CWE-807.

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

• Authentication bypass
• CWE-807

<2.11.48 · fixed in 2.11.48

Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation

• CWE-346
• CWE-807

<2.0 · fixed in 2.0

The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed.

• vivo PcSuite
• CWE-807

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

• CWE-348
• CWE-644

<2.22.0 · fixed in 2.22.0

e107: Host Header Injection in e107 password reset enables phishing

• e107
• CWE-20
• CWE-807

SillyTavern has Authentication Bypass via SSO Header Injection

• Authentication bypass
• CWE-346

<1.18.0 · fixed in 1.18.0

Remote Spark SparkView RCE

• Remote Spark (https://www.remotespark.com/) SparkView
• Authentication bypass
• CWE-807

VM2 Has Sandbox Breakout Through Promise Species

• Code injection
• CWE-693

<3.10.5 · fixed in 3.10.5

Client-supplied URI scheme trusted without transport verification in bandit

• CWE-807

>=1.0.0, <1.11.0 · fixed in 1.11.0

A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive information on the device via crafted requests, affecting certain production printers a…

• Canon Inc. imagePRESS Series
• Canon Inc. imageFORCE Series
• CWE-807

UEFI Secure Boot Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-807

SpotFTP Password Recover 2.4.2 Denial of Service via Name Field

• NSauditor SpotFTP Password Recover
• CWE-807

Duplicate Advisory: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

• CWE-807

<=2026.3.24 · no fixed version yet

Duplicate Advisory: OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

• CWE-807

* · no fixed version yet

Apache Tomcat Missing Encryption of Sensitive Data vulnerability

• Weak cryptography or TLS
• CWE-807

>=11.0.20, <11.0.21 || >=10.1.53, <10.1.54 || >=9.0.116, <9.0.117 · fixed in 11.0.21, 10.1.54, 9.0.117

Contemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security Decision

• Contemporary Controls BASControl20
• CWE-807

OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

• CWE-348
• CWE-807

<2026.3.31 · fixed in 2026.3.31

OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

• CWE-184
• CWE-807

<2026.3.31 · fixed in 2026.3.31

GINA Domain Switch

• SEPPmail Secure Email Gateway
• CWE-807

OpenClaw gateway exec allow-always over-trusts positional carrier executables

• Broken access control
• CWE-807

<2026.3.28 · fixed in 2026.3.28

OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper

• CWE-385
• CWE-807

<2026.3.28 · fixed in 2026.3.28

OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing

• Authentication bypass
• CWE-807

<2026.3.28 · fixed in 2026.3.28

OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

• Broken access control
• CWE-807

<2026.3.28 · fixed in 2026.3.28

OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting

• Broken access control
• CWE-807

<2026.3.22 · fixed in 2026.3.22

OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

• Broken access control
• CWE-807

<2026.3.22 · fixed in 2026.3.22

OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

• Broken access control
• CWE-706

<2026.3.22 · fixed in 2026.3.22

Pixel Studio 2.17 Denial of Service via Malformed Input

• Pixarra Pixel Studio
• CWE-807

ASPRunner.NET 10.1 Denial of Service via Table Name Field

• Xlinesoft ASPRunner.NET
• CWE-807

Pidgin 2.13.0 Denial of Service via Malformed Username

• Pidgin
• CWE-807

Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

• CWE-807

<=2026.2.22-2 · no fixed version yet

Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

• CWE-807

<=2026.2.24 · no fixed version yet

Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

• CWE-807

>=0.8, <2.2.0 · fixed in 2.2.0

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

• CWE-807

<2.1.53 · fixed in 2.1.53

OpenClaw's Zalouser allowlist authorization matched mutable group names by default

• Broken access control
• CWE-807

<2026.3.12 · fixed in 2026.3.12

Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

• Broken access control
• CWE-807

>=2.9.0 · no fixed version yet

OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

• CWE-345
• CWE-807

<2026.2.21 · fixed in 2026.2.21

OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

• CWE-807

<2026.2.25 · fixed in 2026.2.25

OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

• Broken access control
• CWE-807

<2026.2.23 · fixed in 2026.2.23

Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint

• seerr
• Authentication bypass
• CWE-807

OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)

• Command injection
• CWE-427

<2026.2.14 · fixed in 2026.2.14

Microsoft Word Security Feature Bypass Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office LTSC 2021
• CWE-807

Cube Core is vulnerable to privilege escalation via a specially crafted request

• CWE-807

>=0.27.19, <1.0.14 || >=1.1.0, <1.4.2 || >=1.5.0, <1.5.13 · fixed in 1.0.14, 1.4.2, 1.5.13

vscode-spell-checker has a workspace-trust bypass Code Execution

• streetsidesoftware vscode-spell-checker
• Broken access control
• CWE-807

Microsoft Office Security Feature Bypass Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2016
• CWE-807

MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing

• franklioxygen MyTube
• CWE-807

Windows Kerberos Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-807

Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy chain.

• CWE-807

1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel

• Authentication bypass
• CWE-602

<2.0.14+incompatible · fixed in 2.0.14+incompatible

cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust

• yhirose cpp-httplib
• Other injection
• CWE-807

cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)

• yhirose cpp-httplib
• Authentication bypass
• CWE-345

Authentication Bypass in Turkguven's Perfektive

• Turkguven Software Technologies Inc. Perfektive
• Authentication bypass
• CWE-602

oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability

• oobabooga text-generation-webui
• CWE-807

oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability

• oobabooga text-generation-webui
• CWE-807

Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation

• smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
• CWE-807

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

• Microsoft Windows 11 version 22H2
• Microsoft Windows 11 version 22H3
• CWE-807

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

• CWE-807

>=2.17.0, <2.18.0 · fixed in 2.18.0

github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks

• Cross-site request forgery (CSRF)
• CWE-346

<=1.7.3 · no fixed version yet

flaskBlog allows arbitrary privilege escalation

• DogukanUrker FlaskBlog
• Broken access control
• CWE-807

flaskBlog Stored XSS Vulnerability

• DogukanUrker FlaskBlog
• Cross-site scripting (XSS)
• CWE-807

The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess

• openSUSE Tumbleweed
• CWE-807