CWE-345.

Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning

• wavelens gradient
• Authentication bypass
• Broken access control

CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

• cubecart v6
• Open redirect
• CWE-20

Duplicate Advisory: OpenClaw: Isolated cron awareness events were recorded as trusted system events

• CWE-345

<2026.4.20 · fixed in 2026.4.20

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

• CWE-180
• CWE-345

<5.19.0 · fixed in 5.19.0

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

• Weak cryptography or TLS
• CWE-345

<0.0.0-20260501152247-18b587758667 · fixed in 0.0.0-20260501152247-18b587758667

Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

• CWE-345

>=4.0.0, <4.0.2 || >=3.0.0, <=3.4.2 · fixed in 4.0.2

axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

• Weak cryptography or TLS
• CWE-345

<7.0.0 · fixed in 7.0.0

axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

• Weak cryptography or TLS
• CWE-345

<6.0.0 · fixed in 6.0.0

axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

• Weak cryptography or TLS
• CWE-345

<5.7.0 · fixed in 5.7.0

axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

• Weak cryptography or TLS
• CWE-345

<6.7.0 · fixed in 6.7.0

Vaultwarden WebAuthn credential metadata tampered before signature verification

• dani-garcia vaultwarden
• CWE-345

awslabs/tough is Missing Delegated Metadata Validation

• CWE-345

>=0.9.0, <0.22.0 · fixed in 0.22.0

nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token

• CWE-345

<=1.1.0 · no fixed version yet

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

• CWE-345
• CWE-494

<1.2.7 · fixed in 1.2.7

Dolibarr has Insufficient Verification of Data Authenticity

• Weak cryptography or TLS
• CWE-345

<=15.0.3 · no fixed version yet

TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity

• TRENDnet TEW-821DAP
• CWE-345

TRENDnet TEW-821DAP Firmware Update new_gui_update_firmware data authenticity

• TRENDnet TEW-821DAP
• CWE-345

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

• CWE-345
• CWE-706

>=0.24.0, <0.26.0 · fixed in 0.26.0

Five Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter

• rustaurius Five Star Restaurant Reservations – WordPress Booking Plugin
• CWE-345

OpenID Connect nonce generated but never validated — ID token replay attack

• CWE-345

<2.3.43 || >=2.5.0, <2.5.45 || >=2.6.0, <2.6.31 || >=2.7.0, <2.7.18 · fixed in 2.3.43, 2.5.45, 2.6.31, 2.7.18

OpenClaw: Isolated cron awareness events were recorded as trusted system events

• CWE-345

<2026.4.20 · fixed in 2026.4.20

Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification

• Cesanta Mongoose
• Weak cryptography or TLS
• CWE-345

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication

• CWE-345
• CWE-501

<=1.7.34 · no fixed version yet

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

• Broken access control
• CWE-345

<0.12.10 · fixed in 0.12.10

nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

• Memory corruption
• CWE-20

<1.7.2 · fixed in 1.7.2

Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

• gitroomhq postiz-app
• Cross-site scripting (XSS)
• Unrestricted file upload

OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input

• Privilege escalation
• CWE-345

<2026.4.10 · fixed in 2026.4.10

Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server

• CWE-345

<2026.416.0 · fixed in 2026.416.0

Defense in Depth update for NuGet Client

• CWE-345

>=4.9.0, <4.9.7 || >=5.11.0, <5.11.7 || >=6.8.0, <6.8.2 || >=6.11.0, <6.11.2 || >=6.12.0, <6.12.5 || >=6.14.0, <6.14.3 || >=7.0.0, <7.0.3 || >=7.3.0, <7.3.1 · fixed in 4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1

SP1 V6 Recursion Circuit Row-Count Binding Gap

• CWE-345
• CWE-354

>=6.0.0, <6.1.0 · fixed in 6.1.0

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

• Authentication bypass
• CWE-345

<1.8.3 · fixed in 1.8.3

Base64 decoding stops at first padded quad by default

• Python Software Foundation CPython
• CWE-345

OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

• Open redirect
• CWE-345

<2026.4.8 · fixed in 2026.4.8

LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

• Authentication bypass
• CWE-345

<2.1.48 · fixed in 2.1.48

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

• Authentication bypass
• Insecure deserialization

>=2.0.0, <2.1.2 · fixed in 2.1.2

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

• CWE-345

<=26.0 · no fixed version yet

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Str…

• smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
• CWE-345

OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

• Weak cryptography or TLS
• CWE-345

<2026.4.2 · fixed in 2026.4.2

nimiq/core-rs-albatross: Macro block proposal interlink bug

• nimiq core-rs-albatross
• CWE-345

fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)

• CWE-345
• CWE-636

<=6.1.0 · no fixed version yet

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

• CWE-345
• CWE-706

>=0.0.1, <6.2.0 · fixed in 6.2.0

Electron: Service worker can spoof executeJavaScript IPC replies

• Authentication bypass
• CWE-345

<38.8.6 || >=39.0.0-alpha.1, <39.8.1 || >=40.0.0-alpha.1, <40.8.1 || >=41.0.0-alpha.1, <41.0.0 · fixed in 38.8.6, 39.8.1, 40.8.1, 41.0.0

An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data via supplying a crafted iu.sh script con…

• CWE-345
• CWE-494

openssl-encrypt silently skips schema validation when jsonschema library is not installed

• CWE-20
• CWE-345

<1.4.0 · fixed in 1.4.0

mpp has multiple payment bypass and griefing vulnerabilities

• Authentication bypass
• CWE-345

<0.8.0 · fixed in 0.8.0

mppx has multiple payment bypass and griefing vulnerabilities

• Authentication bypass
• CWE-345

<0.4.8 · fixed in 0.4.8

Botpress - Credential Disclosure via Twilio Webhook Handler

• botpress
• Cross-site request forgery (CSRF)
• CWE-345

OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

• CWE-345
• CWE-642

<2026.3.22 · fixed in 2026.3.22

OpenFGA has an Authorization Bypass through cached keys

• CWE-20
• CWE-345

<1.13.1 · fixed in 1.13.1

PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification

• PuTTY
• Weak cryptography or TLS
• CWE-345

janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification

• janmojzis tinyssh
• Weak cryptography or TLS
• CWE-345

barebox: FIT Signature Verification Bypass Vulnerability

• barebox
• CWE-345

Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification

• Yi Technology YI Home Camera
• Weak cryptography or TLS
• CWE-345

Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

• Unrestricted file upload
• CWE-343

<0.0.0-20260318074820-c4bd53f042d7 · fixed in 0.0.0-20260318074820-c4bd53f042d7

OneUptime WhatsApp Webhook Missing Signature Verification

• CWE-345

<10.0.34 · fixed in 10.0.34

JetKVM insufficient firmware verification

• JetKVM
• Weak cryptography or TLS
• CWE-345

GL-iNet Comet (GL-RM1) KVM insufficient firmware verification

• GL-iNet Comet KVM
• CWE-345

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

• CWE-345
• CWE-494

<1.21.0rc1 · fixed in 1.21.0rc1

HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification.

• HCL AION
• CWE-345

Multiple security vulnerabilities affect HCL AION

• HCL AION
• CWE-345