By weakness (CWE)

CWE-940: related vulnerabilities

CVEs classified under CWE-940. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-44698HIGH 8.3

  Home Assistant Companion apps for iOS and Android contain a vulnerability that allows malicious websites viewed in the app to steal a user's access token and run code as if they were logged into Home Assistant. The flaw stems from improper protection of a JavaScript bridge that connects web content to native app functionality. An attacker can craft a webpage with hidden content that tricks the bridge into executing arbitrary commands with the victim's credentials, effectively compromising their Home Assistant account.

• CVE-2026-45353HIGH 7.8

  Electerm, an open-source multi-protocol terminal and remote access client supporting SSH, SFTP, Telnet, serial ports, RDP, VNC, Spice, and FTP, contains a high-severity vulnerability affecting versions 3.0.6 through 3.8.8. The issue stems from improper file permissions and unsafe code execution patterns that allow a local attacker with standard user privileges to gain full control over system resources—reading sensitive data, modifying files, and disrupting availability. The vulnerability is resolved in version 3.9.0.

• CVE-2026-44894HIGH 7.5

  Netty versions prior to 4.2.15.Final contain a flaw in their default token validation logic for QUIC connections. When an application uses Netty's NoQuicTokenHandler (the built-in fallback when no custom handler is configured), the server incorrectly treats unauthenticated tokens as valid. An attacker can exploit this by sending a specially crafted QUIC Initial packet with a spoofed victim IP address and arbitrary token bytes. The server will then bypass its normal traffic rate-limiting safeguards and send full-size handshake responses (including certificates) toward the spoofed IP without restriction. This enables a reflection-based amplification attack where the attacker uses your Netty server to overwhelm a victim with QUIC handshake traffic.

• CVE-2026-6734HIGH 7.5

  A vulnerability in Node.js undici's Socks5ProxyAgent causes it to reuse a single connection pool across multiple destination origins without validation. This means when an application makes requests to different servers through a proxy, undici incorrectly routes requests intended for one destination through a connection pool established for another destination. The result is that sensitive credentials and data meant for origin B get sent to origin A instead, responses from the wrong server are trusted as legitimate, and HTTPS connections may be downgraded to unencrypted HTTP. This affects applications that use Socks5ProxyAgent (either directly or through the global dispatcher) and communicate with more than one origin. The defect was introduced in version 7.23.0 and persists through version 8.1.0.

• CVE-2026-54106MEDIUM 4.7

  The U.S. Government Accountability Office (GAO) operates two critical federal docketing systems—the Electronic Protest Docketing System (EPDS) and the Civilian Board of Contract Appeals Electronic Docketing System (EDS)—that process sensitive government contract disputes. Both systems fail to properly validate the X-Forwarded-For HTTP header, a field that applications often use to identify the true client IP address in proxy or load-balancer scenarios. An attacker who has already compromised administrator credentials can abuse this validation gap to bypass network-level access controls and successfully authenticate. This is a privilege abuse scenario rather than an unauthenticated attack: the adversary needs valid admin credentials but can then circumvent IP-based restrictions that might otherwise limit where those credentials can be used.