CWE-807.

Multiple Vulnerabilities in IBM API Connect

• IBM API Connect
• CWE-807

Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment

• umputun remark42
• CWE-348
• CWE-807

Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint

• aws-nitro-enclaves-sdk-c
• CWE-807

Authlib: ID token can disable its own nonce validation via the nonce_supported claim

• Authentication bypass
• CWE-807

<1.9.0 · fixed in 1.9.0

yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

• YunaiV yudao-cloud
• CWE-807

Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

• NLnet Labs Unbound
• CWE-807

AIOHTTP: Absolute-form request targets can spoof Request.scheme

• CWE-807

<3.14.4 · fixed in 3.14.4

makeplane API Endpoint reliance on untrusted inputs in a security decision

• plane
• CWE-20
• CWE-807

Microsoft Office Word Security Feature Bypass Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 365 for Mac
• CWE-807

Resource allocation without limits in Eclipse Foundation Eclipse Connected Services Platform

• Eclipse Foundation Eclipse Connected Services Platform
• Denial of service
• CWE-348

util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass

• util-linux
• Privilege escalation
• CWE-807

Gitea required Actions check bypass through skipped workflows

• Gitea
• Broken access control
• CWE-345

Microsoft PowerShell Remote Code Execution Vulnerability

• Microsoft PowerShell 7.4
• Microsoft PowerShell 7.5
• CWE-807

Microsoft Office Word Security Feature Bypass Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 365 for Mac
• CWE-807

Windows IKE Extension Spoofing Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-807

Microsoft PowerShell Remote Code Execution Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-807

Visual Studio Code Security Feature Bypass Vulnerability

• Microsoft Visual Studio Code
• CWE-807

Reliance on Untrusted Inputs in a Security Decision in GitLab

• GitLab
• CWE-807

pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID

• ph7software ph7builder
• CWE-807

Reliance on Untrusted Inputs in a Security Decision in hMailServer

• Progressive Robot Ltd hMailServer
• CWE-807

KaTeX: Existing prototype pollution can bypass trust restrictions

• CWE-807

>=0.11.0, <0.18.2 · fixed in 0.18.2

Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

• Ghost
• CWE-807

Genians, Inc Genian NAC/ZTNA Remote Code Execution

• Genians, Inc Genian NAC 4.0.175 Release
• Genians, Inc Genian NAC 5.0.65 LTS Release
• Path traversal
• Broken access control

Kiteworks Core Remote Code Execution

• Kiteworks Core
• CWE-807
• CWE-940

deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision

• deepseek-ai deepseek-harness
• CWE-20
• CWE-807

agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision

• agentverus-scanner
• CWE-20
• CWE-807

authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

• authentik
• Authentication bypass
• CWE-807

Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…

• Red Hat Ansible Automation Platform 2.4 for RHEL 8
• Red Hat Ansible Automation Platform 2.4 for RHEL 9
• CWE-807

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

• Authentication bypass
• CWE-807

<0.5.8 · fixed in 0.5.8

9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

• CWE-807

<0.5.8 · fixed in 0.5.8

Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust

• Mailu
• Mailu helm-charts
• Authentication bypass
• CWE-807

Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

• Temporal Technologies, Inc. Temporal Server
• CWE-807

SysReptor: Host header injection might allow account takeover

• Syslifters sysreptor
• CWE-807

pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode

• pgadmin.org pgAdmin 4
• Authentication bypass
• CWE-807

Admission Control Bypass via Hardcoded Sidecar Image Exemption

• SUSE github.com/neuvector/neuvector
• CWE-807

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0

• joomshaper.com SP Page Builder (Pro) extension for Joomla
• CWE-807

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0

• joomshaper.com SP Page Builder (Pro) extension for Joomla
• CWE-807

Traefik entrypoint header-name sanitization bypassed via request trailers

• CWE-436
• CWE-807

>=3.2.0, <3.7.13 · fixed in 3.7.13

webhookd: Unrestricted HTTP Header to Shell Variable Injection

• Authentication bypass
• CWE-807

<1.22.0 · fixed in 1.22.0

Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36…

• Google Chrome
• CWE-807

DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

• CWE-807

<0.1.2-alpha.1 · fixed in 0.1.2-alpha.1

Improper Access Control in SAP NetWeaver (SAP GUI for Java)

• SAP_SE SAP NetWeaver (SAP GUI for Java)
• CWE-807

Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass

• getgrav grav-plugin-form
• CWE-807

Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

• Apache Software Foundation Apache APISIX
• CWE-807

authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView

• authentik
• Broken access control
• CWE-807

rsync < 3.5.0 Arbitrary File Deletion via Malicious File List

• rsync
• CWE-807

Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision

• Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware
• Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App
• CWE-807

Snipe-IT Checkout Request Cancellation IDOR

• Grokability Snipe-IT
• Broken access control
• CWE-807

Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data

• MongoDB Server
• CWE-807

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

• SAP_SE SAP Business AI Platform (Approuter)
• CWE-807

Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features

• IBM Langflow OSS
• CWE-807

Telenia TVox 26.5.3 Authentication Bypass via set_env.php

• Telenia Software TVox
• CWE-807

Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

• MongoDB Server
• CWE-807

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.7
• CWE-807

Insufficient verification of data authenticity in Eclipse Foundation Eclipse Kura

• Eclipse Foundation Eclipse Kura
• CWE-345
• CWE-348

OpenClaw: Skill Workshop apply flow could override pending approval

• Broken access control
• CWE-807

<2026.5.6 · fixed in 2026.5.6

Blocky DNSSEC validation bypass and validation-cache scope pollution

• CWE-346
• CWE-807

>=0.28.0, <0.32.0 · fixed in 0.32.0

OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers

• Broken access control
• CWE-807

<2026.5.7 · fixed in 2026.5.7

pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic

• mcdope pam_usb
• CWE-454
• CWE-807

Duplicate Advisory: BlueBubbles sender policy could match mutable conversation identifiers

• CWE-807

<=2026.5.6 · no fixed version yet