CWE-290

636 vulnerabilities with CWE-290

CVE-2026-61428 HIGH

PraisonAI AgentMail before 4.6.78 Message Injection via Webhook

CVSS 7.3

CVE-2026-56675 HIGH

9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs

CVSS 8.3

CVE-2026-55641 HIGH

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

CVSS 8.2

CVE-2026-59224 HIGH

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

CVSS 8.0

CVE-2026-54782 CRITICAL

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

CVSS 10.0

CVE-2026-8651 LOW

IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer

CVSS 3.7

CVE-2026-45045 MEDIUM

Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

CVSS 5.3

CVE-2026-56360 MEDIUM

n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger

CVSS 4.0

CVE-2026-54763 CRITICAL

Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

CVSS 10.0

CVE-2026-24013 CRITICAL

Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC

CVSS 9.1

CVE-2026-45489 MEDIUM

Microsoft Edge (Chromium-based) Spoofing Vulnerability

CVSS 6.5

CVE-2026-14381 MEDIUM

Google Chrome < 150.0.7871.46 - UI Spoofing via WebAppInstalls

CVSS 6.5

CVE-2026-58593 HIGH

NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User

CVSS 7.5

CVE-2026-24270 CRITICAL

Nvidia AIStore Framework - Authentication Bypass by Spoofing

CVSS 9.8

CVE-2026-14118 MEDIUM

Google Chrome < 150.0.7871.47 - Cross-Origin Data Leak via DevTools

CVSS 6.5

CVE-2026-13985 MEDIUM

Google Chrome < 150.0.7871.47 - UI Spoofing via MediaCapture

CVSS 6.5

CVE-2026-13984 MEDIUM

Google Chrome < 150.0.7871.47 - UI Spoofing via TabStrip

CVSS 4.3

CVE-2026-13207 HIGH

Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing

CVSS 7.5

CVE-2026-58370 HIGH

Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name

CVSS 8.1

CVE-2026-7656 HIGH

Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack

CVSS 8.1

CVE-2026-54089 CRITICAL

File Browser: Authentication Bypass via Proxy Auth Header Forgery

CVSS 9.1

CVE-2026-52690 MEDIUM

Spoofed answers can mark an authoritative non-EDNS capable

CVSS 5.9

CVE-2026-25119 HIGH

Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

CVE-2026-47381 MEDIUM

NocoDB: Cross-Workspace Integration Use in Connection Test

CVE-2026-52845 HIGH

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

CVSS 8.1