CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
Description
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-349 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-2x6f-rp82-ppmj | CVE-2026-102527 | MODERATE |
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes |
2026-10-15 | |
| GHSA-3mqq-hv9c-85hc | CVE-2026-62364 | LOW |
wlc may disclose API tokens to project-configured URLs |
2026-09-22 | |
| GHSA-fwjf-m4qw-9f2x | CVE-2026-54625 | MODERATE |
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning) |
2026-08-24 | |
| GHSA-g8wj-3cr3-6w7v | CVE-2026-46342 | LOW |
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning |
2026-07-08 | |
| GHSA-f26g-jm89-4g65 | CVE-2026-40034 | HIGH | - |
gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules |
2026-06-30 |
| GHSA-wgjv-9j3q-jhg8 | CVE-2024-34083 | MODERATE |
aiosmtpd STARTTLS unencrypted commands injection |
2026-06-10 | |
| GHSA-3g8h-86w9-wvmq | CVE-2026-44572 | LOW |
Next.js's Middleware / Proxy redirects can be cache-poisoned |
2026-05-14 | |
| GHSA-rxmx-g7hr-8mx4 | CVE-2026-41354 | MODERATE |
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders |
2026-05-07 | |
| GHSA-m3mh-3mpg-37hw | CVE-2026-35641 | HIGH |
OpenClaw has an Arbitrary Malicious Code Execution Vulnerability |
2026-04-10 | |
| GHSA-c35q-ffpf-5qpm | CVE-2023-46446 | HIGH |
AsyncSSH Rogue Session Attack |
2025-11-04 | |
| GHSA-cfc2-wr2v-gxm5 | CVE-2023-46445 | MODERATE |
AsyncSSH Rogue Extension Negotiation |
2025-11-04 | |
| GHSA-jvhm-gjrh-3h93 | CVE-2025-27415 | HIGH |
Nuxt allows DOS via cache poisoning with payload rendering response |
2025-03-20 | |
| GHSA-q6mv-284r-mp36 | CVE-2024-53848 | MODERATE |
check-jsonschema default caching for remote schemas allows for cache confusion |
2024-12-02 | |
| GHSA-5xr6-xhww-33m4 | - | HIGH | - |
Artifact poisoning vulnerability in action-download-artifact v5 and earlier |
2024-11-25 |
| GHSA-q7q2-qf2q-rw3w | CVE-2014-1418 | CRITICAL |
Django Vulnerable to Cache Poisoning |
2024-11-18 | |
| GHSA-gp8f-8m3g-qvj9 | CVE-2024-46982 | HIGH |
Next.js Cache Poisoning |
2024-09-18 | |
| GHSA-rm2j-x595-q9cj | CVE-2011-4139 | HIGH |
Django Vulnerable to Cache Poisoning |
2024-09-16 | |
| GHSA-cfxw-4h78-h7fw | CVE-2024-25638 | HIGH |
DNSJava DNSSEC Bypass |
2024-09-04 | |
| GHSA-8wgj-6wx8-h5hq | CVE-2018-14773 | MODERATE | - |
Symfony HTTP Foundation web cache poisoning |
2024-02-08 |
| GHSA-cwh2-q44x-5w3c | CVE-2023-5548 | MODERATE | - |
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability |
2023-11-17 |