By weakness (CWE)

CWE-345: related vulnerabilities

CVEs classified under CWE-345. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

8 published vulnerabilities

• CVE-2022-4992HIGH 8.6

  Dräger patient monitors—specifically the Infinity Acute Care System and Standalone M540 models—contain a flaw in how they handle network messages. An attacker on the network can send malicious or fake data to these devices without needing credentials, which could cause them to reboot, lose connectivity, or have their alarm settings altered. This is especially serious in clinical environments where patient monitoring continuity is critical.

• CVE-2026-41577HIGH 7.5

  Authentik, an open-source identity provider, contains a flaw in how it processes SAML authentication assertions. The software fails to validate time-based and audience restrictions on these assertions, meaning an attacker could replay old, expired authentication tokens or use tokens intended for a different service. This could allow unauthorized access to systems relying on authentik for authentication.

• CVE-2026-47123HIGH 7.5

  FreeScout, a PHP-based help desk platform, contains a flaw in how it processes incoming email replies. Attackers who can forge the sender address of a help desk agent can trick FreeScout into treating their messages as legitimate agent responses. Because the system doesn't cryptographically verify these replies, the spoofed messages get automatically forwarded to customers using the real help desk email account. This means attackers could impersonate support staff and send messages to your customers without proper authorization.

• CVE-2026-46538MEDIUM 5.9

  Microsoft UFO is an open-source automation framework that lets multiple devices work together on tasks. In version 3.0.1-4-ge2626659, it has a flaw where one authenticated device can trick another device by sending a fake task completion message. When Device A receives a task from the coordinator, the system should only accept a completion message from Device A itself. Instead, the system accepts completion messages from any authenticated device as long as they use the same task ID. An attacker with legitimate access to the network can exploit this to inject false results into another device's task, potentially disrupting automated workflows.

• CVE-2026-7792MEDIUM 5.3

  The WPForms plugin for WordPress is vulnerable to webhook forgery that allows attackers to impersonate PayPal and manipulate subscription payment records. An attacker who knows a subscription ID can craft fake PayPal webhook messages to reactivate cancelled subscriptions, change payment status, or modify other subscription details—all without needing to authenticate or access PayPal itself. The vulnerability exists because the plugin accepts webhook payloads without verifying they actually came from PayPal using the required cryptographic signature check.

• CVE-2026-8608MEDIUM 5.3

  The Event Monster WordPress plugin, used for event management and ticket sales, contains a flaw that allows attackers to create fake payment records without actually paying. An unauthenticated attacker can submit forged transaction details through the plugin's payment handler, tricking the system into marking bookings as completed and issuing valid QR code tickets. This bypasses payment verification entirely, enabling ticket fraud on any affected WordPress site.

• CVE-2026-9189MEDIUM 5.3

  The Contact Form 7 – PayPal & Stripe Add-on WordPress plugin contains a payment validation flaw that allows attackers to mark high-value orders as completed without paying the correct amount. An attacker can make a small legitimate PayPal payment, then submit a forged payment notification (IPN) that references a different, expensive order. Because the plugin fails to verify that the payment amount and recipient email match the target order, the attacker's notification is accepted and the high-value order is incorrectly marked as paid. This affects all versions up to and including 2.4.9.

• CVE-2026-47696MEDIUM 4.3

  WWBN AVideo, an open-source video hosting platform, contains a payment processing vulnerability in versions 29.0 and earlier. When both the AuthorizeNet and YPTWallet plugins are active, any logged-in user can artificially inflate their account wallet balance without actually paying. The vulnerable endpoint accepts a user-supplied amount parameter and immediately credits the wallet without verifying that a real payment transaction occurred through Authorize.Net. This is a financial manipulation flaw that bypasses payment authentication entirely.