE-2026-40434No exploit	Anviz CrossChex Standard Improper Verification of Source of a Communication Channelanviz · crosschex standard · CWE-940 Pre-auth	High8.1	—	0.3%	Apr 17, 2026
32Monitor	CVE-2026-102552No exploit	Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolverfreertos · freertos-plus-tcp · CWE-940 Pre-auth	High8.2	—	0.2%	5 days ago
32Monitor	GHSA-g8fc-vrcg-8vjgNo exploit	Constallation has pods exposed to peers in VPCGo · github.com/edgelesssys/constellation/v2 · CWE-940	High8.0	—	—	Apr 15, 2024
30Monitor	CVE-2023-51440No exploit	A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (Allsiemens · simatic cp 343-1 · CWE-940 Pre-auth Denial of service	High7.5	—	0.5%	Feb 13, 2024
30Monitor	CVE-2026-44894No exploit	Netty's Default QUIC token handler accepts any client-supplied tokennetty · netty · CWE-940 Pre-auth	High7.5	—	0.1%	Jun 12, 2026

CVE-2025-61932
68This week
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests,
CriticalCVSS 9.3KEVWeaponizedEPSS 2%
- pre-auth RCE
motex · lanscope endpoint managerOct 20, 2025
CVE-2023-41094
39Monitor
Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
silabs · emberznetOct 4, 2023
CVE-2024-40515
39Monitor
An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute arbitrary code via the Routin
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
tenda · ax2 pro firmwareJul 16, 2024
CVE-2024-38886
39Monitor
An issue in Horizon Business Services Inc.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
horizoncloud · catereaseAug 2, 2024
CVE-2023-41355
39Monitor
Chunghwa Telecom NOKIA G-040W-Q - Improper Input Validation
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
nokia · g-040w-q firmwareNov 3, 2023
CVE-2026-85085
38Monitor
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView.
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
canva · canvaSep 4, 2026
CVE-2026-33875
37Monitor
Authenticator Vulnerable to Authentication Flow Hijack
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
gematik · authenticatorMar 27, 2026
CVE-2026-48745
37Monitor
Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
traccar · traccar-clientJun 17, 2026
CVE-2026-112408
37Monitor
Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
CriticalCVSS 9.4No exploit
- Pre-auth
aws · amazon sagemaker python sdkToday
CVE-2026-102551
36Monitor
Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
freertos · freertos-plus-tcp5 days ago
CVE-2023-48387
35Monitor
TAIWAN-CA(TWCA) JCICSecurityTool - Improper Input Validation
HighCVSS 8.8No exploitEPSS 1%
- pre-auth RCE
twca · jcicsecuritytoolDec 15, 2023
CVE-2023-3663
35Monitor
CODESYS: Missing integrity check in CODESYS Development System
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
codesys · development systemAug 3, 2023
CVE-2024-40516
35Monitor
An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
Jul 16, 2024
CVE-2026-78685
34Monitor
Le-yan｜Medical Practice Management System - Remote Code Execution
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
le-yan · medical practice management systemAug 25, 2026
CVE-2026-35643
34Monitor
OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
openclaw · openclawApr 10, 2026
CVE-2019-25613
34Monitor
Easy Chat Server 3.1 Denial of Service via message Parameter
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
echatserver · easy chat serverMar 22, 2026
CVE-2025-40820
34Monitor
Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range.
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
siemens · sidoor atd430wDec 9, 2025
CVE-2026-89178
34Monitor
Howyar｜WeenyGenius - Origin Validation Error
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
howyar · weenygeniusSep 11, 2026
CVE-2024-1621
33Monitor
uniFLOW Online device registration susceptible to compromise
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
nt-ware · uniflow onlineSep 2, 2024
CVE-2025-23222
33Monitor
An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root.
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
deepin · dde-api-proxyJan 24, 2025
CVE-2026-40434
32Monitor
Anviz CrossChex Standard Improper Verification of Source of a Communication Channel
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
anviz · crosschex standardApr 17, 2026
CVE-2026-102552
32Monitor
Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
freertos · freertos-plus-tcp5 days ago
GHSA-g8fc-vrcg-8vjg
32Monitor
Constallation has pods exposed to peers in VPC
HighCVSS 8.0No exploit
Go · github.com/edgelesssys/constellation/v2Apr 15, 2024
CVE-2023-51440
30Monitor
A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
siemens · simatic cp 343-1Feb 13, 2024
CVE-2026-44894
30Monitor
Netty's Default QUIC token handler accepts any client-supplied token
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
netty · nettyJun 12, 2026

All vulnerability classes