SEC.co
Emergency

By weakness (CWE)

CWE-350: related vulnerabilities

CVEs classified under CWE-350. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

3 published vulnerabilities

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-36604MEDIUM 6.5

    A Mercusys AC12G (EU) V1 router running firmware version AC12G(EU)_V1_200909 fails to validate the HTTP Host header in requests, creating an opening for DNS rebinding attacks. When an attacker controls a domain, they can redirect that domain to the router's internal IP address. The router's existing CORS misconfiguration (which already allows requests from any origin) amplifies this weakness, permitting the attacker to extract sensitive information from the router's web interface as if the request came from a trusted source. This vulnerability requires user interaction—typically visiting a malicious website—but does not require authentication.

  • CVE-2026-46611MEDIUM 5.3

    Glances, a popular open-source system monitoring tool, contains a vulnerability in its XML-RPC server (activated with the -s flag) that fails to validate the HTTP Host header. This omission enables DNS rebinding attacks, where an attacker tricks a user's browser into connecting to the Glances server and extracting sensitive system monitoring data—CPU usage, memory, disk space, network statistics, running processes—without the user's knowledge. The attack requires user interaction (typically visiting a malicious website) but can expose comprehensive system information. The vulnerability affects all versions prior to 4.5.5 and is resolved in that release.

  • CVE-2026-12635NONE 0.0

    GitLab has patched a server-side request forgery (SSRF) vulnerability affecting multiple versions of GitLab Community and Enterprise editions. The flaw allowed authenticated users with maintainer-level permissions to bypass URL validation during mirror synchronization, potentially enabling them to make requests to internal network resources. The vulnerability required specific conditions and user interaction through the mirror sync feature, limiting its practical exposure.